snakebot | 2af962ad399e4fb17c59924ca84653c7044dd779f4e9e907813fced175b6611e

Analysis

max time kernel
1807s
max time network
1813s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2023 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

script.bat
Size

58B
MD5

0ee707c240e98ab4c3e14f76a5d6d107
SHA1

34cb86eaaca7d7da1532d193bd8d27b75fdf34ee
SHA256

2af962ad399e4fb17c59924ca84653c7044dd779f4e9e907813fced175b6611e
SHA512

147444ea1708ca7e8477ff64a63cc21741d79b58046d3b10a2720f369719f505b9c3f5bee58d08a477a016c07d96d3d7c36f3b330a9a67f381e07762a096c4ed

Score

10^/10

snakebot discovery evasion persistence pyinstaller ransomware snakebot spyware stealer

Malware Config

Signatures

SnakeBOT
SnakeBOT is a heavily obfuscated .NET downloader.
snakebot
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Contains SnakeBOT related strings 2 IoCs

snakebot

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\rockyou.txt.tar	snakebot_strings
C:\Users\Admin\Downloads\rockyou.txt	snakebot_strings

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

670 7028 powershell.exe
Downloads MZ/PE file

flow	pid	process
670	7028	powershell.exe

Drops file in Drivers directory 6 IoCs

Processes:

NPFInstall.exeRUNDLL32.EXE

description	ioc	process
File opened for modification	C:\Windows\system32\DRIVERS\SET1709.tmp	NPFInstall.exe
File created	C:\Windows\system32\DRIVERS\SET1709.tmp	NPFInstall.exe
File opened for modification	C:\Windows\system32\DRIVERS\npcap.sys	NPFInstall.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET94A6.tmp	RUNDLL32.EXE
File created	C:\Windows\system32\DRIVERS\SET94A6.tmp	RUNDLL32.EXE
File opened for modification	C:\Windows\system32\DRIVERS\USBPcap.sys	RUNDLL32.EXE

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

vc_redist.x64.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation	vc_redist.x64.exe

Executes dropped EXE 19 IoCs

Processes:

GDAccountRecoverTool.exeGDAccountRecoverTool.exeWireshark-win64-4.0.10.exevc_redist.x64.exevc_redist.x64.exeVC_redist.x64.exenpcap-1.71.exeNPFInstall.exeNPFInstall.exeNPFInstall.exeNPFInstall.exeUSBPcapSetup-1.5.4.0.exeUSBPcapCMD.exeWireshark.exeUSBPcapCMD.exedumpcap.exedumpcap.exedumpcap.exeukraine.exe

pid	process
456	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
5976	Wireshark-win64-4.0.10.exe
5540	vc_redist.x64.exe
4560	vc_redist.x64.exe
5544	VC_redist.x64.exe
392	npcap-1.71.exe
2600	NPFInstall.exe
4520	NPFInstall.exe
3580	NPFInstall.exe
6000	NPFInstall.exe
4244	USBPcapSetup-1.5.4.0.exe
5932	USBPcapCMD.exe
536	Wireshark.exe
3416	USBPcapCMD.exe
2660	dumpcap.exe
4460	dumpcap.exe
1804	dumpcap.exe
6704	ukraine.exe

Loads dropped DLL 64 IoCs

Processes:

GDAccountRecoverTool.exeWireshark-win64-4.0.10.exevc_redist.x64.exeVC_redist.x64.exenpcap-1.71.exeUSBPcapSetup-1.5.4.0.exeWireshark.exe

pid	process
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
5976	Wireshark-win64-4.0.10.exe
5976	Wireshark-win64-4.0.10.exe
5976	Wireshark-win64-4.0.10.exe
5976	Wireshark-win64-4.0.10.exe
5976	Wireshark-win64-4.0.10.exe
5976	Wireshark-win64-4.0.10.exe
5976	Wireshark-win64-4.0.10.exe
5976	Wireshark-win64-4.0.10.exe
4560	vc_redist.x64.exe
5956	VC_redist.x64.exe
392	npcap-1.71.exe
392	npcap-1.71.exe
392	npcap-1.71.exe
392	npcap-1.71.exe
392	npcap-1.71.exe
392	npcap-1.71.exe
392	npcap-1.71.exe
392	npcap-1.71.exe
392	npcap-1.71.exe
392	npcap-1.71.exe
392	npcap-1.71.exe
392	npcap-1.71.exe
392	npcap-1.71.exe
4244	USBPcapSetup-1.5.4.0.exe
4244	USBPcapSetup-1.5.4.0.exe
536	Wireshark.exe
536	Wireshark.exe
536	Wireshark.exe
536	Wireshark.exe
536	Wireshark.exe
536	Wireshark.exe
536	Wireshark.exe
536	Wireshark.exe
536	Wireshark.exe
536	Wireshark.exe
536	Wireshark.exe
536	Wireshark.exe
536	Wireshark.exe
536	Wireshark.exe
536	Wireshark.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

VC_redist.x64.exeRUNDLL32.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{8bdfe669-9705-4184-9368-db9ce581e0e7} = "\"C:\\ProgramData\\Package Cache\\{8bdfe669-9705-4184-9368-db9ce581e0e7}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	RUNDLL32.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 64 IoCs

Processes:

msiexec.exenpcap-1.71.exeDrvInst.exeNPFInstall.exe

description	ioc	process
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\Npcap\wpcap.dll	npcap-1.71.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8a930d61-5a86-9649-998f-c9db452d0050}\SETF2B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_b5b1a6e95c9e3ae5\NPCAP.inf	DrvInst.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\Npcap\Packet.dll	npcap-1.71.exe
File created	C:\Windows\system32\Npcap\NpcapHelper.exe	npcap-1.71.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\Npcap\WlanHelper.exe	npcap-1.71.exe
File created	C:\Windows\System32\DriverStore\Temp\{8a930d61-5a86-9649-998f-c9db452d0050}\SETF2B.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netpacer.inf_amd64_7d294c7fa012d315\netpacer.PNF	NPFInstall.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\Npcap\NpcapHelper.exe	npcap-1.71.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_b5b1a6e95c9e3ae5\npcap.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_a009d240f9b4a192\ndiscap.PNF	NPFInstall.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrass.inf_amd64_7f701cb29b5389d3\netrass.PNF	NPFInstall.exe
File created	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_b5b1a6e95c9e3ae5\npcap.PNF	NPFInstall.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\Npcap\wpcap.dll	npcap-1.71.exe
File created	C:\Windows\System32\DriverStore\Temp\{8a930d61-5a86-9649-998f-c9db452d0050}\SETF3B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8a930d61-5a86-9649-998f-c9db452d0050}\SETF2A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8a930d61-5a86-9649-998f-c9db452d0050}\npcap.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8a930d61-5a86-9649-998f-c9db452d0050}\NPCAP.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnwifi.inf_amd64_a2bfd066656fe297\netnwifi.PNF	NPFInstall.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_netservice.inf_amd64_9ab9cf10857f7349\c_netservice.PNF	NPFInstall.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ukraine_flag.jpg"	powershell.exe

Drops file in Program Files directory 64 IoCs

Processes:

Wireshark-win64-4.0.10.exe

description	ioc	process
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-open-qt5.png	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-tel-rtp-player_1.png	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\ADSL-LINE-EXT-MIB	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\VRRP-MIB	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\ACCOUNTING-FRAMEWORK-PIB-orig	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\FEEDBACK-FRAMEWORK-PIB-orig	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-mate-dns_pane.png	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\diameter\Starent.xml	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\profiles\No Reassembly\preferences	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\IANA-RTPROTO-MIB	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\SNA-NAU-MIB	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\radius\dictionary.wimax.wichorus	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\NOTIFICATION-LOG-MIB	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\ACCESSBIND-PIB-orig	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\dftest.exe	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\libxml2.dll	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\wka	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\radius\dictionary.aptilo	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\radius\dictionary.localweb	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\ChStatFlowGraph.html	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\DOCS-IETF-BPI2-MIB	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\IF-INVERTED-STACK-MIB	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\MIOX25-MIB	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\ChStatPacketLengths.html	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\radius\dictionary.cnergee	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\radius\dictionary.dhcp	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\radius\dictionary.telkom	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\CIRCUIT-IF-MIB	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\ChStatSummary.html	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\ChUseToolsMenuSection.html	Wireshark-win64-4.0.10.exe
File opened for modification	C:\Program Files\Wireshark\vc_redist.x64.exe	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\radius\dictionary.springtide	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\APS-MIB	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\EtherLike-MIB	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\GMPLS-TC-STD-MIB	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\AppToolsdumpcap.html	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-go-menu.png	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\diameter\Cisco.xml	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\radius\dictionary.actelis	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\radius\dictionary.zyxel	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\dtds\dc.dtd	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\IGMP-STD-MIB	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\SLAPM-MIB	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-sctp.png	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\uninstall-wireshark.exe	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\radius\dictionary.arbor	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\DISMAN-EXPRESSION-MIB	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\DS0-MIB	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\toolbar\x-capture-options.png	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\diameter\etsie2e4.xml	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\radius\dictionary.rfc6519	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\APPLETALK-MIB	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\RFC1414-MIB	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-mate-tcp-output.png	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\plugins\4.0\codecs\g711.dll	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\POLICY-FRAMEWORK-PIB	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\ChIOMergeSection.html	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\ChStatTCPStreamGraphs.html	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\radius\dictionary.azaire	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\snmp\mibs\DOCS-IETF-QOS-MIB	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\ChIOOpenSection.html	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-capture-menu.png	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-packet-sep-win.png	Wireshark-win64-4.0.10.exe
File created	C:\Program Files\Wireshark\libgcc_s_seh-1.dll	Wireshark-win64-4.0.10.exe

Drops file in Windows directory 21 IoCs

Processes:

msiexec.exeDrvInst.exeNPFInstall.exesvchost.exe

description	ioc	process
File created	C:\Windows\Installer\SourceHash{D5D19E2F-7189-42FE-8103-92CD1FA457C2}	msiexec.exe
File opened for modification	C:\Windows\Installer\e65a363.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB5A2.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0025DD72-A959-45B5-A0A3-7EFEB15A8050}	msiexec.exe
File created	C:\Windows\Installer\e65a378.msi	msiexec.exe
File created	C:\Windows\Installer\e65a350.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAB20.tmp	msiexec.exe
File created	C:\Windows\Installer\e65a362.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\INF\oem3.PNF	NPFInstall.exe
File opened for modification	C:\Windows\Installer\e65a350.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e65a363.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	NPFInstall.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAE00.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB9BA.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Detects Pyinstaller 4 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\Unconfirmed 535911.crdownload	pyinstaller
C:\Users\Admin\Downloads\GDAccountRecoverTool.exe	pyinstaller
C:\Users\Admin\Downloads\GDAccountRecoverTool.exe	pyinstaller
C:\Users\Admin\Downloads\GDAccountRecoverTool.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 43 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

svchost.exeDrvInst.exeNPFInstall.exevssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e909c866916b25070000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e909c8660000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e909c866000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de909c866000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e909c86600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	NPFInstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	NPFInstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dumpcap.exedumpcap.exerunonce.exeWireshark.exedumpcap.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dumpcap.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Wireshark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	dumpcap.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	dumpcap.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	dumpcap.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Wireshark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Wireshark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Wireshark.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	dumpcap.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	dumpcap.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	dumpcap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Wireshark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Wireshark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dumpcap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Wireshark.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 59 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1c	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1d	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1D	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe

Modifies registry class 64 IoCs

Processes:

GDAccountRecoverTool.exemsiexec.exeWireshark-win64-4.0.10.exeVC_redist.x64.exeVC_redist.x64.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "4"	GDAccountRecoverTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	GDAccountRecoverTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\27DD5200959A5B540A3AE7EF1BA50805\VC_Runtime_Additional	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tpc	Wireshark-win64-4.0.10.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	GDAccountRecoverTool.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wireshark-capture-file\DefaultIcon	Wireshark-win64-4.0.10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pcap\ = "wireshark-capture-file"	Wireshark-win64-4.0.10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.enc\ = "wireshark-capture-file"	Wireshark-win64-4.0.10.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	GDAccountRecoverTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tr1\ = "wireshark-capture-file"	Wireshark-win64-4.0.10.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	GDAccountRecoverTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2E91D5D9817EF24183029DCF14A752C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2E91D5D9817EF24183029DCF14A752C\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\27DD5200959A5B540A3AE7EF1BA50805	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.atc	Wireshark-win64-4.0.10.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	GDAccountRecoverTool.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.atc\ = "wireshark-capture-file"	Wireshark-win64-4.0.10.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	GDAccountRecoverTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe1100000075ea9bafc005da01aa54acb2c005da01a13456b5c005da0114000000	GDAccountRecoverTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.36.32532"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e80922b16d365937a46956b92703aca08af0000	GDAccountRecoverTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tr1	Wireshark-win64-4.0.10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pkt\ = "wireshark-capture-file"	Wireshark-win64-4.0.10.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000000000001000000ffffffff	GDAccountRecoverTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	GDAccountRecoverTool.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wireshark-capture-file\Shell\open\command	Wireshark-win64-4.0.10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pcapng\ = "wireshark-capture-file"	Wireshark-win64-4.0.10.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	GDAccountRecoverTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\27DD5200959A5B540A3AE7EF1BA50805\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pkt	Wireshark-win64-4.0.10.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	GDAccountRecoverTool.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	GDAccountRecoverTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2E91D5D9817EF24183029DCF14A752C\Servicing_Key	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bfr	Wireshark-win64-4.0.10.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	GDAccountRecoverTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wpz\ = "wireshark-capture-file"	Wireshark-win64-4.0.10.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pcapng	Wireshark-win64-4.0.10.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	GDAccountRecoverTool.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.36.32532"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\PackageCode = "1BE5B2DDE80EDC54D874D240756DB43A"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wireshark-capture-file\DefaultIcon\ = "\"C:\\Program Files\\Wireshark\\Wireshark.exe\",1"	Wireshark-win64-4.0.10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\27DD5200959A5B540A3AE7EF1BA50805	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.trace\ = "wireshark-capture-file"	Wireshark-win64-4.0.10.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pcap	Wireshark-win64-4.0.10.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	GDAccountRecoverTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.36,bundle\Version = "14.36.32532.0"	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27DD5200959A5B540A3AE7EF1BA50805\Version = "237272852"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wireshark-capture-file\Shell	Wireshark-win64-4.0.10.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2E91D5D9817EF24183029DCF14A752C\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	GDAccountRecoverTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	GDAccountRecoverTool.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X64,AMD64,14.30,BUNDLE\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle	VC_redist.x64.exe

NTFS ADS 4 IoCs

Processes:

msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 602151.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 159977.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 535911.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 661737.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

6060 NOTEPAD.EXE
Runs net.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

Wireshark.exe

pid process

536 Wireshark.exe

pid	process
6060	NOTEPAD.EXE

pid	process
536	Wireshark.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsiexec.exeNPFInstall.exepowershell.exepowershell.exemsedge.exepowershell.exepowershell.exemsedge.exe

pid	process
2072	msedge.exe
2072	msedge.exe
8	msedge.exe
8	msedge.exe
2948	identity_helper.exe
2948	identity_helper.exe
800	msedge.exe
800	msedge.exe
1888	msedge.exe
1888	msedge.exe
5916	msedge.exe
5916	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
1324	msedge.exe
1324	msedge.exe
6020	msiexec.exe
6020	msiexec.exe
6020	msiexec.exe
6020	msiexec.exe
6020	msiexec.exe
6020	msiexec.exe
6020	msiexec.exe
6020	msiexec.exe
2600	NPFInstall.exe
2600	NPFInstall.exe
5184	powershell.exe
5184	powershell.exe
5184	powershell.exe
5548	powershell.exe
5548	powershell.exe
5548	powershell.exe
6472	msedge.exe
6472	msedge.exe
7028	powershell.exe
7028	powershell.exe
7028	powershell.exe
5080	powershell.exe
5080	powershell.exe
5080	powershell.exe
2396	msedge.exe
2396	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

