wannacry | hxxps://malc0de[.]com/database/

Resubmissions

14-02-2024 17:05

240214-vl6g3sgc5t 10

14-02-2024 17:05

14-02-2024 17:00

14-02-2024 16:55

14-02-2024 16:52

Analysis

max time kernel
1860s
max time network
1844s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2024 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://malc0de.com/database/

Score

10^/10

wannacry evasion persistence ransomware spyware stealer trojan upx worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Downloads MZ/PE file

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD13A.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD141.tmp	WannaCry.exe

Executes dropped EXE 17 IoCs

pid	Process
1040	Babylon12_Setup.exe
5960	Babylon12_Setup.exe
5844	setup.exe
4328	setup.exe
4596	Babylon12_Setup.exe
1860	setup.exe
5452	SpySheriff.exe
3268	SpySheriff.exe
460	WannaCry.exe
5824	WannaCry.exe
1840	!WannaDecryptor!.exe
2892	WannaCry.exe
1480	!WannaDecryptor!.exe
3868	!WannaDecryptor!.exe
2768	!WannaDecryptor!.exe
2412	!WannaDecryptor!.exe
5732	!WannaDecryptor!.exe

Loads dropped DLL 8 IoCs

pid	Process
4328	setup.exe
5844	setup.exe
5272	rundll32.exe
1860	setup.exe
4328	setup.exe
4156	rundll32.exe
2336	rundll32.exe
5844	setup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00060000000233d0-2864.dat	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r"	WannaCry.exe

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
240	raw.githubusercontent.com
241	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 3 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
6028	taskkill.exe
6048	taskkill.exe
1008	taskkill.exe
408	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\IESettingSync	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\IECookies = "\|affilID=\|trkInfo=\|visitorID="	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\IECookies = "\|affilID=\|trkInfo=\|visitorID="	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\IESettingSync	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\IECookies = "\|affilID=\|trkInfo=\|visitorID="	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	setup.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133524039828443106"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	taskmgr.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 845154.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 539377.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 170512.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 684354.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2292	chrome.exe
2292	chrome.exe
4720	msedge.exe
4720	msedge.exe
2028	msedge.exe
2028	msedge.exe
5776	identity_helper.exe
5776	identity_helper.exe
2168	msedge.exe
2168	msedge.exe
4328	setup.exe
4328	setup.exe
4328	setup.exe
4328	setup.exe
4328	setup.exe
4328	setup.exe
1860	setup.exe
1860	setup.exe
1860	setup.exe
1860	setup.exe
1860	setup.exe
1860	setup.exe
1860	setup.exe
1860	setup.exe
5844	setup.exe
5844	setup.exe
5844	setup.exe
5844	setup.exe
5844	setup.exe
5844	setup.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
480	msedge.exe
480	msedge.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
4628	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2768	!WannaDecryptor!.exe
4388	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe
Token: SeShutdownPrivilege	2292	chrome.exe
Token: SeCreatePagefilePrivilege	2292	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2292	chrome.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2292	chrome.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe
1148	taskmgr.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
4328	setup.exe
4328	setup.exe
5844	setup.exe
5844	setup.exe
1860	setup.exe
1860	setup.exe
4328	setup.exe
4328	setup.exe
5844	setup.exe
5844	setup.exe
1840	!WannaDecryptor!.exe
1840	!WannaDecryptor!.exe
1480	!WannaDecryptor!.exe
1480	!WannaDecryptor!.exe
3868	!WannaDecryptor!.exe
3868	!WannaDecryptor!.exe
2768	!WannaDecryptor!.exe
2768	!WannaDecryptor!.exe
2412	!WannaDecryptor!.exe
2412	!WannaDecryptor!.exe
5732	!WannaDecryptor!.exe
5732	!WannaDecryptor!.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 432	2292	chrome.exe	30
PID 2292 wrote to memory of 432	2292	chrome.exe	30
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 1840	2292	chrome.exe	86
PID 2292 wrote to memory of 2100	2292	chrome.exe	87
PID 2292 wrote to memory of 2100	2292	chrome.exe	87
PID 2292 wrote to memory of 4920	2292	chrome.exe	88
PID 2292 wrote to memory of 4920	2292	chrome.exe	88
PID 2292 wrote to memory of 4920	2292	chrome.exe	88
PID 2292 wrote to memory of 4920	2292	chrome.exe	88
PID 2292 wrote to memory of 4920	2292	chrome.exe	88
PID 2292 wrote to memory of 4920	2292	chrome.exe	88
PID 2292 wrote to memory of 4920	2292	chrome.exe	88
PID 2292 wrote to memory of 4920	2292	chrome.exe	88
PID 2292 wrote to memory of 4920	2292	chrome.exe	88
PID 2292 wrote to memory of 4920	2292	chrome.exe	88
PID 2292 wrote to memory of 4920	2292	chrome.exe	88
PID 2292 wrote to memory of 4920	2292	chrome.exe	88
PID 2292 wrote to memory of 4920	2292	chrome.exe	88
PID 2292 wrote to memory of 4920	2292	chrome.exe	88
PID 2292 wrote to memory of 4920	2292	chrome.exe	88
PID 2292 wrote to memory of 4920	2292	chrome.exe	88
PID 2292 wrote to memory of 4920	2292	chrome.exe	88
PID 2292 wrote to memory of 4920	2292	chrome.exe	88
PID 2292 wrote to memory of 4920	2292	chrome.exe	88
PID 2292 wrote to memory of 4920	2292	chrome.exe	88
PID 2292 wrote to memory of 4920	2292	chrome.exe	88
PID 2292 wrote to memory of 4920	2292	chrome.exe	88