GDAccountRecoverTool.exeWireshark.exe

pid process

856 GDAccountRecoverTool.exe
536 Wireshark.exe
Suspicious behavior: LoadsDriver 6 IoCs

Processes:

pid process

648
648
648
648
648
648

pid	process
648
648
648
648
648
648

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 63 IoCs

Processes:

msedge.exe

pid	process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zG.exe7zG.exevssvc.exeVC_redist.x64.exemsiexec.exe

description	pid	process
Token: SeRestorePrivilege	4120	7zG.exe
Token: 35	4120	7zG.exe
Token: SeSecurityPrivilege	4120	7zG.exe
Token: SeSecurityPrivilege	4120	7zG.exe
Token: SeRestorePrivilege	6000	7zG.exe
Token: 35	6000	7zG.exe
Token: SeSecurityPrivilege	6000	7zG.exe
Token: SeSecurityPrivilege	6000	7zG.exe
Token: SeBackupPrivilege	4484	vssvc.exe
Token: SeRestorePrivilege	4484	vssvc.exe
Token: SeAuditPrivilege	4484	vssvc.exe
Token: SeShutdownPrivilege	5544	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	5544	VC_redist.x64.exe
Token: SeSecurityPrivilege	6020	msiexec.exe
Token: SeCreateTokenPrivilege	5544	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	5544	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	5544	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	5544	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	5544	VC_redist.x64.exe
Token: SeTcbPrivilege	5544	VC_redist.x64.exe
Token: SeSecurityPrivilege	5544	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	5544	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	5544	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	5544	VC_redist.x64.exe
Token: SeSystemtimePrivilege	5544	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	5544	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	5544	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	5544	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	5544	VC_redist.x64.exe
Token: SeBackupPrivilege	5544	VC_redist.x64.exe
Token: SeRestorePrivilege	5544	VC_redist.x64.exe
Token: SeShutdownPrivilege	5544	VC_redist.x64.exe
Token: SeDebugPrivilege	5544	VC_redist.x64.exe
Token: SeAuditPrivilege	5544	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	5544	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	5544	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	5544	VC_redist.x64.exe
Token: SeUndockPrivilege	5544	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	5544	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	5544	VC_redist.x64.exe
Token: SeManageVolumePrivilege	5544	VC_redist.x64.exe
Token: SeImpersonatePrivilege	5544	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	5544	VC_redist.x64.exe
Token: SeRestorePrivilege	6020	msiexec.exe
Token: SeTakeOwnershipPrivilege	6020	msiexec.exe
Token: SeRestorePrivilege	6020	msiexec.exe
Token: SeTakeOwnershipPrivilege	6020	msiexec.exe
Token: SeRestorePrivilege	6020	msiexec.exe
Token: SeTakeOwnershipPrivilege	6020	msiexec.exe
Token: SeRestorePrivilege	6020	msiexec.exe
Token: SeTakeOwnershipPrivilege	6020	msiexec.exe
Token: SeRestorePrivilege	6020	msiexec.exe
Token: SeTakeOwnershipPrivilege	6020	msiexec.exe
Token: SeRestorePrivilege	6020	msiexec.exe
Token: SeTakeOwnershipPrivilege	6020	msiexec.exe
Token: SeRestorePrivilege	6020	msiexec.exe
Token: SeTakeOwnershipPrivilege	6020	msiexec.exe
Token: SeRestorePrivilege	6020	msiexec.exe
Token: SeTakeOwnershipPrivilege	6020	msiexec.exe
Token: SeRestorePrivilege	6020	msiexec.exe
Token: SeTakeOwnershipPrivilege	6020	msiexec.exe
Token: SeRestorePrivilege	6020	msiexec.exe
Token: SeTakeOwnershipPrivilege	6020	msiexec.exe
Token: SeRestorePrivilege	6020	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe7zG.exe7zG.exe

pid	process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
4120	7zG.exe
6000	7zG.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

Processes:

msedge.exe

pid	process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

GDAccountRecoverTool.exeWireshark.exemsedge.exe

pid	process
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
856	GDAccountRecoverTool.exe
536	Wireshark.exe
536	Wireshark.exe
2072	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2072 wrote to memory of 3388	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 3388	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1508	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 8	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 8	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1632	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1632	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1632	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1632	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1632	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1632	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1632	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1632	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1632	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1632	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1632	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1632	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1632	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1632	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1632	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1632	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1632	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1632	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1632	2072	msedge.exe	msedge.exe
PID 2072 wrote to memory of 1632	2072	msedge.exe	msedge.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\script.bat"
1⤵
PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd42e446f8,0x7ffd42e44708,0x7ffd42e44718
2⤵
PID:3388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
2⤵
PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
2⤵
PID:1632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
2⤵
PID:984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
2⤵
PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
2⤵
PID:3164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
2⤵
PID:2244

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3648 /prefetch:8
2⤵
PID:2616

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3648 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
2⤵
PID:3876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
2⤵
PID:3848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
2⤵
PID:1708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
2⤵
PID:1824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
2⤵
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5060 /prefetch:8
2⤵
PID:2744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5940 /prefetch:8
2⤵
PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
2⤵
PID:5296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
2⤵
PID:5288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
2⤵
PID:5596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1800 /prefetch:1
2⤵
PID:5728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1804 /prefetch:1
2⤵
PID:5988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6132 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1968 /prefetch:8
2⤵
PID:4700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
2⤵
PID:5556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
2⤵
PID:3544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
2⤵
PID:5856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
2⤵
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
2⤵
PID:2528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1
2⤵
PID:5788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1084 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5248 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=244 /prefetch:1
2⤵
PID:1952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
2⤵
PID:5148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
2⤵
PID:5868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
2⤵
PID:1532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6880 /prefetch:8
2⤵
PID:5496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1324

C:\Users\Admin\Downloads\Wireshark-win64-4.0.10.exe
"C:\Users\Admin\Downloads\Wireshark-win64-4.0.10.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
PID:5976

C:\Program Files\Wireshark\vc_redist.x64.exe
"C:\Program Files\Wireshark\vc_redist.x64.exe" /install /quiet /norestart
3⤵
- Executes dropped EXE
PID:5540

C:\Windows\Temp\{F6908797-60F6-4027-A581-8245AD1786EF}\.cr\vc_redist.x64.exe
"C:\Windows\Temp\{F6908797-60F6-4027-A581-8245AD1786EF}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Program Files\Wireshark\vc_redist.x64.exe" -burn.filehandle.attached=712 -burn.filehandle.self=564 /install /quiet /norestart
4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:4560

C:\Windows\Temp\{58151C1E-BA8D-407A-BDB1-55E0EA3A08C0}\.be\VC_redist.x64.exe
"C:\Windows\Temp\{58151C1E-BA8D-407A-BDB1-55E0EA3A08C0}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{209CFCCE-BC0B-4397-8DE4-419572B0010D} {D716E415-D680-440F-AA29-2E060B8FBB04} 4560
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5544

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1032 -burn.embedded BurnPipe.{22E3319F-6BC4-47A1-8C59-737610C1AD57} {E839C3F1-0EF6-4030-81E8-B3A883A4F1A4} 5544
6⤵
PID:3764

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=584 -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1032 -burn.embedded BurnPipe.{22E3319F-6BC4-47A1-8C59-737610C1AD57} {E839C3F1-0EF6-4030-81E8-B3A883A4F1A4} 5544
7⤵
- Loads dropped DLL
PID:5956

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{6988BD3F-894B-412C-A5BA-3754E3932BAE} {BE38181E-DDF8-47EC-A5C2-80CA48BE2E75} 5956
8⤵
- Modifies registry class
PID:1784

C:\Program Files\Wireshark\npcap-1.71.exe
"C:\Program Files\Wireshark\npcap-1.71.exe" /winpcap_mode=no /loopback_support=no
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:392

C:\Users\Admin\AppData\Local\Temp\nsyC9D6.tmp\NPFInstall.exe
"C:\Users\Admin\AppData\Local\Temp\nsyC9D6.tmp\NPFInstall.exe" -n -check_dll
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2600

C:\Windows\SysWOW64\certutil.exe
certutil -addstore -f "Root" "C:\Users\Admin\AppData\Local\Temp\nsyC9D6.tmp\roots.p7b"
4⤵
PID:624

C:\Windows\SysWOW64\certutil.exe
certutil -addstore -f "TrustedPublisher" "C:\Users\Admin\AppData\Local\Temp\nsyC9D6.tmp\signing.p7b"
4⤵
PID:4452

C:\Program Files\Npcap\NPFInstall.exe
"C:\Program Files\Npcap\NPFInstall.exe" -n -c
4⤵
- Executes dropped EXE
PID:4520

C:\Windows\SYSTEM32\pnputil.exe
pnputil.exe -e
5⤵
PID:5716

C:\Program Files\Npcap\NPFInstall.exe
"C:\Program Files\Npcap\NPFInstall.exe" -n -iw
4⤵
- Executes dropped EXE
PID:3580

C:\Program Files\Npcap\NPFInstall.exe
"C:\Program Files\Npcap\NPFInstall.exe" -n -i
4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:6000

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Microsoft.PowerShell.Management\Start-Service -Name npcap -PassThru | Microsoft.PowerShell.Management\Stop-Service -PassThru | Microsoft.PowerShell.Management\Start-Service"
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5184

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "ScheduledTasks\Register-ScheduledTask -Force -TaskName 'npcapwatchdog' -Description 'Ensure Npcap service is configured to start at boot' -Action (ScheduledTasks\New-ScheduledTaskAction -Execute 'C:\Program Files\Npcap\CheckStatus.bat') -Principal (ScheduledTasks\New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount) -Trigger (ScheduledTasks\New-ScheduledTaskTrigger -AtStartup) -Settings (ScheduledTasks\New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Compatibility Win8)"
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5548

C:\Program Files\Wireshark\USBPcapSetup-1.5.4.0.exe
"C:\Program Files\Wireshark\USBPcapSetup-1.5.4.0.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4244

C:\Windows\system32\RUNDLL32.EXE
C:\Windows\system32\RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 .\USBPcap.inf
4⤵
- Drops file in Drivers directory
- Adds Run key to start application
PID:1500

C:\Windows\system32\runonce.exe
"C:\Windows\system32\runonce.exe" -r
5⤵
- Checks processor information in registry
PID:5568

C:\Windows\System32\grpconv.exe
"C:\Windows\System32\grpconv.exe" -o
6⤵
PID:3556

C:\Program Files\USBPcap\USBPcapCMD.exe
"C:\Program Files\USBPcap\USBPcapCMD.exe" -I
4⤵
- Executes dropped EXE
PID:5932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
2⤵
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
2⤵
PID:1948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
2⤵
PID:1380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:1
2⤵
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
2⤵
PID:5880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
2⤵
PID:4044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7228 /prefetch:1
2⤵
PID:2240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7420 /prefetch:1
2⤵
PID:1836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7572 /prefetch:1
2⤵
PID:5380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7528 /prefetch:1
2⤵
PID:5176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
2⤵
PID:5464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8408 /prefetch:1
2⤵
PID:2932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7972 /prefetch:1
2⤵
PID:1608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8240 /prefetch:1
2⤵
PID:5140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9096 /prefetch:1
2⤵
PID:3888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9144 /prefetch:1
2⤵
PID:3088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8100 /prefetch:1
2⤵
PID:5184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8608 /prefetch:1
2⤵
PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7748 /prefetch:1
2⤵
PID:5716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7728 /prefetch:1
2⤵
PID:5732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9908 /prefetch:1
2⤵
PID:5296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9916 /prefetch:1
2⤵
PID:5616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10216 /prefetch:1
2⤵
PID:508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9544 /prefetch:8
2⤵
PID:3996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9608 /prefetch:1
2⤵
PID:4304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9780 /prefetch:1
2⤵
PID:4020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10688 /prefetch:1
2⤵
PID:4312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10696 /prefetch:1
2⤵
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11076 /prefetch:1
2⤵
PID:2356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11100 /prefetch:1
2⤵
PID:656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11360 /prefetch:1
2⤵
PID:5568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11480 /prefetch:1
2⤵
PID:5820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=11012 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6472

C:\Users\Admin\Downloads\ukraine.exe
"C:\Users\Admin\Downloads\ukraine.exe"
2⤵
- Executes dropped EXE
PID:6704

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://upload.wikimedia.org/wikipedia/commons/thumb/5/58/Flag_of_Ukraine_2.svg/1280px-Flag_of_Ukraine_2.svg.png' -OutFile '%TEMP%\ukraine_flag.jpg'"
3⤵
PID:7012

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://upload.wikimedia.org/wikipedia/commons/thumb/5/58/Flag_of_Ukraine_2.svg/1280px-Flag_of_Ukraine_2.svg.png' -OutFile 'C:\Users\Admin\AppData\Local\Temp\ukraine_flag.jpg'"
4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:7028

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -Command "Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Wallpaper { [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni); }'; [Wallpaper]::SystemParametersInfo(20, 0, '%TEMP%\ukraine_flag.jpg', 3)"
3⤵
PID:4744

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Wallpaper { [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni); }'; [Wallpaper]::SystemParametersInfo(20, 0, 'C:\Users\Admin\AppData\Local\Temp\ukraine_flag.jpg', 3)"
4⤵
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
PID:5080

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l1nrrthk\l1nrrthk.cmdline"
5⤵
PID:1692

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES25E6.tmp" "c:\Users\Admin\AppData\Local\Temp\l1nrrthk\CSCC8486ED8738C4AF6A7BB5F875B9B8C4C.TMP"
6⤵
PID:3912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8076 /prefetch:1
2⤵
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10988 /prefetch:1
2⤵
PID:6788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8516 /prefetch:1
2⤵
PID:5848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11200 /prefetch:1
2⤵
PID:5808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7972 /prefetch:1
2⤵
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7660 /prefetch:1
2⤵
PID:1552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=11444 /prefetch:8
2⤵
PID:3160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9104 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10280 /prefetch:1
2⤵
PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1326156829315154303,11918980631800219664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7300 /prefetch:1
2⤵
PID:6140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2376

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4200

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap25144:90:7zEvent19282
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4120

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap31032:84:7zEvent8048
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6000

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\rockyou.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:6060

C:\Users\Admin\Downloads\GDAccountRecoverTool.exe
"C:\Users\Admin\Downloads\GDAccountRecoverTool.exe"
1⤵
- Executes dropped EXE
PID:456

C:\Users\Admin\Downloads\GDAccountRecoverTool.exe
"C:\Users\Admin\Downloads\GDAccountRecoverTool.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
3⤵
PID:6084

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:6032

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:5688

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{51dc2174-36ec-7e46-acba-327781528f3c}\NPCAP.inf" "9" "405306be3" "0000000000000140" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files\Npcap"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5608

C:\Program Files\Wireshark\Wireshark.exe
"C:\Program Files\Wireshark\Wireshark.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:536

C:\Program Files\Wireshark\extcap\USBPcapCMD.exe
"C:\Program Files\Wireshark\extcap\USBPcapCMD.exe" --extcap-interfaces --extcap-version=4.0
2⤵
- Executes dropped EXE
PID:3416

C:\Program Files\Wireshark\dumpcap.exe
"C:\Program Files\Wireshark\dumpcap.exe" -D -Z none
2⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2660

C:\Program Files\Wireshark\dumpcap.exe
"C:\Program Files\Wireshark\dumpcap.exe" -i \Device\NPF_Loopback -L --list-time-stamp-types -Z none
2⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4460

C:\Program Files\Wireshark\dumpcap.exe
"C:\Program Files\Wireshark\dumpcap.exe" -S -Z 536.dummy
2⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1804

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:5960

C:\Windows\system32\net.exe
net tsart npcap
2⤵
PID:3684

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 tsart npcap
3⤵
PID:3716

C:\Windows\system32\net.exe
net start npcap
2⤵
PID:5904

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start npcap
3⤵
PID:5736

C:\Windows\system32\net.exe
net start npf
2⤵
PID:5236

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start npf
3⤵
PID:4964

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc 0x2d8
1⤵
PID:1624

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc 0x2d8
1⤵
PID:5264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e65a355.rbs

Filesize
19KB

MD5
affc5f8d986d890fd7f80a4ae5045cd7

SHA1
1e84d7b9e17a4957ff166e06d3a77c6c370b4d5b

SHA256
86ccad49c33d0e1883d2c45edee0e48850778664f321d1d321ec026960742675

SHA512
3d03266fd21ae460f6b9e595cc26f6e46e61a4d3334dac7fef86210dd8766dd405195dcc9293869d31a0ffdc80ca6c08e2d578aafa143a25f4eb0f160ccd4f57

Download Submit
C:\Config.Msi\e65a361.rbs

Filesize
19KB

MD5
75c8e2f32926e40da3cae919cf4bbbb9

SHA1
51ee4df08fd100298ef7ec6452058e20519bd67f

SHA256
9e813a48b9bd216016af50eb9dc6339066f490fd6a7470ec9c2fb569849635ad

SHA512
f4d902384e6efe54ac8c508e9e1167f646a96dccb8dfb247d90409c5ac946dea7834348b95e4c806dcf596ec5d65593497e5c40aca8e048ddfcc3abca04c4562

Download Submit
C:\Config.Msi\e65a368.rbs

Filesize
21KB

MD5
d633deedad8a7bf1ac904ee7d940c683

SHA1
12ff897cdda88942b619b49720a2cfe283618e1c

SHA256
056b1c780653d8f21dac1170778cbc40649bb6a39ca3df65e168462910e50f79

SHA512
19e7ca5049462d3bf13358b8a2ad75352967244e11cf67d7a3850e046df8991831e3b88333cbfff23d8733feb2ecc9ef4ea97326611e681fead68ff22178479f

Download Submit
C:\Config.Msi\e65a377.rbs

Filesize
21KB

MD5
580cf12ea593cc9aa0a58feeb574c362

SHA1
c2687f02371b7d4e351b7947f3244036d3baa578

SHA256
89ccd989c88c813f661dd75fa9b79bd3754d08ec66605871e1ca826f4d58be02

SHA512
e8680c5fd9d17a879eb9a87c8b67166ab3700309efd90040e71a4e247df0a6a804d00a7f751c31b3e0af0746db66d338ba4320056e92c2ca55732b2fa8ed5438

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
1KB

MD5
d3bc4013bfcd8b8581a1ae3e3a0e3389

SHA1
401dd64673127d1ce309f75b1066cab9eac96ef4

SHA256
661a014ede3eff0c9dbf2a423b46d98a4e6e588e404627a41c6b69a92f7a90a8

SHA512
c342156a4095e9fc189086af24155fb0d769c8452c9b2f051f74e930335b62ada0675174f4a5cc171f8b73fd35452e1e6eddc810c9372d813244976ba07c5d02

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
1KB

MD5
d3bc4013bfcd8b8581a1ae3e3a0e3389

SHA1
401dd64673127d1ce309f75b1066cab9eac96ef4

SHA256
661a014ede3eff0c9dbf2a423b46d98a4e6e588e404627a41c6b69a92f7a90a8

SHA512
c342156a4095e9fc189086af24155fb0d769c8452c9b2f051f74e930335b62ada0675174f4a5cc171f8b73fd35452e1e6eddc810c9372d813244976ba07c5d02

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
1KB

MD5
5b16e0278a57ab32e7336f0d1ee557d9

SHA1
e002b823d24dc9279b5c9d9aa5002e169d139fd0

SHA256
690e3bfa3b22e63017a44e8ace0431d732e99c78c198aa2918aeed8665457ad3

SHA512
3700c102ddfbceddee1b6b321058927656ae9384a4280ed1376485473efddf3805d66a9aadf07022891143b78bfcd07747e55a2302b9ec6060a242f3ca983cc6

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
3KB

MD5
b61dfefa090b8bde51e86b53a8b811c9

SHA1
c37a0d61c756f79ab343ddd4daecad917541151e

SHA256
1dd59e14f5795e18abcb8a3e4a8127d659c5b3fcef304640441e21caf549dcdc

SHA512
27e6cca02bd2468e3d1e78b1e7fc467d19f5373a0231f61fd481887c4ef8f635e721f007f5c7d74b28ffc95cb393c55e29c6c0dd3d4a76e4c73b6209c3269c2d

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
3KB

MD5
ad5bb4a358a5b51c291b20c90c54620a

SHA1
5152ec6965f135014ed1ff4339d759cb6edede6b

SHA256
a8e3ca5fa25468526d40796001bafbc1ab8a2d71b6e6def4d55f59aedcc12c51

SHA512
c17373f1a5dbf10f781c59f59009e66e37e69b1d6c72b914d092467b5d91a53fce78dd542f5a210907efa553bf9aecc5b5a8fcb632e2d84ef5e97d8a1b18e4c0

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
4KB

MD5
311f16552ecd6c5048403cb3c850e8bb

SHA1
5da3757a69aa5deb02808c24dc678a1c58be3f7d

SHA256
f787084dd4ffa6bd65c50328e570c9d12d3acb47cab2ca43bae98c7f26d03efa

SHA512
3181f1c27898f9163e7bd0dcf5d51f7e6494965e0a5eceaaaa257f8b21aca242d6ba713d75e00c3d38f76794bf860dcc7ffdd3bfd2bb8a00332febaba9dda6cb

Download Submit
C:\Program Files\Wireshark\Wireshark.exe

Filesize
8.6MB

MD5
bb8e8e283cecb20bfc46f33f483bc9e9

SHA1
8902d53a0566306b1c5ca9b83398c43a3ed4bd0f

SHA256
2ac8dc6b113af3a7f012cd91561138f74863768ea3a1f5cdd760faafe15fc508

SHA512
d3d3e3f471bc608ce5c167ffa108181e07c835d1bfd7ecc60f3a0cfa0b988fdd0b7a7de725438f184e77272cb12963c379f6e258d5db215f40b4c6581ac769bd

Download Submit
C:\Program Files\Wireshark\extcap\USBPcapCMD.exe

Filesize
55KB

MD5
939020f02ba0dffd7a7a1d45182c3bc4

SHA1
c219269325c53ed5d69343086dfdd853e533b072

SHA256
8b13173e9453fda9914d707c732880de44081e20e1113b3a2c827abd7a28b15d

SHA512
d0c09838a028bfbf3477fbf13d05753a3ec2fa7f87b92d94c516fbe9d35fb4c9b7fb85efa78d6c8fff8b4105cd8e2db107974800695b49dc85e3745b646c4055

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3bc9d8e5-c243-48bb-9982-167c28d09a26.tmp

Filesize
12KB

MD5
889078ccffbd023d5779c0a7420e2020

SHA1
5e1b167dd773a8f4934d648b271417d49b725a58

SHA256
a951525c2a569e9967c594cbe8ea7a9349e514d02d9eea5f3408cd2661cec210

SHA512
1db967ccc28aeec7b25133713f05cb0855e934c1123a8ab42e267f6158a218ee36f9451bf5bb402aa7ca19334a8ab253677c1336e3fd2f55f412df00e11f0636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
21KB

MD5
f0d11cde238eb54a334858a3b0432a3f

SHA1
7c764fe6f00cab8058caeba38eb7482088a378f4

SHA256
579adf148a5905868140df9075b90a2ff33c9070dfd35b3ab869a2d9aacd9a96

SHA512
b3e590c88b462004b29ced18027f640addd1ea6ce9ae584820054ca508ce7d626acb3bd729e3693b50ccdc5e4694b1aa400cb33a315a475de47f5b25ed964d02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
21KB

MD5
124bb16d61bd7e05fed02efe386fd67c

SHA1
f6a0c0fb70d79ea3d1142478888d07c9a5e81de0

SHA256
0f7b42c02adb65d2a8b61cec3e4229a377a49114b0fa43953a7d8fbccde0bb2f

SHA512
e05e34abd07f202ca06a8b356954490e3d97d92186108eb5b2d66eed4fc14eeb07e9f7d00e9ccd90bb29a16d2d677ac443680be74f48abe17478d31a72e2e6fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
36KB

MD5
3296f64a7a2bf91e144553e17654643b

SHA1
639b0f05038c69cfc21ad55ce92b92c71b9bb8ba

SHA256
4de9e2c37234da98c8be5f282084e5603918a287602df7f75af3f1bcf825781f

SHA512
45db48942642adc0e9d50c5cfdcc2cb44f8e2245f2248f5fbe7cd38c405d35a0f678446d31845a35136333c1b9d16112799d08bfcac28caa7d60039c04bc5ec6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
69KB

MD5
7f64f527eb916de76d5559f2af78c4c5

SHA1
a08d47d130d2025d8c678609fa857e4da5d34105

SHA256
76c12bca3ea33b6d5d0c248b8a7935e467a3cd35257cae3829d16a3dc5abf891

SHA512
6c706f7a5465a6bd002c004726e35719a1df7a8ce84d3ca620db22ae9016c4285cc344e8d080898fca2212b9c2e801e43951a55b46244e080086bf1dcedee56f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
85KB

MD5
45a177b92bc3dac4f6955a68b5b21745

SHA1
eac969dc4f81a857fdd380b3e9c0963d8d5b87d1

SHA256
2db3b6356f027b2185f1ca4bc6b53e64e428201e70e94d1977f8aab9b24afaeb

SHA512
f6a599340db91e2a4f48babd5f5939f87b907a66a82609347f53381e8712069c3002596156de79650511c644a287cbd8c607be0f877a918ae1392456d76b90ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
998KB

MD5
2d55c0b9836cb4f5b4bc05aa8c87895c

SHA1
a1dc5ca89c4ba722fe4a0a63a6c37e2fc90c73d6

SHA256
e8f498ce2db32c93693b051ce877f74192c881b143aff34ae5df0185b90fb53e

SHA512
fe8464bd1d2783fff8c4f38cca83e726780d6dbe9f0a9e0039b23a661defe498bc0c83aa6d1a4459a1d368b00bf1183a7d2983e3a65c8dcbe16a62da34172c95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
33KB

MD5
c2e3c144f359749c9e9808eca64257d2

SHA1
eca75b3ce4fbc041f8256689a81c7dc2bc5cc2e3

SHA256
e42091356819da9dfa73cbbf17d2e9e88da6eda201c38627165d29baa04de1a5

SHA512
cd717f7115dab4fd4ac7ec6a85915e6ba803ed9fb10313d8315637e95b46ff3859e4bda3247fb11137f53c94ef4dd74a49f5b7ad51acd1a6a201161d2133f3f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
74KB

MD5
c60fc26f87ddbef308737edf34ef65c6

SHA1
cac72a52856bd8696a66563883198d9d1e685410

SHA256
23e360f2d680bac47c218b199d688c80f72ff2f829a5150c74993f1fdfce1bf5

SHA512
ef2ad3901b32d3ff817afba6718ac6a5ca600546662b2543473bc32238a3b61c601f7803078f48020658fca8e2bca9bf8bbcca8fbbf52b503f30fa2b13758956

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
43KB

MD5
461fca0881aef0cd2fd12e1f24a7b466

SHA1
f1e58deafef86c0a518ffcda4aeff9d652fdb87d

SHA256
69a375a5abda534d6fbff863473e8724684d9af3ab9713a170117bf0cb49ac27

SHA512
bd0f3fe0cc52609985db24e7ffcb4215d1a8d12b0428ca707293291e1eafe4518c3c4ce60196cde654e028619396f1cacddb6433a383cc09ab9b98769e62ddb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
29KB

MD5
dbb436e8ea5882d3cfbe4fed916cba7d

SHA1
947827a1f7d2b721cedbedc7e74943b05829d1c1

SHA256
ad8cdef30da7a02b6ea353dc54a4b6108c65ad8903a77179c8c23e6c8e51f3fe

SHA512
f700e29c5b92b926b46f7ed74940053023951b68e1978c182f74a3e56c7b1971e672b497b4e4b36e8432074456f591722bd2413946a56d9af951c7c535e55dad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
40KB

MD5
65269f83b3989bdc604da0a567cbe42c

SHA1
a510143772cf0b6304d0eb134818723588391978

SHA256
1a68108ac918ecc66fede9f479826ba5bb0a92233d23a66ee4922109ff1cc78b

SHA512
2b36ca1cb3c1bf678b52bcc7cbe7515849a964167d805a377d19dc78a3922eebc3a5674b04d0de8dbbe71305456e71a6fffa12ca45ec6f68c2393bc586160ed7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
26KB

MD5
b179be434eb5008d9da2d46946a09afa

SHA1
e05c6308845ae95908afd075871973d7fc79d773

SHA256
ad1e5f54d47cfe0512b60622fc4194682d3d876a52fe808b5363955d1641cbc2

SHA512
0316961c0afaf56a7a049a9b0832e1928d6e5e4b56a2016ae34c459510196ac0095197546bd2de39fe591f9b7b1e0068fe6b5a4e44d4a1196aa606b252caaee3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
19KB

MD5
2c0a9b7b88ad07a8f371f676f5ee76ff

SHA1
85ecdc29f37bf254e61f5e1922421cb7bef874ce

SHA256
b0fa4ed82836b012df7e6983a775727d3d2c1226cc1377654d67a1728efb4567

SHA512
8c041ef500d64dae18e661170d1642d4c2cd66d703221e4db7927a5b3ac6b701ef4ed0953692849b9b4f9f192ca409651bb710f34ac5e8040a756439da4c06cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
61KB

MD5
88d8977ccc7d0430dd94ac97d63f6344

SHA1
63be441f1d8bc7b9cd3916b469a195cc37e5c63e

SHA256
ff569315d08c74890a4cd04ea0bf3fa8ac9e633e83132facd8d877871c3a0b95

SHA512
84cc75278160de4a2a3e1b960e3f354adb00ae9e02ad9af90f8db77db91d72a4f828d4e640b90f6871b9075bfc614b77e07bd2ca85d101e467b3b51c203ea3a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
26KB

MD5
a9acecea99a58292813bd5a469533dfe

SHA1
1cde625d079db861e8f0960e760a87e710cbbd17

SHA256
ec4eb3032bb25ec467c5b5dc0fcd5fc899c68040bdbd2388fc6d9bc1989c7992

SHA512
b8d41fc5289781d405109f8fee48c0625f1941cb1e04643ff3fba7110a9be14615cd5aa6887cc5ab4f314641db88c972a4745783eb9a6e573a670ba80026adda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
18KB

MD5
7219d29b54187cbcde991f6a26ad2b75

SHA1
5123551a5040b2fe3c40977d6a62dc1977367dea

SHA256
7610fd06afc38a4f6d83e0955dc8ab55adf0837406a96c4eeb6116544aeb2e2a

SHA512
0b0910787bf6a60e83537b50da089b4cc7993251dc17beb5317914062e038d755ee8848d3a2cb16920f1adb3e01e16059fb50cdcf5c83314d2b65fbb3b28ddf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
16KB

MD5
7c5274fe6abe2314d016cfbe340be855

SHA1
562a3dfd63be2c6481c4e370190c122b081f4ac1

SHA256
8857bd2d2f1679df695e348d27c884904d855987691567cec0a9a929cfbed1e2

SHA512
0a21b0514c9f90494acee0248a8025c09466349b27df327eaaed081b5f7e9c9234a0c51a6aac2013b4d38dd58c28d55b911f22189a5579ed3e74272e5f9ff478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006a

Filesize
266KB

MD5
af8b411fb091a512813459320af6801e

SHA1
461bf6a66e3383e6b655695cc77227b72fedad7e

SHA256
70c7f834d17caa74745c0dbd411b913dc14bfd6b0d4f5f2505c8e8e5b01311b1

SHA512
2b7bcb3f0e492cfda5df8d9e463952fdb94d7a592216b6fcf9783a66d91736b98fb049fbb99be5bb6d7780824a601f8f4a606bd6f4a1a274894c660d4e5fc466

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\071ffa3bd03bc997_0

Filesize
2KB

MD5
5da6b8cdb056ffa4f6fc9f926a28884d

SHA1
ef476a8f8e787db50d926a585bf5ca42c595a8cf

SHA256
9f0108ebcbd1a15f680dfa1e5a6d9b4062b27ff2335966473ca4b9aa7f879c1e

SHA512
9ad6a40dbe1e514d7c92582d144b1e16233d4e67e4d4f2feaa82b222ec504de2fcb9ad3d237ecccd83ec9593901c0fabbea4706c40883eff734d990e8acd0dc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1dabe23f0827a2ce_0

Filesize
366B

MD5
3a7dd6f83d30072f71ab794dcde15b9b

SHA1
23ed872b03e3b7477571c18563f3f289cefd5bee

SHA256
6a3e7c9b309cb89bae8387e34b1203b34d34cb58d0c2d5f1dce1893f5b8263b4

SHA512
8132b98507bf4e6193269a08e09f7ddfb723ed650345d3333ee604a36df1d9fd3966ae9a65d57b39e0163ab57ec44ddd000f2e7e61efce6add94a8da50a7595d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1ebca1801d1bfe20_0

Filesize
4KB

MD5
558413402f347ccb8f95f51bfa0f775f

SHA1
f7a8abb658a1be5d84ba593aba939e86f6e4f003

SHA256
6b39a61f9fcae1ace4d11a21ec13803bd6ecb85799577360463a9d2d07bb441c

SHA512
750f1caf39053f0d6d69042c4a7649f2473fd8559cb07c803398d9d6ca5896f5bbfd2c2601b1369d2a8c8fbe6672ee715b4a21f762bdedec60c8de398bfec3ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\27bd0153cb132dc3_0

Filesize
2KB

MD5
f86478d267031e0291b9962f2700c8b0

SHA1
5175b3d87dfa4fbe5f0283c21c05ac313bbdbf1c

SHA256
4ec9ad8d87a9f3155d47f5cbefe931bc6018960e4a2ccbbf505f924c2f3845e9

SHA512
f515ae4ca4f08692b5d2e0b16b807a92eaf02766ce5aae5f3f2b277274ae3935d8589344e2bbe8aa44b8f6991eb49deafc06ca1c1ba7f90145fadebacb83594e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2c371e7971338465_0

Filesize
78KB

MD5
b579fdff45908c581203602f1b688dc9

SHA1
b50f2310234d525755235122b1ee95e5cc6ade31

SHA256
6dcb2794a5816dfe71dfd276b3c715c886455d393fbcc83b3e02ba25a19b35d9

SHA512
360c4961902225ffcf9b01a6944a55526f5395d8644ca92da7637ddc301b067412e14f999220b981dd7920fd60c798c03594847c4d338262ec09e536b98ab77a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\31d994d0af81ed0c_0

Filesize
2KB

MD5
269b6fbbc146a5184e8eb442ff849416

SHA1
f4c18268efedb33d66971b3a227b0640cd7f7a52

SHA256
fc33d7f61292d3253bce84f9cdfd114efba072c4441a286e81dca176dfd72801

SHA512
0edb0522d6342fde25885decd2087352108986b7ed2f6fec53a224f9d283678018c5c11116b4d9f26656e41c9a517402c24b56da1d83f7fce08eb46f4957a285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\40767c6ffa0c49cf_0

Filesize
1KB

MD5
e2a688edc50c1c3e3c4dfeeccb1b8ce8

SHA1
5c1dfb6233e0237457f5e482730df548364b5477

SHA256
ab2ad5dd91ab86c49cb22d743cf28398247ad57a6f0b60dff6999af1b18fe7d9

SHA512
6665842e813f4014d93c6eedbdf3831bb28fc24d745bbc77e14a080b194d925bb14e01c3ca989694dac507946f01f322f241c32c72b2958a38a3d90940674a38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\40cdaaf8bd9d351a_0

Filesize
1KB

MD5
e4dd2a5ac68a52c2efae1ed913195658

SHA1
dc02dc4f3a2d837df7e15635060ce057666f9669

SHA256
9b2517d8da12dfe0d214106fab6bef8614e6e6cfdc9b62ff5f728e31de354048

SHA512
480e93d04bcffa161eae782f20d7afa5e0c0d8b8611773d48e5e9f75160cf42e6d37510fe2396aa3b17475e6a39bb70a99512b9d048740d4ec808c94d1210fd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\41681fac5d5c7019_0