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://malc0de.com/database/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd753e9758,0x7ffd753e9768,0x7ffd753e9778
  2⤵
  PID:432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1892,i,12508954842139825941,4298677425208971630,131072 /prefetch:2
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1892,i,12508954842139825941,4298677425208971630,131072 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1892,i,12508954842139825941,4298677425208971630,131072 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2840 --field-trial-handle=1892,i,12508954842139825941,4298677425208971630,131072 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2832 --field-trial-handle=1892,i,12508954842139825941,4298677425208971630,131072 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4764 --field-trial-handle=1892,i,12508954842139825941,4298677425208971630,131072 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 --field-trial-handle=1892,i,12508954842139825941,4298677425208971630,131072 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 --field-trial-handle=1892,i,12508954842139825941,4298677425208971630,131072 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5016 --field-trial-handle=1892,i,12508954842139825941,4298677425208971630,131072 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5344 --field-trial-handle=1892,i,12508954842139825941,4298677425208971630,131072 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3124 --field-trial-handle=1892,i,12508954842139825941,4298677425208971630,131072 /prefetch:1
  2⤵
  PID:2168

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd635346f8,0x7ffd63534708,0x7ffd63534718
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3872 /prefetch:8
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2168
- C:\Users\Admin\Downloads\Babylon12_Setup.exe
  "C:\Users\Admin\Downloads\Babylon12_Setup.exe"
  2⤵
  - Executes dropped EXE
  PID:1040
- - C:\Users\Admin\AppData\Local\Temp\{51064CCE-BAB0-7891-9429-BB126A8B219D}\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\{51064CCE-BAB0-7891-9429-BB126A8B219D}\setup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5844
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\{51064~1\IECOOK~1.DLL,UpdateProtectedModeCookieCache affilID|http://babylon-software.com
      4⤵
      Loads dropped DLL
      Checks whether UAC is enabled
      Modifies Internet Explorer settings
      PID:2336
- C:\Users\Admin\Downloads\Babylon12_Setup.exe
  "C:\Users\Admin\Downloads\Babylon12_Setup.exe"
  2⤵
  - Executes dropped EXE
  PID:5960
- - C:\Users\Admin\AppData\Local\Temp\{C765FA97-BAB0-7891-BE7D-BE77F5491009}\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\{C765FA97-BAB0-7891-BE7D-BE77F5491009}\setup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4328
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\{C765F~1\IECOOK~1.DLL,UpdateProtectedModeCookieCache affilID|http://babylon-software.com
      4⤵
      Loads dropped DLL
      Checks whether UAC is enabled
      Modifies Internet Explorer settings
      PID:5272
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\{C765F~1\IECOOK~1.DLL,UpdateProtectedModeCookieCache affilID|http://babylon-software.com
      4⤵
      Loads dropped DLL
      Checks whether UAC is enabled
      Modifies Internet Explorer settings
      PID:4156
- C:\Users\Admin\Downloads\Babylon12_Setup.exe
  "C:\Users\Admin\Downloads\Babylon12_Setup.exe"
  2⤵
  - Executes dropped EXE
  PID:4596
- - C:\Users\Admin\AppData\Local\Temp\{977AF665-BAB0-7891-A266-6565532A3FA7}\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\{977AF665-BAB0-7891-A266-6565532A3FA7}\setup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3048 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1348 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5396 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2256 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:480