Filesize
16KB

MD5
072438baef6a9a038196db880e49a77e

SHA1
2be756a086db26871adecf8c658703f6a5eefe41

SHA256
f0aaa8326a26e8702e4c2b52c0b233a52bfc90ea3cc9b828c18bdabc93deee4a

SHA512
257e9678ff61ba625a5455f0eebbc90ef38a2e201fb908281a93e78bc1129b864fea3d1908bd0e836fa68847d7727a36d420ad42b55b21a3313dfd754da563b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\43930e4c0770473e_0

Filesize
269B

MD5
c76ec164d4ea07f950287f53ce72c48d

SHA1
b772d5c61ffccb2ad6460cb0f8b7f06c3416d931

SHA256
ae89d7c085d222d88d5655e3f009c2668ebce6f8a4e5ccd1feef5d4d25b3944d

SHA512
eba853aa359c3fc15d478988fa7e5ee992ac0413c2ad0e208342981c9795bcb0cd04d9ec1eaa9acca704bbfee05e334554e94c59f9e57290aad336d6babfb50b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\505556e698f8ab61_0

Filesize
9KB

MD5
6e2b9d8c2a62d2799e623fd73b97f35a

SHA1
be4e926079376f161b3a11a5a38a7f9f323b4d61

SHA256
72e01568ca4eeb94f9a96db04acff2bfec12816d4c349e28b5fca00da00f43db

SHA512
4faf6c0aadeed89720ee5bf439975523bb1401c1c8e5fb90fa0bd4924f87b60438c94bf7b3e3960abd0f2aa7c3d4fce43fced5731dd4719069c4d56ff274bba1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\598d13216dd1c55c_0

Filesize
1KB

MD5
3b65182ff4722f14b676efd17876da18

SHA1
2c46d33288ca6dca739073d4ae80be70c4675e2a

SHA256
4eb3b35e4cdcb7987844bccc6377e8034dcf249816714ed24f5b8399d297aba5

SHA512
3eddf714396be9adc59af821a613b24e94afb1ad25cba3c0ccecb7e6d519465b34d9020c5eeb3a373c99127519ae82d9d3bb6cf75685120f9c9b54ed63276e82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5a7e275b743e23fb_0

Filesize
24KB

MD5
6011971c2a67058b27d1c7a5216c58e1

SHA1
aacd3a26fd360a307682c3a08c0ba46e695054a5

SHA256
59a3f17f10a25388f141df63d1df9e58a75c467adbfa0494c75ef3b9d78b1e52

SHA512
8041d69d4778813484bc9ca0bf3207c78c301346d7983c3092564c9c68c1461ee81079ac7e865d05956e73a6d1164f3b3589cbf962b21bcd0c6313a6bf42dbd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5d7e4678f7c870bd_0

Filesize
1KB

MD5
5d0c3d600f3c7340b21571b2ec16a63c

SHA1
0d8e1f9d23a83d6672a2d7447c0d171736a37348

SHA256
5b73ccae2f5942ccd94e6ff9e547cee95cb4f31b45bbb7d27aa35e70c105e17b

SHA512
b5cd2a763d37141257e6f4f5512634413bfbf336023e810e402267929b7fd9c483ab0ccc3a243cf2c1d85f3528771ed744ad2a61de5aec124eb4ccd079410c0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5d88ff796cc0e10b_0

Filesize
2KB

MD5
ae495d21d3bf27b23261dd801344f998

SHA1
214845886160d91e3e1c1c76efaf888752f2d228

SHA256
9500d2c5ab0c4c7f33f2bc4ac3629589458c7ba3ac7fd6642004111cad5b683e

SHA512
64b949241ce529bd58a27e90f699dca8c75070cab2038460d878a542a00c57064a2de957ab5847341a0f8bf495cb956b809cb224b9446083b1f1ade1c568d28f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6738772579b698f3_0

Filesize
1KB

MD5
3d6fb04a1d1958f164105ab9a0e64967

SHA1
eec83a3e810b40d039e6552a9817bcfd98fc42b5

SHA256
1259545ff3056108c04d9f9a1a26fb31a2bd469101936cb80ffd0a18b3d67e0e

SHA512
de9b9d9a599b9c3c9a97ac27d821e224581125f1d484f590a8b520082054a76b086a106435bbfbec30d240440aab3f5f3dc353cc03cbb29ad0b3c54d22d07f8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\69b667ac731779d1_0

Filesize
1KB

MD5
be7951d2c7ce541d104a2173127b6b2f

SHA1
504d928092b721bde1ebf91ab101b191a76022cd

SHA256
cfcab8fe5870d468df9be7c0a5e674f1db0158e22c2451b431901e218a441588

SHA512
5969a0e546cb69549630a1388883eb080cb87fe357d6131dfe06babaef825fe238a436e8e3c94a4fb16f1903b72b969a671805dc17f036689ffdbe109a24d046

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7116d760c26aedf6_0

Filesize
2KB

MD5
b3fed97298bd4252ea73f1872b5f9a76

SHA1
a3d0218aa4b37602c1275a6bc2ae1659a75fb89b

SHA256
2ac71891644fa80d32a4bcf62716f18ce6ee3396b9e7167aad690a7a668ad2ae

SHA512
68e728068dc44d7fb429172f1095bde89fca128f5e47f702c44da0068c5d049c416078e564133cc95a641b784651c010abb530a68ab91769c2a40aeb897fad96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\71eecbaaf9326469_0

Filesize
1KB

MD5
7332b4c49601d87783222bc9adda5dc1

SHA1
0f11f2edb003c5021e22ee52afa5ed83d15697c9

SHA256
bde7691b4049f0ac8850e91d4f7f4c114ad0fca52d604595cf07b71fe2889658

SHA512
50509763fc08d4c5c875677cbfcacb8ff9f081ef2b3c768de3ca047e4b8754dabc65a60264c50446568f84409a707f838f3909bfd518f730721c512acada543d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\755b66e6611f8c5d_0

Filesize
1KB

MD5
c73fbc16a4d51e09f9052e00c216bd5b

SHA1
33a7bdddce5d375acbeefc297c2c5bbc38d3855d

SHA256
4adcb9459d4a71da59ad05580e08e42755c5fb233f85299dc4a961a5b794d747

SHA512
4118c5b67166b288b6f81848f81dfbe133f304cfd243228e73960f3ee16bb9224e6f08a61881272926c5e67710574274c48915298853df7d41ec91cabb24ec25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\791dec89d7e5593a_0

Filesize
11KB

MD5
291e71980b936b4f587cb963d1d40d79

SHA1
3addd194d857c0e5aa179b83c7d5ee91d46936cb

SHA256
7c57ff0a4956f21efffe76f4096ef9b7911d3dd566227340a304e42192ca60aa

SHA512
8f02f8a0b831f15f4374560daefdcf2595f8046a9df7d915955c6c205a99e713277b70a7e6b2e625c00d86aac5ba6c7ef18acc439d88820f137609c14a8739e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8f2fb6bc3521b9f0_0

Filesize
1KB

MD5
5ab7ea1a51c271fe4266fb37d6f8d710

SHA1
fd9d0bc0e52fecd804145ff35140b3ccc56a2942

SHA256
fc663c12eaf0c7f46ce716976cec3ca062a31bae41c94242ec48ae3610c1e9f5

SHA512
ebe7b65ffa9d340e256244e2207d3f2925d7327ed62c67df03052ecd1f71be1c02364aebf0dd7c709eb64ecbe68b7e5f91b0ca00fab244d5b3a0544ae3804428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\909472decc75f3e8_0

Filesize
1KB

MD5
030c6b3e234f147634aeca3a4ec738fa

SHA1
6910003a75ca2e41b2005b1855fffa3d36fa58ea

SHA256
b3fc20f655c042b2503d2c954413c487a95ff2ab1057ad432e1fa6114b7dfdf1

SHA512
a4df24a3af543becb50d4cb598c6d9bd3ab0571dbc643ba87ce46ffb96e3822d8b289acc97d186c75cbd4e43442068e24c624d164157e92e955e7a8198b80116

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\931ff3ee2cba732f_0

Filesize
1KB

MD5
ee645d768ebcf92f459716655f6f9a18

SHA1
cb1a107ff9f51f1707ab80c4e90d1d0e8c9d14ce

SHA256
0524bcccb5bfb9062f1b4c6e7df15ea0fcd71533f20e191cb1b273f8d8054b68

SHA512
7b046634db748fbfadcbee14da4ac1a5dd3efe97a9d8d86651db66a66db40d56a6de2dc0e9f2766f886ec3db1030f47681ac73357bba650cbedb1e0c8b989010

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\93573f553973dfe2_0

Filesize
1KB

MD5
c57954fdd2a1d184ed1508695b1d14bb

SHA1
9d695d84cb2d25b919f04256bb925244ddabd714

SHA256
68ae1625be1749eef91e13f7479593676637e6757444ca8b5d43d72124d585de

SHA512
ed02bdb1e36d0cdb11ac4f66af5d4731a1345298df3dec99e3745321a5360173364b807190ae944facdd8e6ff0b14f28ca1986f371337ef4a6c02522b25b9b0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\99968e48ba30b730_0

Filesize
1KB

MD5
8c58ce7c684d3f9f7fa08ec93f8c3dba

SHA1
09a10a4fa2dd256107172d5388bad724440ba466

SHA256
382a57810e4998391226894d947c32c76668354aff7cbd8112b44cebfbf31774

SHA512
b1bbbf53fe9608212679af71703dc4df23826b1856e6c5aa19bb1b47325a58e11dde4661b0cc0cd51656c88be93cc3737a1152cd1a24320c6d991fc31b1d5320

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9ad645f9b7448181_0

Filesize
1KB

MD5
5d3f3558082625d17388db2209106627

SHA1
59a159e95e0768a5e83e48700863f3966adc3811

SHA256
bd35682faab25bc7adb76cec9b3393a3b56940b730ad3c3b268327c9d238e0c7

SHA512
151eab4b66f947b7ca988b4e838dea3344d0cb7789252b6522022151cac0280a58be50acd4734745f73748659d63a19479e68ad7802974f5f9c29386128f6254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9d2cc39ec17df0fb_0

Filesize
998B

MD5
ad9c951100b8d91759594911be2b21c2

SHA1
998db4abe15bf1a249fbc8abfa49746049338b41

SHA256
972db526e54a4b457e1a4ce1965083f133fc9608be27d7d5fb60810709cf9eb8

SHA512
7a9b2b87f5096b09e3693896a3381d1de2001eb20e7fb503fa732b44ca45dbc557b3a29236dd5b130a060884c79df87a536b5792fd31e53893e5e0f968b8e22f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a6b9ae79142c3831_0

Filesize
1KB

MD5
82d88ce2677f4de440a9b58e72bc9ab4

SHA1
4943ff89b2a0e81b0593d7c042283aecb74a168d

SHA256
a5b9df86b8377ea1b005eb6855472d8d76682b60271d89de9c39e541e9ba5e9e

SHA512
2d3f91426464b9f2a4a182ed392a4cb5337d81636d2ef4791228343b563787c2ea54be28d17012673483798fef70982681f490c37f25975971f2e193bb305104

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a83342dbafbcc57e_0

Filesize
1KB

MD5
058c8701c2280128a2157351c6635289

SHA1
5bf803178e10956c6777eed4edf8ad7bd9833807

SHA256
9cc5a63db6ea31db217ee6a4002d5eaf946d550d32d4779c288bf52a4fec3f65

SHA512
c537ba5bc89c190eb5d70d249f087307e379c2558de4f0736af6f46d6d1f62e87dd61f69c74f75856d82b6b5d5035a47268d11da320f5df978bf5f7f9d874a70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b0642d7a2f57be83_0

Filesize
1KB

MD5
4e5f4d44c470e6416553ff65be5f29ef

SHA1
71c51880d06828c44679dec3a5b09a5b8a1920a6

SHA256
9166cafee3a50822e7eb278a5e51404b46b988ecc85ec52a8a1f64f7c141336c

SHA512
9e18bd4dd6d9c47a42e21020ee06273903849d4de76f22c4da524b3a6d807914353d0ce4b90bb3a763a68f40807432bca19d9d09799f0ad2482f77bcf944d3e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b12f9a1db31e8d99_0

Filesize
22KB

MD5
a917f7200823323941544daff6d9c0bf

SHA1
9ec19364c60cbb82e45e87e88380f206b799fc02

SHA256
f756a9fd6e178756e0846e32204241524af2986308566c3fba1852ea3e5da1a8

SHA512
579a5738f512e9eecd3a4d0c972eeb26038f453506d12f87026c0433fe69efa459443ea44e79338ca264d0801e55d37c2885cdb39bb778516f675145d5fad4ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b5040e5931ad4436_0

Filesize
139KB

MD5
63261cfe21e29b447dbfdb9bc4d5f9fb

SHA1
db56a46ee4595d9745f65e6dffe3600578092454

SHA256
1e4c9b7db096ee426c780f048437512f08f256c0f759efb1c1a09d61c6a2b458

SHA512
202635c5ba6b6ba9e7ded011ebcbeca3c6e02cc514c07c3bab667ddc49d03d45669884c1e253c4873417638e81d1cf85ec270898872246e7197480c099da5dee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b592afa2ef95479f_0

Filesize
2KB

MD5
4555add63395cda9223d69d1095dbef3

SHA1
2aa71ba4d292b3e534bc60430cf78579e482183c

SHA256
b48bb8ff5907045ffc5c1276be834454e6b4922749d8ec8bc9b92c87ba57d52e

SHA512
7d4b440a2a3d24d77f4e9c0e97e660b4811b723b6b97ad1f4a91205d9431e80c54784d26a08446d8f10d30c5d2ae39f469e36f264cfba03c8a3512cd4cc28a3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ba6fed0fd633e23f_0

Filesize
7KB

MD5
f5a652334748e1a3330845a519547b95

SHA1
add17bd63707be2e72d3abb44b810a96c2c086b0

SHA256
5d18ec9c29a2a64a75b3bde93c4035961b59611821c166d21ab05b1088df9025

SHA512
61071fc58b8580e21674433e8abd366f0f607359dfbd591c9f4b4df4f0d759c0d7c6817cde37725fb175daa8d0d18b5cb82657a6727c1163f62fd3123411728b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bb9d3617b204eedb_0

Filesize
1KB

MD5
36b022ece4f08a9d7265a1e9829d346e

SHA1
fd2f64ba8c1dadb8843e60ad48b425f364969bbc

SHA256
db5464487bee25db8e27038ac7c34e492d90a88836bb1f2441eb31a63cbcff6c

SHA512
267569e41cf321ce1ec07d0a702f2b1fb749250eac107c10b9d2da87930b165feaff13104cc78d949346d51e0ecc60ff13498b4e367b438ecba48a07cf08c797

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c4e0464851744dd6_0

Filesize
1KB

MD5
afa3b8940f625a9ac53ba11221df29ea

SHA1
7f8c116c54a89aa6754c5c26023cb7f61c142f4e

SHA256
da6e461e72a7382d848ef87107c2373138882f57c5f9c5c80b1e10a9084f022c

SHA512
157419a2c6170cf1bb042fcd4a5a7342c0137f0a5ab6483fbdb8fb932b70ee47c87a67a10a2ce08335d369579770aa80d1c5d923e054b9ba57b0ffbbcba8bca3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c9822c34ba20db86_0

Filesize
1KB

MD5
43be93428e373e3cbe1d764f17e0f4b6

SHA1
53c28bac8893612066bebba7e87e5c4ef11829b5

SHA256
03808cbece1f274788048e11201f1308ad7c0bc9c7990815c7254b4b21074efc

SHA512
e6667319aca91d762f65809ec008a6ac869fa4e6ef4f4e8ed7015fbc39452e1a07b0b74aba141f659f48455c27ac7496f1741b66637af8e383310f588fec186b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cb3cbf13da42d74d_0

Filesize
1KB

MD5
04977d3b561d3ea3fb537d5d5512f428

SHA1
dd00528b4f2fe44c88999d1500a8cc84a303a22d

SHA256
7622464184399d1678b848ca3bbd6b5c9a3dd7c32715b772bed5cf697db1de8b

SHA512
22c1c075fbafbcb33627dc462198056011d0a3b1ab20c4326037e6a76b03c0a58667b69cc4b4b701fcb4b0d48cd1bb5a1c3b69b972b7d96b8ddc4eca57d8eeeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cdd5371e0bdd1fd0_0

Filesize
1KB

MD5
958de5c26abcfeec6f8dd5ada6ca1ab0

SHA1
38966526d1805817ad7e8a17cd8fdd60b3148114

SHA256
0d7be76ae55c4b5256a0e51890bd6382fbb79d6795c0e439b550cdc160b76fa7

SHA512
3a6dc807608274cc147ec48fac49e993a61c7a30ce0dc512445959fb29e2fe762d8d2c7d8f72b549745cd48af5d0f6e30ea6d2023529291483246fd03276c203

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\deaf24bcda660b9d_0

Filesize
2KB

MD5
c3d027c730ab09bc94292b5b9f9ca5c5

SHA1
711ae61c84ae858356ee6c4628c5e49252af8d9f

SHA256
04d6d23c361ec8cc50ee0acbee7268932aaccb991bbe61a66aa1b83da1150395

SHA512
2a5f8e329650e932a72aa1bece4c17c6b123349e2fb182b0b8d6ebb8eaeb03e1a39dfca973794776b82d06ddc0dd9645b7b481d6977c5d340f9e9abb673c8a25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e797f4355fadd8dc_0

Filesize
5KB

MD5
ac794f620608cc8b09159328c47f3309

SHA1
81fa58e2bc75a85ad0e94c009172ef5374c6d6f7

SHA256
7560f8bb4e32748263af77974db032f8a97b18279d67d376103d5c367ca52d58

SHA512
6e7565c1204e375b95773702b9c260269ad7cda834708d67e372a20c66ca7a284efe7fdc06b2abf3234cd17d69e7f90adc0347467922445517b76ac19096ad5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ea2ea1afb9d99265_0

Filesize
4KB

MD5
2148b6c967cf5a79576ed8c1e0b88ed4

SHA1
2ee7c894ebc63a889ff0e796980ba5b82b9f2522

SHA256
dfd9c91a6eefb2ae082f599d714fbf94556d4a5c5b3c86d8805d1e8c98552f2e

SHA512
235fa456a648009781410681bc1a86e2cf3c6d1be6082bc5c0f25758739a301d81096f504f361d042e099280c9ada45f8ae400f141a9f4c934337275384c4ce3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\efe78be45ed3302c_0

Filesize
1KB

MD5
2a9446ce1ba799f195ce2c41e7827e62

SHA1
369ad7be087b786345d85a32affcbb2e23978c09

SHA256
63452b0fb7aa0ef8b38f100111397f20410647b27c394ac6c83a7722e0162173

SHA512
98ab85dcac45242c755b90119143fa1c3bb18ac07fab74c55f6184f4faf0bb3a047d91b9bbc5c1cef870daf387f80bbcff70ce1c382bf790386ea1caee6411b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f0346ec7cc726fcc_0

Filesize
1KB

MD5
3574992f66ccb380807d6f580f7e9e01

SHA1
bc946c4943e81780fbdc3048c2ace5dd82f40965

SHA256
296ebbe3320dff987d91d709338bfea15ed2d5e7b32e812d4fe88b08b40354a0

SHA512
382e4cfc70c196732a84d4148a75b431b069a9aa8d7240a5675071a13dc4b88fc6e859e1bdc7e3d62cbd235d993d9f3a1faeaf6a0d5da5a6bcaa5395f85b0334

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fbb391511280563c_0

Filesize
1KB

MD5
a333fee391c95375c3e4ef3c483b3fdf

SHA1
fb37d2ed92793df5a33d3cb7c98a5456dd933e24

SHA256
b8fb8e80dc8822fb40fc9bfe05967dc5ff30b0f566b95f400a615845e7f6fd39

SHA512
fac1ca5a8396f5c2dcfe3682480dba486e852ca6e9ea5077ab3b04cfc7d555c20de5e0228e4335366669918a1fcb8472c5a4f1757ad354de733459ddc7a3227a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ffd26c8c14c33986_0

Filesize
1KB

MD5
0821e3dcc51b156537fe4252aa714e7d

SHA1
37c2499e6c1ca4478a902b0032b9d142dbe1fc0b

SHA256
430ec2f6313f936a04805d9a5b46842bee5dc780d8b5757832d0a78b1c718366

SHA512
ba9eb9d8dd82f2e11b38bbfbc3388b1e103bc2651165b5a822157cb7f32b510a0199f83c9c21961866721666ade7e4c2c36821fa1857b8f4a0d6a52757a9e86a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
5KB

MD5
f8c7d61141adc11f479951f99114fd08

SHA1
0dc3f9ab8998281ac224eba6b29dce91467e0527

SHA256
69912df408e0ac44f7ec8489484a0eb91eec000867249b641d212dfb578c8089

SHA512
95ace31b85a35d3b09835ad925dda65f972fa828542b6e4f6e934d4cc227025356eca83c7cb6a4dfd2a81c27270ea88604c975a188b07dcc8ca82cfaa0a1cd57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
f5ab039c045b07b44ed5fd12e5403aec

SHA1
14e48e9d3b0d78d7dc541c5df613245b1a2f7129

SHA256
ba93ba8b4d9aaeba8014d0bb079aad616bd471664ad0a37f8d0b03e6e75314bc

SHA512
1944b95ab3904b837e2369718b48a53b9506982f2493736545d0e0615a949c5c00c14e48c218ec6858d96e36ebc68d093a908167383d2f45dce12c69d756d8aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
7a76b37509c3b606abe1426a90fbd9fd

SHA1
e1c03b3a5a61008acb3b84a94d430a57be513607

SHA256
d8ac6de0c57d3ee5bb068adccdf2c24cca1059830ebd9b353b1f3c2e7ec741df

SHA512
800b57afa92354f14509c4d6a3f285ab29a6d13659e124ab0c9b20fe68005c1d710b613116a34658c8084251c4a34dbecc3e45db6ae9abac0b3b9e3d6da6bd09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
b9124954ce83b2c92ecdf01137c847da

SHA1
a00671470b8173f63f3a8da4decee6adc4e0dc7a

SHA256
6e0e155cbf9d2dc5cc12cd9084a5e7fcda57a6b7c6021e58f19c1e948828abdb

SHA512
cf04b7e0505595e56b3df3ff2279ae59c3f5eb732444e413066320859a744f530647f7a6cc549dad0cd11e396dfa9d31086f1bd301ac90e1ac921ae8418d0e19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ca71379d598893755989a92d1fdfb8c5

SHA1
8b7630801e349bdde77a6321ecc543d4f0b5005c

SHA256
7bffc6640c5432eb7fd3f446ad8a2af88cdc384dadb3227f5e07fbbb941a47fb

SHA512
ad638d7af6103d2c942317751b844fcc3ded253420e5399cf676794f2c13ba3b397b0480502593d8a9a232fb00d71cc911e2bc6ee0c180583e694e8e1e414e6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_prebid.a-mo.net_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
858B

MD5
c9f13950bc9784a62401a7cc1c898f6d

SHA1
3a13c744c47dcbbb529d91834d2737e43815119b

SHA256
1f2c5b9ff62c28ea4da6042c2f61d8119fe78e432982169191d7fc9f92030a9e

SHA512
9e6f527451aec5029d27d1b65975bc0d1b37206790cf71cdc13e10a1c9a78fddfdf87dfa7b270d53830df6a0138d644f6aa4d78a6d1c374bc9ad43f337d2b37d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d254b1f3c0979500f692b4ec5d7e02c6

SHA1
b94d4f4957940ef17f8ac4c5a57105da6ca769d1

SHA256
569ecc71e6d920a10adbcbdae004a6750fd86796100d9dd10e31b8c90ab6e854

SHA512
b2180986550895dc78b05ea081cf16262aacad917166073f5f236ce421850ec8c3c5e7ac7368de97831877c796ed8e0af7a3f5d7cdc2ae69ca1ca0fde8f6ef4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
13KB

MD5
14933bda5276381f65b85ed9a7191289

SHA1
7f1b6f24c764e455ab1ab384ef6a41d7ee4d8aea

SHA256
f0bb8c7c08e30c9d33fa617f2cbf5a500e88a2c96c03c76f6df0fb8a08dd8ece

SHA512
b555c33234e03ae9e070906c839a09f3a145522cc588f87efffd3566f15098f1df6140d39bdb846d8976c449cae1fb1abc33b24d7beac4d1e36e672497f0c408

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
941B

MD5
797cebbff848e833dfdde1599def2668

SHA1
f2287afc11ca135b9eea371bc7615358a9b40597

SHA256
0ff8fc6102b6d0324efd83b8d3508d0e186f68fa96b383d0ee82f938d1ac1fdf

SHA512
393e83c5a9cd4c2d42b0fddbb4d535599e7aed4ef1b1f06145c05b84e846cf3dcd029ba8f85cc17e051fbef1b5f9500f7aa0621c830963bb1ba3a29c7abf838d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
13KB

MD5
4e4802d8997093cd6244c2186d6c8327

SHA1
75187805a7aa50c080c9df2cb53ffe66ea78fa5c

SHA256
d520a5cead483c45630191dcd0778a971b5881ed31272fe925502a57b0cab625

SHA512
1f2e26ea3934d3c7439c7c4a489b163a62b74e1687a6b26c93b22bafdb7e36a4f720046b262d148a39cb5c13dbb682de623698c2009ea2d7d5829cd8c9eca639

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
059bbf4752f7f4603e9719738874774a

SHA1
0ca8322be40e80984e5642ab9bdf9a4aa9e7f7c4

SHA256
667f28d76c04799ee55bc59d0692c9a28915731a3c2c27b5e1dce224c964d396

SHA512
0c9b12a041129317b8d9efe93463d580ce077bc32730e8d1905a4d113260777e0c00934af6395cbce621fc875ab0b31203c4ee089f4a68433bdb39f536f34423

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2aae6d82616384333fa251ce68830f68

SHA1
f511d1f267c9b8a437965e0772fba81dd24f8279

SHA256
4f41b1bf4ddaa066b2693c8f728aa7685c417f4d1effc7a5414ccf635eba9629

SHA512
50a69d1a59c9c69de86311f222e5e65ebba44f26e4626d45369ae845003ca6fda265e6e345bf6a1a142cbcdf60c6f27bf82227c4220506c03be5ad5de3dae9c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b8fc5d7d9135d1df657b3d8977b32d9f

SHA1
b8cd6f28319893f3a5c31d526547755300bf4661

SHA256
a77cf759a80698f5860517595bcf06bebfd70610d00fcb1926228bc9510ac604

SHA512
77721f2787542e1d6d47fd0cba692e1260e7f48d4ae6daa86f40e1752498157ee2e38a862b8a6f02a5682b69bbbb3364b433c4d53bb247056f03c5bae7e0913f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f7e323db207b96773bb762d1e07f4904

SHA1
811d5d5f335c89c17d8dcc328719b5539b6bc43f

SHA256
3c4ef167b204811c5bb3960d8f8031e28d543523425362b568bad10ae6afc7be

SHA512
c513168b84f44d938c8c92b2fe070c85036de3bc8e38363447d9999bab6be2b72ce7ac9c34fd9e044b8ed0a7f713d2de9841802daaf4a05fd679e22268f89fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
6e88ecbb2fb9deba464aa3260b6053c3

SHA1
2d76b59e80e0f9d330fdc8b7f792571c1d38b5e1

SHA256
5f2452fd5672ee1c809480d0ac6d00f8891c43a40a2e46c3c81a5beda68feec4

SHA512
068e0410468896244975c639a916f77a75116bad9175e8ae1af6a8223a8fb7dcae8d9eb0db504e52398c647d197ce120181dc552951abb9f9e4076ce1a99506c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0d96f41598aab960f0b86ae34d6de6ef

SHA1
4a501cbe6580bcacf22d64155fcd7298d7f5f291

SHA256
ca8b7b78598039b72236ce542bce80de5de4bef33f30433eb00b039f3e067be2

SHA512
04d281e00fcffc2f5d8936d975137f3aa4faf906fba27370299e0842972564ad0a821da30c24f485f67943d9285d7bc69003de8a911405cdf3eb5133cf2e8305

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
32f6103003652f5177ecc8777378b40f

SHA1
e71cfff794f8c39c267c25b2f4aaeb33fac59d22

SHA256
fe2eaa518199faa3b806f93f5e3216211d3664f5f61317554dce710c21ba22d8

SHA512
471785d9bfdeaa627cf9af8d7a7673f8515800781b753844adfd6f9aa711201255689bf16079b463ebd426c263a1e82de7a881b045f7071d15bfd2bd0dae8a3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a6adf0838c72d880607197ae3dcc2ce4

SHA1
4b859437483480c2d96ee28baef2e4f27e736655

SHA256
6144737e3b8426f052324b759b197c0682b23a0e58cfc62eb07c6176fd368217

SHA512
b0feb1de532d5832c337e914c4e2b97b018cafe7e470c87e978d3d4de1f2864518a7c6df7f6c5ec905d2bb0c75e2f39fe2861d25a5e5962d98dcb915f379f21c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
55448a294c2ea88ce18d6f8293d5f2ff

SHA1
83c3ca57f0caf6540b0169675157541c5cfe6e39

SHA256
ce4b2f9d5086c476f9b79e422d471647b44034c1c97d66f210168025daad223f

SHA512
4a69b9dcc6a406206edbde5ca6d883df4f4ca4b32db6d2e095e3567331767f6a06ef61de32f8f4a22d4aeba8d87553afd367b20f244483456e94a1b7808d9708

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
4f20236e948693fde07b4ab5c5622d53

SHA1
948ada9138d32d02026db239b06674609515c3c0

SHA256
5a1d74746959866b5c4e83da3837d5eb749e7283caa793b0a3e86890ace315c6

SHA512
2b0e48159ca18538c8a10da672d047b49c5164a94373878bc77d3b65ab1155200ee37fc4eeb4d6a558bd276585cf709f874da80223937166c8a1cc2485e8e8da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
22fd9a3b509f77b8583bb14e207e8ba2

SHA1
19f651548f9aace233c6e6d1cdf6e04e3ee17a14

SHA256
b1db1cf4376fc6885246a4e909bd77422a98835f7ce9e11961c651e88fc31a6e

SHA512
eb46042bd37b749a7aded28e327d71d8991c83f94b4150dde53b701f4754a13adb7d5b8b8eb415bfc9c093aeba2e709e57eb15344d36fb1bfb345dc4681672e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
12fd27124540d677a59adbb059267f57

SHA1
251b3baa9c4c203224b46607c5c563c0565871de

SHA256
2b36dfb0ad6f47450cdcd8ee96663aa3a3c4069e8c4e8e702276c745c20d9735

SHA512
e0801d6b968edda0f0ff02d829feddaf92aeb8539666a2b937ef7ed2831315e77af89133c32f4ed73b63e2d140a66796b8edfbcc48e2bc39aea7aebfeeb6e09d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
d1e2d9f5dc4319b6b6854130f7a35aaf

SHA1
35649348838c19bafa8de4e592bd297a4f7a7074

SHA256
fe81f2b5216a541719df57da79c63a79685935db7d638b4fb213efdc180996ea

SHA512
33b9a756eabaae67bab1bd3d6a1a2ca00256b030e582a9eb7aac8010afcf8bb9f58ac6118a889df4666dbece91d0deb39986299064ba9825b1e10cf85a373c18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
36da716dc06929c99602b87bed00ee6b

SHA1
e3392d5db74eefe296349eb275a2dffa67a7e149

SHA256
538eb54957054c33fc7a1284e36351f43e8639b41f3089e80e241b075f0ca41a

SHA512
6d4bf4c491790820f84b3f6be03a56362db3102e3b3d28e8527ea6787b474f2afbd5882331394d7ec4b566c226017df4920284e228fa851ba116d9ef865bdb76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
dd79a972126759a705e838550978434f

SHA1
67ffd35917f5ba7a3d84d3583b354bb0a47d9e34

SHA256
02245caa42aaf0296a385125854d867b9968df6de58c7b2b65a4aa39d263ff17

SHA512
df213d8e453d115410b90e5771ed3b71d7883b2234cc2ad4fe7761e524e4a4116cd2a5a03587ab3af1ef04bcc110cde96a03ad0fc8b82d0a37905aaebb360940

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c96b92655a94dc68f8ada9bb54825d7f

SHA1
2912d63608d63d6e0fe90e2d402c875d5511ed01

SHA256
a5543f5acc30f74b32a597ac6dc1321d6e9673f6a67c8efe92bc70fc80e03c39

SHA512
b3ad6b93678818aa3b63e4b774eec7283afb794f1b7be51a040b532a80dab1448d514b96fd72816bfb535852760e84d8a67f7fd9b00a9fe1b421e8e2dbbdd56f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
42f0b2af320c729df600ee67131d2252

SHA1
8e39794dd661d8d5473f9bc62a4e3490f85b31de

SHA256
570981ca30e11618f11fa080daacb5c7250f0fc1011296ba6129691bed7e4f9e

SHA512
dcae105896bbd45eb88f488f7744aff51c2bcb8d37e53fc37b67039d1432edecd55430b33ae7f33ed7b01634173b23816ce4584d248e9d9abb4fbda968e3b8ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5adfbc91a6116afe27af0aa45654e47d

SHA1
cd51f9846bb81fafacc29bf14152a1017f12668c

SHA256
092cb08f87063d83ab5a58c66947d5385637959516e79f3df90af8d48a364c5e

SHA512
e3f4cc4f197341384a169836064b1369c24794ea6e9183ea3962b59bfc56ef1b79d2ba7f8b1b0804e76c56d4df47d5c7d0ca6aba51f397c4337970645a1f0124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0b8abe9b2d273da395ec7c5c0f376f32

SHA1
d7b266fb7310cc71ab5fdb0ef68f5788e702f2ec

SHA256
3751deeb9ad3db03e6b42dedcac68c1c9c7926a2beeaaa0820397b6ddb734a99

SHA512
3dd503ddf2585038aa2fedc53d20bb9576f4619c3dc18089d7aba2c12dc0288447b2a481327c291456d7958488ba2e2d4028af4ca2d30e92807c8b1cdcffc404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Filesize
36KB

MD5
64c0c4062ec53e3d2b107b1b2f5671da

SHA1
7028485fd3521aeb5595e9d023184a43078ed721

SHA256
2fedc9c7aa87e88f78d6a0ef5f2559ea860312882333d44a937999e7e5182e16

SHA512
30f5ff8719110e57fa8476741669560cd111f31f474f44627feec858944fc768de31317bf13b6cc980810a281b251777701b54507fa96603b726795f291107f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
0fd3a875c539d78b2891ab0150c08453