- C:\Users\Admin\Downloads\SpySheriff.exe
  "C:\Users\Admin\Downloads\SpySheriff.exe"
  2⤵
  - Executes dropped EXE
  PID:5452
- C:\Users\Admin\Downloads\SpySheriff.exe
  "C:\Users\Admin\Downloads\SpySheriff.exe"
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4628
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  PID:460
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 227681707930671.bat
    3⤵
    PID:240
  - - C:\Windows\SysWOW64\cscript.exe
      cscript //nologo c.vbs
      4⤵
      PID:4784
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe f
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MSExchange*
    3⤵
    - Kills process with taskkill
    PID:6028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlwriter.exe
    3⤵
    - Kills process with taskkill
    PID:6048
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlserver.exe
    3⤵
    - Kills process with taskkill
    PID:1008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Microsoft.Exchange.*
    3⤵
    - Kills process with taskkill
    PID:408
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe c
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1480
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b !WannaDecryptor!.exe v
    3⤵
    PID:4576
  - - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
      !WannaDecryptor!.exe v
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3868
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        5⤵
        
        PID:1764
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        
        PID:5404
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.btcfrog.com/qr/bitcoinPNG.php?address=15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
      4⤵
      PID:340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd635346f8,0x7ffd63534708,0x7ffd63534718
        5⤵
        
        PID:5772
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - Suspicious use of SetWindowsHookEx
    PID:2412
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - Suspicious use of SetWindowsHookEx
    PID:5732
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Executes dropped EXE
  PID:5824
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1732 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,9724470212801668381,2893337886963374569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:4600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4280

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\3fbd5dd66e71486bb8823b216984d73f /t 3624 /p 4328
1⤵
PID:5548

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\4103fa43b72d4c64b83a0e019fef5ccb /t 4988 /p 5844
1⤵
PID:5984

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:1148

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3656

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3952

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\!WannaDecryptor!.exe.lnk

Filesize
590B

MD5
3835ec6ae53114f02906fdd84657eacf

SHA1
aa937f2ccba9a1d0dcf0f2ff264d14fc68edaf5f

SHA256
3a0fc83cb2af05563371c75302cb39d7edae2db7a999ebc2bb02d8d3e84e5fcc

SHA512
51abf92919ce6bf1758c3220d7fba4f3fc008dcfda1acfb138b444665a1e31b46a44813b2d93b7b61127040f3fe4f94c578c43631fd156d2a6def185302f0fff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
194KB

MD5
36104d04a9994182ba78be74c7ac3b0e

SHA1
0c049d44cd22468abb1d0711ec844e68297a7b3d

SHA256
ccde155056cdce86d7e51dfd4e8fb603e8d816224b1257adfcf9503139dd28f1

SHA512
8c115e3e5925fb01efd8dda889f4d5e890f6daaf40b10d5b8e3d9b19e15dadcb9dcf344f40c43f59a1f5428b3ee49e24e492cf0cb6826add1c03d21efdec52ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
95dec53038b1d12d430df84d3865faf4