SHA1
0b03bbf6f88008db1a67b01ff2b1832223fdf28f

SHA256
10502629f518d52a9638390ca73ba80b0cd1400b318fe5542c4adb27c50e073b

SHA512
cafa62163ec12945ba33ab69ebdec57a177bbc4d3bf6fccc62213a166a3e0ff3449fcc2e67658d49a34bb9fd37df463af8557c596c4b66e64ed6379e89856368

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe63b4af.TMP

Filesize
48B

MD5
83f5fc78f782c323ab24a83b1824129a

SHA1
bdb92acf8f045ae3a8f9aa6ce44da8845b5a40e3

SHA256
20d7c479b4b71fdc907e48926e7f775a69912fc32b42efc4bbf2bbed07c6812f

SHA512
edb1b728c651184e487314adbdcbff4919e70f9e1e4edfac6941040889be2ef8d7135898c84575a84a284880cd3110a50955e8cd6502b4e37769094970eebd97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1a60af51cc372536f7f47e0a59008142

SHA1
426cf91e361704f97d153ae2adb6878ea66bd28a

SHA256
e3f3eb93ef1b22859abb108cb8cbd7edff6faedded35bee219d8cf2f7ba62d67

SHA512
048577d770700997dabeac4a8945b357afe183177ce25f5142520dd777d7977325d273909d0a5f0b57426abaee292a434ee7d02ac7003de72b9c819e7d2476dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7b2d30241ad7f93086900ba1cfb6dee8

SHA1
1d406a05e1acda925ae0de3d75493d204c007b93

SHA256
0b58a3d70d9b07f57919e64b3eb0f52b9cdb0d9335775560756ba30ebd4926a9

SHA512
6782a0ef1f2507a529d7cb11eb305846b5a0ee90e30b8e3cb8a642ee6fa29d9b9fafa36b20e313e7eb0cd5d63a6ccb53126ab28922859c3728c66f9b809fe41c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1fecd887aa731bc522d36ae1365b9084

SHA1
3b5634acb2a5b2acd2c3fcdf6019647c53fea6ef

SHA256
20347f906ae335dc39d76ca7e90167bdaae8151c1189ff8b507639c64daa179d

SHA512
72eafa4fcc3511b6880486bfb38915174040752cbfe83e4075d290c19c018f8b9c22ed73854b6c66bb90d6246a11cb6e5e012f73d98337e6ec78426f6856df41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
93dc34a34a26c6a30ad769f63ec63a3c

SHA1
b53b67568ec34032ae6d5804dcb5884f3b6db147

SHA256
81ac78ee2b539c4d80c7f081ba075e41c2fd40ee077668e58af8986c393c1afe

SHA512
dd293cc5986a272baa4192a612fa563b18c9c4589acb36647663c2911464ab416222bee6d8cb644e2fb4a08bc09578c252ad25cfe9e3383131d0d8eb801e6b10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ff65f5a8f0535f73829fc4262a6d1146

SHA1
7c35fce39e507288a5961db4a97f4eaa248a5ba2

SHA256
759206373825e102e329fa91d6233d1effbf45bb2a43d38e3e27cdfd73a178cf

SHA512
ba9a2c99a52472c75f718f43cddcfcb2b4bfcde9a23d6e4387e968e5dae2524b70049a77064b3aa943106a6b66298d6f14f5fa0266863febf6864f80b03374aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
7baed45557e596d378e0a88b2f4ae0ec

SHA1
01695788546eced510e8c9f39b5e1b3ead9f4bfb

SHA256
027acec98942083dbef51801f57005d258f024161b0604896cb5fad264267f4a

SHA512
aac189e7744165be7bac645228eed918422a4ff2e67e6f716ee4fcd6df9b2398cce2610851dfb4ba12ff1baa060a418c6ec5ee613044d6a0a9ab33302c9e20ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bf0d6da12f7b344946163295c975bd47

SHA1
8b4122eb53805d0e56cfe1eaeb2107ff1e4490d4

SHA256
188bfd1a9540b808ee17b8505272343b722c8e1ea740807fe2ef5e9ab0fbe979

SHA512
84d2f6550cffcf2b5e724de9cc2c71a37a2e270cb3b9706fe261c783e689d774a228ad2fecb6f219c48675bb4d639059e56be7c7a953be0abc9be55c0862bf4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
d2cd3672084628d37e147432801b4e0d

SHA1
296c84c74abe69af11da5b2ac95c28efba4bc361

SHA256
cb5f680c2a94d861b2b9293a59334e6649ffe95951cb4be09308608c4fca2fe7

SHA512
2c597e6e3debc6d0cefb8dcc78a91971fb30a5e1048022fac50d4d6968012359fc8c890db9b03a1384e3775c935ce41754d7d667b5a422a4516db6f04476c947

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
d2d4bdd8b5d1ef1e6f66baab906f17e7

SHA1
3f7407385e64485a842d1521ddce6b8dc9f8e21d

SHA256
a5e63fea688bbed168aa1a5cf344fd07c73f670ff6cb30bda5bb98766d3d84c9

SHA512
7e696d3ee709d50c200034df9c44f34edee0686154fd58b469a454ad3008a08d0724fa62e4ed20ef05b7baf837d532c8504032c89a7460f2bd4e7535e3524491

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
06e9d1f361edac475242269befaabd47

SHA1
7a2ce86df9f8038e504b6d9d8a54f6453e5d87f6

SHA256
e7bd2c9fb9967cf5af006cf22c88c33936973a41def38f68c1c6a54996ec203e

SHA512
fce16c81bbaece08b8adc3d56ab6f8be4eef0929f02281a75435a43220fec7722803a5c0070f8a304b6808f9f710665cd602f4141d6630c317c162cd4fe1f46e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
2a29fa9712c475aeac1fd6993df4d765

SHA1
c657074931c24826c0260061d11e6ac9ff7dfb08

SHA256
a7bbbe187eeb8526d7c740ac29835144365d7d01337bcd781209af1b34e295f7

SHA512
6d4ca541f9ac2886452503c42b842f17fd7539a314c27e9ed0e6e3d30ad7ecaa8bfb5eb7a6eed59aae417aa14eec842e410c7eabac1b5af35117ccb84e231f96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
67c5dcebdb7bb6af3c7ee68665299c19

SHA1
b11a6f87f5b34b93fc83820adaa745809787c8bc

SHA256
b6a7a62b529647b90d947b36bc5ad17f317ea71ee07fb3e4be751c263aba018d

SHA512
2a26914d27b36ad822c1563b05ec74d30bb62ff1e73574ba32584674be6a02f624275291706937402c7499c0234ec86f89a0118fd4e839043afabd59852cc55d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
77f26b49ba386737427baba6db1a7e41

SHA1
c812cdb2dfa9bf5e34fd9956f7640125316082f6

SHA256
20a0e2bbd06884643aadf7fa595a1627a63f52002c5becaf7445e6d12e89936c

SHA512
ebf05db7c295503c9e40e1ee81610b6f85223eaea912e18f8ad83c3e24f8da9cc30bbd879423e5c8a6c1f745a065fb53b16394b17eef96ab1d23b807aa5d4526

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6fada0a6c75a08ef64da63eb82b53102

SHA1
8f6cb08a088491236a5dfb2bc1c8bf9f3f78635c

SHA256
f6afc539f36f40218351b0de6e017ebfa1e279bbe327c454adc05baf7364e9e8

SHA512
0b0367932abf31dd75142c5487171db4d9ef407f528baaee84304dd66d08ce9f3aa697eeae89cd3085a415e3181f402f8d8e0ba6f96b765915ae88756650c865

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
42384c65f6a4ce84754921332b0e1e22

SHA1
dae1fe6af3261bd6ecc73f02161350faa1a6ddb4

SHA256
7a48534e48908d849b40279d20c5e62b5f974d67ac958d9abdd72ed4039ea7ae

SHA512
d2be73d5003ed80e3f02dbb624c05d3ab17b60cd60ae81e79dcec10703f2b33480b49ef3431f18e036b13fe8c4d8b46e299445f3ea2ae77bd02a28394eaef3e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dbac064725b0dc39b1574ca1a07c5c9f

SHA1
677aa00b6991de68378e945ab13dbc5e30de650d

SHA256
85620ee12e6a62ae8edc4ea2951f7ce0eb76619c91c7643941dffb1b84400815

SHA512
607f8075fcadcb778c95e04d0341a41465f8889f7b98c9fcfe8712865704288a689348e531ce27e7693e8fbe6f7085c027e1252b6305d22040f00000235900cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58f7e8.TMP

Filesize
534B

MD5
27e7d01014b7a96ea7ee930757381070

SHA1
cd96f950d3095f8008720ca010fd23316a97f1e5

SHA256
20622548bbe232d1ca9017355006209585dca0cc8f0c7147f6028819094bf39c

SHA512
c865929f9611f4dd199662632bac6d3abb39ae2995d25b9060245cd61214edf415c23f37d4dd2808fcbd3eb1e475d3293f30f2228f79f2101b394910e565ae39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cbe8395bfb8c6914940dadbfed299a8d

SHA1
4d9c3b76497f91e4ef9982b5297d828bd27f7996

SHA256
80b00f7ed07008fbe9c7590969b8991e76c879f37197727999795e373086649a

SHA512
2d0d7a55db1bf197b4b7e05f81fec82298f2ad6469b3fcf4c4ae7b12054004d10691ab1e107b6bf56ed2102ef0a77c1e519261fce38534ad714dd7e3956bf613

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
96043bee67037a0a98a6b3098cdad764

SHA1
3b4327a86738d56d6ed8467717ba1b69d362e237

SHA256
d47e5bba0938f1ffe5117d120284cf5bee3b2f951cc98b4790acd92b47ccf394

SHA512
f67533b2f5672474e264c179276485f28ce0600635287fbf7674d512845c1981d01fdb7d3e816dbac13658d2e2f644122121669186629510074bdc3bbea431ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
cd31a1c75fed1fe6dd4ca9dae5f25703

SHA1
1b65429d692fdbc2ec11d5c7dd12eb93480e9c04

SHA256
39c0314b9aa53500daa1c3ac7f0731a3950adf9ec0fa096d0fe2eacf629026f1

SHA512
e0bded7bafcd783e83b9dc80b9ec6fac4c8bf55b3d4abd7df73c2ded37055f9128ff23c0ca41f14741c2e19ea72ffe70a3e4f0b0fe45e0393dfb36caf028472b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5f586cf257adb801a38fe1abaa83f7db

SHA1
d9888adf4af93b42cc575885dccecc9c9200f5f3

SHA256
65d52cdcfbfc69800188e30d4dad7b933c37ff37a71c0599445b6a9f842dd08c

SHA512
ed124f59fc48828e52b957ad77c181f92ef40970499738bfb1eb5a9c8a2af48739bd54b634112dcb7f33e7607088cd9ac9850a8f4e48edebb97781fcd073a624

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
35ba2a722484fc9297e89b5586e91a29

SHA1
f45d8f6b1652842625dbd775eb4c91070d84acdc

SHA256
0969861b66ed60db365ea0ee94fd6b3b6f9a6d63a15ee445df1f09e0348d9283

SHA512
0fc06e2ee972bd8d2717a512a9261afba5cc769586de54329a2a3b160e5474857ecb2b85c01d47cadffd9a773b06b59d4559fa928e528a12fcf72144a8bb7f4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
504f62a016fc680bc2966a7d4ec82dde

SHA1
2c786a747fc8bcd48a7e8d9cfa4bac0868a14e8a

SHA256
ab980af50ccbdb8bc138ab03fb13b1504245112ae30f17c6266981883b550b54

SHA512
65040d393191ce2db9ed92f4443b41c7e7ea2912d834e4075edbf9e2df61055a4029edbf939c8d2715c7ac30954ea3c1a86cbb396089e88acd82beb33cf9c7e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\VCRUNTIME140.dll

Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\VCRUNTIME140.dll

Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\_asyncio.pyd

Filesize
63KB

MD5
79f71c92c850b2d0f5e39128a59054f1

SHA1
a773e62fa5df1373f08feaa1fb8fa1b6d5246252

SHA256
0237739399db629fdd94de209f19ac3c8cd74d48bebe40ad8ea6ac7556a51980

SHA512
3fdef4c04e7d89d923182e3e48d4f3d866204e878abcaacff657256f054aeafafdd352b5a55ea3864a090d01169ec67b52c7f944e02247592417d78532cc5171

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\_bz2.pyd

Filesize
82KB

MD5
3859239ced9a45399b967ebce5a6ba23

SHA1
6f8ff3df90ac833c1eb69208db462cda8ca3f8d6

SHA256
a4dd883257a7ace84f96bcc6cd59e22d843d0db080606defae32923fc712c75a

SHA512
030e5ce81e36bd55f69d55cbb8385820eb7c1f95342c1a32058f49abeabb485b1c4a30877c07a56c9d909228e45a4196872e14ded4f87adaa8b6ad97463e5c69

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\_bz2.pyd

Filesize
82KB

MD5
3859239ced9a45399b967ebce5a6ba23

SHA1
6f8ff3df90ac833c1eb69208db462cda8ca3f8d6

SHA256
a4dd883257a7ace84f96bcc6cd59e22d843d0db080606defae32923fc712c75a

SHA512
030e5ce81e36bd55f69d55cbb8385820eb7c1f95342c1a32058f49abeabb485b1c4a30877c07a56c9d909228e45a4196872e14ded4f87adaa8b6ad97463e5c69

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\_ctypes.pyd

Filesize
120KB

MD5
bd36f7d64660d120c6fb98c8f536d369

SHA1
6829c9ce6091cb2b085eb3d5469337ac4782f927

SHA256
ee543453ac1a2b9b52e80dc66207d3767012ca24ce2b44206804767f37443902

SHA512
bd15f6d4492ddbc89fcbadba07fc10aa6698b13030dd301340b5f1b02b74191faf9b3dcf66b72ecf96084656084b531034ea5cadc1dd333ef64afb69a1d1fd56

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\_ctypes.pyd

Filesize
120KB

MD5
bd36f7d64660d120c6fb98c8f536d369

SHA1
6829c9ce6091cb2b085eb3d5469337ac4782f927

SHA256
ee543453ac1a2b9b52e80dc66207d3767012ca24ce2b44206804767f37443902

SHA512
bd15f6d4492ddbc89fcbadba07fc10aa6698b13030dd301340b5f1b02b74191faf9b3dcf66b72ecf96084656084b531034ea5cadc1dd333ef64afb69a1d1fd56

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\_lzma.pyd

Filesize
155KB

MD5
e5abc3a72996f8fde0bcf709e6577d9d

SHA1
15770bdcd06e171f0b868c803b8cf33a8581edd3

SHA256
1796038480754a680f33a4e37c8b5673cc86c49281a287dc0c5cae984d0cb4bb

SHA512
b347474dc071f2857e1e16965b43db6518e35915b8168bdeff1ead4dff710a1cc9f04ca0ced23a6de40d717eea375eedb0bf3714daf35de6a77f071db33dfae6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\_lzma.pyd

Filesize
155KB

MD5
e5abc3a72996f8fde0bcf709e6577d9d

SHA1
15770bdcd06e171f0b868c803b8cf33a8581edd3

SHA256
1796038480754a680f33a4e37c8b5673cc86c49281a287dc0c5cae984d0cb4bb

SHA512
b347474dc071f2857e1e16965b43db6518e35915b8168bdeff1ead4dff710a1cc9f04ca0ced23a6de40d717eea375eedb0bf3714daf35de6a77f071db33dfae6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\_queue.pyd

Filesize
31KB

MD5
f00133f7758627a15f2d98c034cf1657

SHA1
2f5f54eda4634052f5be24c560154af6647eee05

SHA256
35609869edc57d806925ec52cca9bc5a035e30d5f40549647d4da6d7983f8659

SHA512
1c77dd811d2184beedf3c553c3f4da2144b75c6518543f98c630c59cd597fcbf6fd22cfbb0a7b9ea2fdb7983ff69d0d99e8201f4e84a0629bc5733aa09ffc201

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\_queue.pyd

Filesize
31KB

MD5
f00133f7758627a15f2d98c034cf1657

SHA1
2f5f54eda4634052f5be24c560154af6647eee05

SHA256
35609869edc57d806925ec52cca9bc5a035e30d5f40549647d4da6d7983f8659

SHA512
1c77dd811d2184beedf3c553c3f4da2144b75c6518543f98c630c59cd597fcbf6fd22cfbb0a7b9ea2fdb7983ff69d0d99e8201f4e84a0629bc5733aa09ffc201

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\_socket.pyd

Filesize
77KB

MD5
1eea9568d6fdef29b9963783827f5867

SHA1
a17760365094966220661ad87e57efe09cd85b84

SHA256
74181072392a3727049ea3681fe9e59516373809ced53e08f6da7c496b76e117

SHA512
d9443b70fcdc4d0ea1cb93a88325012d3f99db88c36393a7ded6d04f590e582f7f1640d8b153fe3c5342fa93802a8374f03f6cd37dd40cdbb5ade2e07fad1e09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\_socket.pyd

Filesize
77KB

MD5
1eea9568d6fdef29b9963783827f5867

SHA1
a17760365094966220661ad87e57efe09cd85b84

SHA256
74181072392a3727049ea3681fe9e59516373809ced53e08f6da7c496b76e117

SHA512
d9443b70fcdc4d0ea1cb93a88325012d3f99db88c36393a7ded6d04f590e582f7f1640d8b153fe3c5342fa93802a8374f03f6cd37dd40cdbb5ade2e07fad1e09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\_ssl.pyd

Filesize
157KB

MD5
208b0108172e59542260934a2e7cfa85

SHA1
1d7ffb1b1754b97448eb41e686c0c79194d2ab3a

SHA256
5160500474ec95d4f3af7e467cc70cb37bec1d12545f0299aab6d69cea106c69

SHA512
41abf6deab0f6c048967ca6060c337067f9f8125529925971be86681ec0d3592c72b9cc85dd8bdee5dd3e4e69e3bb629710d2d641078d5618b4f55b8a60cc69d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\_ssl.pyd

Filesize
157KB

MD5
208b0108172e59542260934a2e7cfa85

SHA1
1d7ffb1b1754b97448eb41e686c0c79194d2ab3a

SHA256
5160500474ec95d4f3af7e467cc70cb37bec1d12545f0299aab6d69cea106c69

SHA512
41abf6deab0f6c048967ca6060c337067f9f8125529925971be86681ec0d3592c72b9cc85dd8bdee5dd3e4e69e3bb629710d2d641078d5618b4f55b8a60cc69d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\base_library.zip

Filesize
1.8MB

MD5
1204f7a526c0956e05170df2f60ab202

SHA1
c7f9dcd92ed563cca7f38b98d9bbd0a36e9f23f3

SHA256
26c92438fd1fba4aba0ab0d1f6db8e6a201f68cd90f7a34c327c0701b366d0eb

SHA512
942c1c5e73de6442379f7770cdd88c203d15c16269ffb8c77d8a3835edb078c226e060e10efa4d96048b617e9be5056f09ca49ce3a65c8d52b975b30925fc04a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\libcrypto-1_1.dll

Filesize
3.3MB

MD5
e94733523bcd9a1fb6ac47e10a267287

SHA1
94033b405386d04c75ffe6a424b9814b75c608ac

SHA256
f20eb4efd8647b5273fdaafceb8ccb2b8ba5329665878e01986cbfc1e6832c44

SHA512
07dd0eb86498497e693da0f9dd08de5b7b09052a2d6754cfbc2aa260e7f56790e6c0a968875f7803cb735609b1e9b9c91a91b84913059c561bffed5ab2cbb29f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\libcrypto-1_1.dll

Filesize
3.3MB

MD5
e94733523bcd9a1fb6ac47e10a267287

SHA1
94033b405386d04c75ffe6a424b9814b75c608ac

SHA256
f20eb4efd8647b5273fdaafceb8ccb2b8ba5329665878e01986cbfc1e6832c44

SHA512
07dd0eb86498497e693da0f9dd08de5b7b09052a2d6754cfbc2aa260e7f56790e6c0a968875f7803cb735609b1e9b9c91a91b84913059c561bffed5ab2cbb29f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\libssl-1_1.dll

Filesize
688KB

MD5
25bde25d332383d1228b2e66a4cb9f3e

SHA1
cd5b9c3dd6aab470d445e3956708a324e93a9160

SHA256
c8f7237e7040a73c2bea567acc9cec373aadd48654aaac6122416e160f08ca13

SHA512
ca2f2139bb456799c9f98ef8d89fd7c09d1972fa5dd8fc01b14b7af00bf8d2c2175fb2c0c41e49a6daf540e67943aad338e33c1556fd6040ef06e0f25bfa88fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\libssl-1_1.dll

Filesize
688KB

MD5
25bde25d332383d1228b2e66a4cb9f3e

SHA1
cd5b9c3dd6aab470d445e3956708a324e93a9160

SHA256
c8f7237e7040a73c2bea567acc9cec373aadd48654aaac6122416e160f08ca13

SHA512
ca2f2139bb456799c9f98ef8d89fd7c09d1972fa5dd8fc01b14b7af00bf8d2c2175fb2c0c41e49a6daf540e67943aad338e33c1556fd6040ef06e0f25bfa88fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\pyexpat.pyd

Filesize
194KB

MD5
9c21a5540fc572f75901820cf97245ec

SHA1
09296f032a50de7b398018f28ee8086da915aebd

SHA256
2ff8cd82e7cc255e219e7734498d2dea0c65a5ab29dc8581240d40eb81246045

SHA512
4217268db87eec2f0a14b5881edb3fdb8efe7ea27d6dcbee7602ca4997416c1130420f11167dac7e781553f3611409fa37650b7c2b2d09f19dc190b17b410ba5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\pyexpat.pyd

Filesize
194KB

MD5
9c21a5540fc572f75901820cf97245ec

SHA1
09296f032a50de7b398018f28ee8086da915aebd

SHA256
2ff8cd82e7cc255e219e7734498d2dea0c65a5ab29dc8581240d40eb81246045

SHA512
4217268db87eec2f0a14b5881edb3fdb8efe7ea27d6dcbee7602ca4997416c1130420f11167dac7e781553f3611409fa37650b7c2b2d09f19dc190b17b410ba5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\python311.dll

Filesize
5.5MB

MD5
5a5dd7cad8028097842b0afef45bfbcf

SHA1
e247a2e460687c607253949c52ae2801ff35dc4a

SHA256
a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce

SHA512
e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\python311.dll

Filesize
5.5MB

MD5
5a5dd7cad8028097842b0afef45bfbcf

SHA1
e247a2e460687c607253949c52ae2801ff35dc4a

SHA256
a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce

SHA512
e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\select.pyd

Filesize
29KB

MD5
c97a587e19227d03a85e90a04d7937f6

SHA1
463703cf1cac4e2297b442654fc6169b70cfb9bf

SHA256
c4aa9a106381835cfb5f9badfb9d77df74338bc66e69183757a5a3774ccdaccf

SHA512
97784363f3b0b794d2f9fd6a2c862d64910c71591006a34eedff989ecca669ac245b3dfe68eaa6da621209a3ab61d36e9118ebb4be4c0e72ce80fab7b43bde12

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4562\select.pyd

Filesize
29KB

MD5
c97a587e19227d03a85e90a04d7937f6

SHA1
463703cf1cac4e2297b442654fc6169b70cfb9bf

SHA256
c4aa9a106381835cfb5f9badfb9d77df74338bc66e69183757a5a3774ccdaccf

SHA512
97784363f3b0b794d2f9fd6a2c862d64910c71591006a34eedff989ecca669ac245b3dfe68eaa6da621209a3ab61d36e9118ebb4be4c0e72ce80fab7b43bde12

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zmovru2u.c00.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgA0E6.tmp\DonatePage.ini

Filesize
904B

MD5
a7503cc175535989650d0749c18c8881

SHA1
1f4d8aed9a2677e9a2f0467c022fc98b732ce81a

SHA256
e0f775ff3740334da3924a6537b87d8fc1211942e42d4565f9edd26cf50e7b3f

SHA512
3495eee44dd3756b180e50a6f59e3b5fb41707bd243e9f2631e8f23e8f2cc1f668e449a0f905d8876e997c341adbc234ca4a0b7a6f9857d77ee7fd2f689face5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgA0E6.tmp\InstallOptions.dll

Filesize
15KB

MD5
d095b082b7c5ba4665d40d9c5042af6d

SHA1
2220277304af105ca6c56219f56f04e894b28d27

SHA256
b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c

SHA512
61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgA0E6.tmp\NpcapPage.ini

Filesize
2KB

MD5
5d424161f66c456d004ce9238e325951

SHA1
5645bfdf329598f2fa1d537f06bfe6bc1992f7ff

SHA256
b5ff3df23ee62a824a3cc4299d5298c9a746f3003d6958e98e917a9069d61689

SHA512
266dcbcafc8d6e63aa35dfe036c6faa4ead258acf76fad03c1bbe5a1226ac97bc02a05abdcdb103935b04375f3dbbcf7e772133d857c175c2197cf7214324a32

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgA0E6.tmp\NpcapPage.ini

Filesize
2KB

MD5
c829ac33cd63e1ad13d12f4bd6389d5c

SHA1
f91be61058667910916c7a4fc03bf5aa2178faa9

SHA256
36859bd147fafae5270ebe1865eecd86528cb6f4d431b324329e1bebedadf2b9

SHA512
1b65335c18053cb48431453c07789df88789ed365cad17ad0afdd2248de8051ab2fbd4727d756bd6a6417050d45016dbbbcbad73ad7fef1424cb98f27a2f83b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgA0E6.tmp\NpcapPage.ini

Filesize
2KB

MD5
3e1206241aef0f9c95ba84dd943f23a2

SHA1
af2aa7db11db4c9e52fe9f3f229c840417bd60b1

SHA256
f22b7ea60271431fe7353c8ba35be3bcded53147abe63433bfefca0dcf4a4a3a

SHA512
3f49f05785020679a694d0e5302276cc7cc70832a24ba5fbdef52a7b89ef58512fe196c82ecd93ccfa24ec945993273c4fca59c03d1f71564b92df1f8859db6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgA0E6.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgA0E6.tmp\USBPcapPage.ini

Filesize
2KB

MD5
e99e395d6bfc37663626c4a01c732692

SHA1
75813eb6682b97de44dafdd6f98afae7e4d3868b

SHA256
b4c5e164a7dc968941eab553a3c0f53f3aae8209b8eef74d4be9838b78b51503

SHA512
e13cf96693c5d3971fdb5b14ee25e629b7016b045719f59d451789651127323b0a260f6c085f0b746b64d04a06a4d408aafc20eb71635d6064d8584af20973f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgA0E6.tmp\USBPcapPage.ini

Filesize
2KB

MD5
8d4d2d3887312cf48d36adf2f4db2c9e

SHA1
b933f560ceb68727d6205875fc5183942926506c

SHA256
c23507155295b4c1e90952409f33b5a885789de3a220b31347cff23356e90d61

SHA512
d37cca2879bb2a9481ff0c132c4fddebe19eecc91669312cebb37ceec081a445509b80025534be86b3e0a52bb4bff24a3cf9d9484642b14f33246c586f8493b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgA0E6.tmp\modern-wizard.bmp

Filesize
25KB

MD5
cbe40fd2b1ec96daedc65da172d90022

SHA1
366c216220aa4329dff6c485fd0e9b0f4f0a7944

SHA256
3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

SHA512
62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgA0E6.tmp\nsDialogs.dll

Filesize
9KB

MD5
1d8f01a83ddd259bc339902c1d33c8f1

SHA1
9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

SHA256
4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

SHA512
28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy7066.tmp\SysRestore.dll

Filesize
5KB

MD5
c1e07f0ea14ebf4142176d340ed421f3

SHA1
f3524213ebbb53b4ce9ae1a1172897d4438445ed

SHA256
9176c65e37d931edeeb51f9deb1ab9b5ac2d1c6311ad85339bb79f0f2840b2a9

SHA512
3e69f403bdd041ce9da91307659645f44a760360e69e986c1740b04be0dd66bfa017ce8783f9f4f81d545eb43eb68df09c90c8391c2a417cf611064dba5453a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy7066.tmp\System.dll

Filesize
11KB

MD5
0063d48afe5a0cdc02833145667b6641

SHA1
e7eb614805d183ecb1127c62decb1a6be1b4f7a8

SHA256
ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

SHA512
71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyC9D6.tmp\InstallOptions.dll

Filesize
22KB

MD5
170c17ac80215d0a377b42557252ae10

SHA1
4cbab6cc189d02170dd3ba7c25aa492031679411

SHA256
61ea114d9d0cd1e884535095aa3527a6c28df55a4ecee733c8c398f50b84cc3d

SHA512
0fd65cad0fcaa98083c2021de3d6429e79978658809c62ae9e4ed630c016915ced36aa52f2f692986c3b600c92325e79fd6d757634e8e02d5e582ff03679163f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyC9D6.tmp\System.dll

Filesize
19KB

MD5
f020a8d9ede1fb2af3651ad6e0ac9cb1

SHA1
341f9345d669432b2a51d107cbd101e8b82e37b1

SHA256
7efe73a8d32ed1b01727ad4579e9eec49c9309f2cb7bf03c8afa80d70242d1c0

SHA512
408fa5a797d3ff4b917bb4107771687004ba507a33cb5944b1cc3155e0372cb3e04a147f73852b9134f138ff709af3b0fb493cd8fa816c59e9f3d9b5649c68c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyC9D6.tmp\final.ini

Filesize
568B

MD5
cae757421db8d011e41266bfd9439885

SHA1
7108a9f0740ee4e3a118f6ac9212e0446f074181

SHA256
ff350a68202aadb145f590c8579f9284d2e3c324b0369fde39e5a3a31d7b8204

SHA512
785d19c796834065c823a7da99036378bba54b932ea1e47d4ba0c1d123a0a09ec307a3459fb862221de74ce61d9a8d7ec73901c9de007d31e7b39eb7a19b16b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyC9D6.tmp\nsExec.dll

Filesize
14KB

MD5
f9e61a25016dcb49867477c1e71a704e

SHA1
c01dc1fa7475e4812d158d6c00533410c597b5d9

SHA256
274e53dc8c5ddc273a6f5683b71b882ef8917029e2eaf6c8dbee0c62d999225d

SHA512
b4a6289ef9e761e29dd5362fecb1707c97d7cb3e160f4180036a96f2f904b2c64a075b5bf0fea4a3bb94dea97f3cfa0d057d3d6865c68da65fdcb9c3070c33d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyC9D6.tmp\options.ini

Filesize
2KB

MD5
4c03a565eafdd997f6d501d81e3ad3c9

SHA1
1a8e728e164148dc08c4b24242721e6ecf515812

SHA256
0f5a91ef783df6ea57ff35297d7a05f5cc6b38b04ff6f307eabb08be6484b43f

SHA512
fd1c34b3f5ffe51fd91ee82ad68b131918724e6b0b4b19947c17ad169bf3cd1bcd37d6fea36afac817929a9f74c13a65b5e1736de83af65dfdcd895f002e229c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyC9D6.tmp\options.ini

Filesize
2KB

MD5
d25e466a4621df43fa62daa2d47c8d16

SHA1
a9414fc9e507added2273f0bc1b0c4fc37253743

SHA256
ef766ba41c2c64dd3cde3adf9502e99f5ddb96a41c8e6aa9138e87998f9c2e9d

SHA512
3bb7ac3c9ba87216ee5f3b6d8eca2157a524e2fb737ce7a90ea7d3d49bce55e6785912d3bbd074803c77e56c55f68332053a9a967de4368387bde044ef9792a7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
b0c19579964dd4e56f07f26afc356dcb

SHA1
872daf2ef6dbd17c1662298c0499d262b942fef5

SHA256
4b0095872ce9edfeeee81c7e4a3e3fcedfe1eb055acd12957d9ec4717bfa5cec

SHA512
477c94c9aac31978ae99f514e89e12e7951e57eace8bf145c5c145bf61d6273465c4a90db36f0cd299c7a558ab3f0e2e3cc2916f2c138a0c1662799af89dddb9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
4798ee2459d5ad7daaecfcca397e6c33

SHA1
b8041e6dd4d2e8b3162cc2f668395f12d92dcfad

SHA256
fa816ae662f03d1b2f8443e2fc09aadbcf7e8ee8801a615b51c3a1a9a7fcec38

SHA512
7c192e88b559f349899372cb436b7f758517c23aa87a277d5eacfccb570aeb22ee1aea842ce78280e45dfb1e0a466c1a5e9d3e6b544a3cedb132a088dff78218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
15KB

MD5
22b40f34b580fef65f6b606de9aadf5c

SHA1
f8cb10347b9a3cf99dcd795bbe5bac94f0ee2e1c

SHA256
f65d74bcc71a66113d85271b38ecc2f48646cc357ae28265044282d3881f7e9c

SHA512
2eb76a9b43fdb0344dcff304dc1399d14dd47cf3a9d1a025b74a2d84df0b6762a912f2d6ba61f56d01d96a248e32c2eb2116a49b2f129cf7e92dce7506ad00a8

Download Submit
C:\Users\Admin\Downloads\GDAccountRecoverTool.exe

Filesize
16.1MB

MD5
014825d18c3f8412408f5119279b7c2e

SHA1
b4f9bc7b07717203dff94ccc3c909453f9c369c3

SHA256
047638d1b999063e6a3fba68eaf02add01d12417c48655e846b1752f59b0a5c2

SHA512
dd5ae9279b12230ca65ec67da85bb61af29455ff2c1b1376997534cb5a2152731e11ded1e2ff426f666a6bd28bd0bdb9696fd69757c71539cd3b0de4d5067d2c

Download Submit
C:\Users\Admin\Downloads\GDAccountRecoverTool.exe

Filesize
16.1MB

MD5
014825d18c3f8412408f5119279b7c2e

SHA1
b4f9bc7b07717203dff94ccc3c909453f9c369c3

SHA256
047638d1b999063e6a3fba68eaf02add01d12417c48655e846b1752f59b0a5c2

SHA512
dd5ae9279b12230ca65ec67da85bb61af29455ff2c1b1376997534cb5a2152731e11ded1e2ff426f666a6bd28bd0bdb9696fd69757c71539cd3b0de4d5067d2c

Download Submit
C:\Users\Admin\Downloads\GDAccountRecoverTool.exe

Filesize
16.1MB

MD5
014825d18c3f8412408f5119279b7c2e

SHA1
b4f9bc7b07717203dff94ccc3c909453f9c369c3

SHA256
047638d1b999063e6a3fba68eaf02add01d12417c48655e846b1752f59b0a5c2

SHA512
dd5ae9279b12230ca65ec67da85bb61af29455ff2c1b1376997534cb5a2152731e11ded1e2ff426f666a6bd28bd0bdb9696fd69757c71539cd3b0de4d5067d2c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 159977.crdownload

Filesize
501KB

MD5
016169ebebf1cec2aad6c7f0d0ee9026

SHA1
0931fd4e05e6ea81c75f8488ecc1db9e66f22cbb

SHA256
9c891edb5da763398969b6aaa86a5d46971bd28a455b20c2067cb512c9f9a0f8

SHA512
09a16d6f11312010795329059dcda0aeea4b781d7ebe52467ad7e628a8ccc85abc8fd9592cde61dbf2900289f9870c149142899e3b0a1d2db1ce94052083034d

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 535911.crdownload

Filesize
16.1MB

MD5
014825d18c3f8412408f5119279b7c2e

SHA1
b4f9bc7b07717203dff94ccc3c909453f9c369c3

SHA256
047638d1b999063e6a3fba68eaf02add01d12417c48655e846b1752f59b0a5c2

SHA512
dd5ae9279b12230ca65ec67da85bb61af29455ff2c1b1376997534cb5a2152731e11ded1e2ff426f666a6bd28bd0bdb9696fd69757c71539cd3b0de4d5067d2c

Download Submit
C:\Users\Admin\Downloads\Wireshark-win64-4.0.10.exe

Filesize
75.5MB

MD5
6f733bc09ea051a0b4ff21b6608f28ea

SHA1
1e5ea0f5fa1a8835bcfc9587efa4bf58c495d13f

SHA256
085d9aa4f6614730f132fb5c28ec5fa445dea79687e4c648d586de569ffcc5e2

SHA512
836c4a5d3d056d229265801c2e6248cf20ff783c05434830e02fc71f4bec3b625150ee3df47eaab7b88d83d3c27b183ae2bba64c0bb7f53aef017a48ee0db588

Download Submit
C:\Users\Admin\Downloads\rockyou.txt

Filesize
133.4MB

MD5
9076652d8ae75ce713e23ab09e10d9ee

SHA1
768abc17bafbce37bf3cf1e946f6d9970428b7b3

SHA256
6dfa76aa0e02303994fd1062d0ac983f0b69ece5474d85a5bba36362e19c1076

SHA512
6359fe9a1fee8b593072489d9c6a54fc4df05bbe268a8c68e4ca97a222dc3d3173b2440417360ad205f8358466c85a1b1db75bd1ae284232117cbb7edb8e7acd

Download Submit
C:\Users\Admin\Downloads\rockyou.txt.tar

Filesize
133.4MB

MD5
4a0666e0a353a11203387d09ae179ccf

SHA1
624a23188edb48338912037dbb5d00fe740351bb

SHA256
327325bf24da16973d5ef919e68ecf5692acefb361d8040360ec4377fe48550f

SHA512
f0439b075a6cd5cf41286cf6c384ca5396ed7ddcc5855ab64aa55796347ac1e545d066f22320d65917e3123b18226f2c3e92b5deef486f1b665549d5369b5847

Download Submit
C:\Users\Admin\Downloads\rockyou.txt.tar.gz

Filesize
50.8MB

MD5
5c81f621620ecd420653f397fab689ca

SHA1
ba1e209f92be6b91fd637cbcdeab1af2853d7e1d

SHA256
47c070a029bcdb4cbd0e02c69fed136ef46dce4048ddbadf177daa5e885b8172

SHA512
997d67a755c93f0d835e378d48e58df02da2c1fcb2190e43f1df3cab5125e0f8896218a40bd8d9a7891d0c8adb526d0f4a720e620f447a37a7480bff7a058126

Download Submit
C:\Users\Admin\Downloads\ukraine.exe

Filesize
91KB

MD5
7834280ba27c5b1ddc9659ad7089816a

SHA1
f7bed8501aa73d6d46dad54dd70590d00b75ab62

SHA256
8b17f33b1a75951807db7e3671a49ce5ec7373a9187346374951b04c1cdc946e

SHA512
e0bc1702650bc3e2b24ccc29eefb38bda26c5f230b65ee8e8fc22dea95ed55a23366785d7e98e19eace39c5f529a64c9e41cc0e6854438993051c92c0fb49e74

Download Submit
C:\Windows\Installer\e65a362.msi

Filesize
188KB

MD5
a4075b745d8e506c48581c4a99ec78aa

SHA1
389e8b1dbeebdff749834b63ae06644c30feac84

SHA256
ee130110a29393dcbc7be1f26106d68b629afd2544b91e6caf3a50069a979b93

SHA512
0b980f397972bfc55e30c06e6e98e07b474e963832b76cdb48717e6772d0348f99c79d91ea0b4944fe0181ad5d6701d9527e2ee62c14123f1f232c1da977cada

Download Submit
C:\Windows\System32\DriverStore\Temp\{8a930d61-5a86-9649-998f-c9db452d0050}\SETF2A.tmp

Filesize
12KB

MD5
be2a59b225dace6a52b98f17678786c0

SHA1
abec30ea6b668f9ccff77209d54b971ce6a22711

SHA256
43d10d470320041e663a82439d79cfac78de99addd98e02c4d60171710d032b2

SHA512
9a9acfe84f822b7f20148725a4abaa51118759f5688d4a3841c4a9e73b59801128adf4df54a14078408fb14ad0acea068a2bdd1cf0f9ffc6c44e6e38721f79d6

Download Submit
C:\Windows\System32\DriverStore\Temp\{8a930d61-5a86-9649-998f-c9db452d0050}\SETF2B.tmp

Filesize
8KB

MD5
ff536154cf4932322ca818eda6712e49

SHA1
873bb1d640cdc9c41596f46fbc37b48a5d6b03cd

SHA256
4c1b4785d35a4828b98b7acacf8b18b0a4e4d0c9da683cd9294f6a6ae6cf7bf2

SHA512
164d9c7eca15fa83aa2645fd4eefbf2a562b49615978b72f6c9c1b072cbdd1bffdc3295d95b69d2cf26dba67f25d6fe82ddbfa6decda07fa855bfa3c2311d7b4

Download Submit
C:\Windows\System32\DriverStore\Temp\{8a930d61-5a86-9649-998f-c9db452d0050}\SETF3B.tmp

Filesize
75KB

MD5
08a2def8efc2619ddabe13a041703aea

SHA1
f9fd929c77d5a47766623abaa7490bcd98b3ad97

SHA256
a2039b552dfacd4edc2b8ed42bbe32cb0a481240fce18f78aeb1a68dbb747d39

SHA512
0afb5d2dd6747b37162494f4f90387160c5b90c58a71703d2ddd07256e848ee1f3e4237b660d511262255e54038ab11699808526a3574450c9407eb1e830dfac

Download Submit
C:\Windows\Temp\{21E1BEF4-84B5-4B6E-85AE-A72F55CDD948}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{58151C1E-BA8D-407A-BDB1-55E0EA3A08C0}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{58151C1E-BA8D-407A-BDB1-55E0EA3A08C0}\.be\VC_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
\??\pipe\LOCAL\crashpad_2072_DXHDYLZHLGAYLYKM

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/536-5823-0x0000000061440000-0x0000000061538000-memory.dmp

Filesize
992KB

Download
memory/536-5835-0x0000013B180D0000-0x0000013B180E0000-memory.dmp

Filesize
64KB

Download
memory/536-5832-0x000000006D7C0000-0x000000006D839000-memory.dmp

Filesize
484KB

Download
memory/536-5834-0x000000006A680000-0x000000006A69E000-memory.dmp

Filesize
120KB

Download
memory/536-5833-0x0000000065C50000-0x0000000065C6E000-memory.dmp

Filesize
120KB

Download
memory/536-5831-0x0000000000F20000-0x0000000000F36000-memory.dmp

Filesize
88KB

Download
memory/536-5830-0x0000000065CA0000-0x0000000065D53000-memory.dmp

Filesize
716KB

Download
memory/536-5829-0x000000006B740000-0x000000006B751000-memory.dmp

Filesize
68KB

Download
memory/536-5828-0x0000000065F00000-0x0000000065F22000-memory.dmp

Filesize
136KB

Download
memory/536-5827-0x0000000068EC0000-0x0000000068FCB000-memory.dmp

Filesize
1.0MB

Download
memory/536-5826-0x000000006FB80000-0x000000006FBBF000-memory.dmp

Filesize
252KB

Download
memory/536-5825-0x000000006D040000-0x000000006D074000-memory.dmp

Filesize
208KB

Download
memory/536-5824-0x000000006ACC0000-0x000000006AD39000-memory.dmp

Filesize
484KB

Download
memory/536-5822-0x0000000064840000-0x00000000649F5000-memory.dmp

Filesize
1.7MB

Download
memory/536-5821-0x00007FFD33DE0000-0x00007FFD33E13000-memory.dmp

Filesize
204KB

Download
memory/536-5820-0x00007FFD326A0000-0x00007FFD327E3000-memory.dmp

Filesize
1.3MB

Download
memory/536-5758-0x00007FFD2CA60000-0x00007FFD2CFA1000-memory.dmp

Filesize
5.3MB

Download
memory/536-5759-0x00007FF6CAA40000-0x00007FF6CB2E2000-memory.dmp

Filesize
8.6MB

Download
memory/536-5760-0x00007FF6CAA40000-0x00007FF6CB2E2000-memory.dmp

Filesize
8.6MB

Download
memory/536-5761-0x0000013B180D0000-0x0000013B180E0000-memory.dmp

Filesize
64KB

Download
memory/1804-5811-0x000000006D040000-0x000000006D074000-memory.dmp

Filesize
208KB

Download
memory/1804-5812-0x000000006FB80000-0x000000006FBBF000-memory.dmp

Filesize
252KB

Download
memory/1804-5810-0x000000006ACC0000-0x000000006AD39000-memory.dmp

Filesize
484KB

Download
memory/1804-5808-0x00007FFD33DE0000-0x00007FFD33E13000-memory.dmp

Filesize
204KB

Download
memory/1804-5809-0x0000000061440000-0x0000000061538000-memory.dmp

Filesize
992KB

Download
memory/1804-5807-0x0000000064840000-0x00000000649F5000-memory.dmp

Filesize
1.7MB

Download
memory/1804-5806-0x00007FFD326A0000-0x00007FFD327E3000-memory.dmp

Filesize
1.3MB

Download
memory/1804-5815-0x000000006B740000-0x000000006B751000-memory.dmp

Filesize
68KB

Download
memory/1804-5816-0x0000000000600000-0x0000000000616000-memory.dmp

Filesize
88KB

Download
memory/1804-5814-0x0000000065F00000-0x0000000065F22000-memory.dmp

Filesize
136KB

Download
memory/1804-5813-0x0000000068EC0000-0x0000000068FCB000-memory.dmp

Filesize
1.0MB

Download
memory/2660-5790-0x000000006FB80000-0x000000006FBBF000-memory.dmp

Filesize
252KB

Download
memory/2660-5789-0x000000006ACC0000-0x000000006AD39000-memory.dmp

Filesize
484KB

Download
memory/2660-5785-0x00007FFD326A0000-0x00007FFD327E3000-memory.dmp

Filesize
1.3MB

Download
memory/2660-5788-0x000000006D040000-0x000000006D074000-memory.dmp

Filesize
208KB

Download
memory/2660-5786-0x00007FFD33DE0000-0x00007FFD33E13000-memory.dmp

Filesize
204KB

Download
memory/2660-5787-0x0000000061440000-0x0000000061538000-memory.dmp

Filesize
992KB

Download
memory/2660-5784-0x0000000064840000-0x00000000649F5000-memory.dmp

Filesize
1.7MB

Download
memory/2660-5791-0x0000000068EC0000-0x0000000068FCB000-memory.dmp

Filesize
1.0MB

Download
memory/2660-5792-0x0000000065F00000-0x0000000065F22000-memory.dmp

Filesize
136KB

Download
memory/2660-5793-0x000000006B740000-0x000000006B751000-memory.dmp

Filesize
68KB

Download
memory/2660-5794-0x0000000000340000-0x0000000000356000-memory.dmp

Filesize
88KB

Download
memory/4460-5799-0x000000006D040000-0x000000006D074000-memory.dmp

Filesize
208KB

Download
memory/4460-5797-0x0000000061440000-0x0000000061538000-memory.dmp

Filesize
992KB

Download
memory/4460-5804-0x00007FFD33DE0000-0x00007FFD33E13000-memory.dmp

Filesize
204KB

Download
memory/4460-5805-0x0000000000120000-0x0000000000136000-memory.dmp

Filesize
88KB

Download
memory/4460-5803-0x000000006B740000-0x000000006B751000-memory.dmp

Filesize
68KB

Download
memory/4460-5795-0x0000000064840000-0x00000000649F5000-memory.dmp

Filesize
1.7MB

Download
memory/4460-5801-0x0000000068EC0000-0x0000000068FCB000-memory.dmp

Filesize
1.0MB

Download
memory/4460-5800-0x000000006FB80000-0x000000006FBBF000-memory.dmp

Filesize
252KB

Download
memory/4460-5796-0x00007FFD326A0000-0x00007FFD327E3000-memory.dmp

Filesize
1.3MB

Download
memory/4460-5802-0x0000000065F00000-0x0000000065F22000-memory.dmp

Filesize
136KB

Download
memory/4460-5798-0x000000006ACC0000-0x000000006AD39000-memory.dmp

Filesize
484KB

Download
memory/5080-6504-0x00000000751D0000-0x0000000075980000-memory.dmp

Filesize
7.7MB

Download
memory/5080-6505-0x00000000026A0000-0x00000000026B0000-memory.dmp

Filesize
64KB

Download
memory/5080-6524-0x0000000005910000-0x0000000005C64000-memory.dmp

Filesize
3.3MB

Download
memory/5080-6534-0x00000000026A0000-0x00000000026B0000-memory.dmp

Filesize
64KB

Download
memory/5080-6545-0x00000000751D0000-0x0000000075980000-memory.dmp

Filesize
7.7MB

Download
memory/5080-6542-0x0000000004C90000-0x0000000004C98000-memory.dmp

Filesize
32KB

Download
memory/5184-3624-0x00000000066E0000-0x000000000672C000-memory.dmp

Filesize
304KB

Download
memory/5184-3607-0x0000000003090000-0x00000000030A0000-memory.dmp

Filesize
64KB

Download
memory/5184-3609-0x0000000005740000-0x0000000005D68000-memory.dmp

Filesize
6.2MB

Download
memory/5184-3610-0x0000000005E00000-0x0000000005E22000-memory.dmp

Filesize
136KB

Download
memory/5184-3608-0x0000000003090000-0x00000000030A0000-memory.dmp

Filesize
64KB

Download
memory/5184-3606-0x0000000073FF0000-0x00000000747A0000-memory.dmp

Filesize
7.7MB

Download
memory/5184-3631-0x0000000073FF0000-0x00000000747A0000-memory.dmp

Filesize
7.7MB

Download
memory/5184-3628-0x0000000007E00000-0x00000000083A4000-memory.dmp

Filesize
5.6MB

Download
memory/5184-3627-0x0000000006AC0000-0x0000000006AE2000-memory.dmp

Filesize
136KB

Download
memory/5184-3626-0x0000000006A70000-0x0000000006A8A000-memory.dmp

Filesize
104KB

Download
memory/5184-3622-0x0000000006210000-0x0000000006564000-memory.dmp

Filesize
3.3MB

Download
memory/5184-3625-0x0000000006B20000-0x0000000006BB6000-memory.dmp

Filesize
600KB

Download
memory/5184-3612-0x0000000006010000-0x0000000006076000-memory.dmp

Filesize
408KB

Download
memory/5184-3623-0x0000000006690000-0x00000000066AE000-memory.dmp

Filesize
120KB

Download
memory/5184-3605-0x00000000030A0000-0x00000000030D6000-memory.dmp

Filesize
216KB

Download
memory/5184-3611-0x0000000005FA0000-0x0000000006006000-memory.dmp

Filesize
408KB

Download
memory/5548-3651-0x0000000073FF0000-0x00000000747A0000-memory.dmp

Filesize
7.7MB

Download
memory/5548-3636-0x0000000073FF0000-0x00000000747A0000-memory.dmp

Filesize
7.7MB

Download
memory/5548-3649-0x00000000078D0000-0x0000000007902000-memory.dmp

Filesize
200KB

Download
memory/5548-3648-0x0000000002FE0000-0x0000000002FF0000-memory.dmp

Filesize
64KB

Download
memory/5548-3647-0x00000000060B0000-0x0000000006404000-memory.dmp

Filesize
3.3MB

Download
memory/5548-3637-0x0000000002FE0000-0x0000000002FF0000-memory.dmp

Filesize
64KB

Download
memory/7028-6487-0x0000000005220000-0x0000000005230000-memory.dmp

Filesize
64KB

Download
memory/7028-6485-0x00000000751D0000-0x0000000075980000-memory.dmp

Filesize
7.7MB

Download
memory/7028-6486-0x0000000005220000-0x0000000005230000-memory.dmp

Filesize
64KB

Download
memory/7028-6497-0x0000000006000000-0x0000000006354000-memory.dmp

Filesize
3.3MB

Download
memory/7028-6498-0x0000000006730000-0x000000000677C000-memory.dmp

Filesize
304KB

Download
memory/7028-6499-0x0000000005220000-0x0000000005230000-memory.dmp

Filesize
64KB

Download
memory/7028-6500-0x0000000007EC0000-0x000000000853A000-memory.dmp

Filesize
6.5MB

Download
memory/7028-6503-0x00000000751D0000-0x0000000075980000-memory.dmp

Filesize
7.7MB

Download