SHA1
0467cb5eacf529573aa20abc4c3cdb4845970263

SHA256
37f5b14c1549ae440aa41a9bb412ceba5c1bce67c288faf995b2e25af5e55f71

SHA512
b7f353f42e9ae87cb286bc1e7b0f5fd1d93b97aa858b98f2d01c54e26c01e309b45b07973b347ac197600b6e971a3b933abe680e1d8fbcb9ceb3317eabeaf688

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
cad4d04032299ffd222b09646d263d00

SHA1
8424921cf63986b80f5e1c4420cf374ffa9ca1a5

SHA256
8d26fc4fd5fedfdede2705043e5e069cd2c4eddb59cde750fa3e7803ded2bf75

SHA512
1c1f99c8a51788bb87c64ee65bc35dfa52cf7cc2d16dd86df89fe4a5a7fe90bd93cdad60410579be014f90db23e66a77762769cf1ebdf2b5a5d98811fb4f1a9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
367B

MD5
8f63f3ef895798d568af92443d24b4d7

SHA1
17ae3c38d56de65578a3caf5101f6ef4c5bf35e4

SHA256
bb636bf7c2dee7535d3b103fd7b79c45443c53901f75884fb7b454480903f8f2

SHA512
ec8162116cda6b1a5374f55f3e8a603c3fbfd8059f6b7aec41968dfb647174b5685263e75a53f962703c99934142faf9cc3f8f5ccec14556b7c008636efb7183

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
367B

MD5
0e7c875a3a3b37d85ad3a8acbd7bc3f5

SHA1
7833d0b495a13d6c98a423adc6eca5bce6b47cb3

SHA256
219ab8c8337718e9552e1f662c0c558a313ea7b271506bcc294dfb299803bbd4

SHA512
ecf7ef1e7751bcb81bd069907d01db75091d786e01b94690bb0dd79a9af009083b9034cfdad0bd2fde1d9e256518908e60d5407242c411e9ed21c07c64a99e89

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
47023278b9c0b6d1e08133b5c8392003

SHA1
1f80587618be88b72fe48d531d97da59dd0c94ef

SHA256
4bdd61703ec065c53619358e46bc7f9d8f0126f3a21a8cfaaf42049fb14af325

SHA512
66ee7a57f2f0aac0fdd13afd2e05ade98888fb15e7a17f8aa97a5e55913737c0573d051acfdf4b8a36a147a55e994ae143494a1202bde641ab51f2b1960dab1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f9ec4890189255e1109fde5d6299593e

SHA1
e6dd5f97132784cd3d742aac09ea01b3b3886184

SHA256
affaaa1e2b5d0bfba8f2a4a0c2176cd7d0c8ec1e929d626cce61efa2c87838b2

SHA512
17d84f37fd50b021fc2269092d25bac3d89dddd63e76df549f8e8ca75d649589e55c2737ab26c61afb2558b3d917ba306aec1e341f9720c21b74e52336e117d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
26eff988e58d653025d2f96b20d6baa9

SHA1
6c5cfb77c0f61bc955191af86ec283821407ee3c

SHA256
98a192dd6846a912412f9587018d9ef960829273464ed268adf6b658090260c4

SHA512
aaba6a55b97c5cc905ff22365837475b4fbef45b6abf68588715c766f853f2964a89d75fd1b09c6792d5b566f47680400ded55d66444b4bed1fafc44b59a6521

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
5ff038c7f96515f58839ab6bb91753c8

SHA1
5ef6c081e7efa978963fdcbb3283615c4c15126e

SHA256
29e548b382d24a44bbda8f696027a31be94f9d481fff2a6eda4d995ea000085d

SHA512
c7c5c80b1c54ab4422565993c713cc6a72e723f58a4ae98193c349f3c7a71c12fbc1cb355f888743f559dee4ee0811db0360963d4d6b74b46a79c3162cb912a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
efa023105d086d1a4140f4136baa5c0b

SHA1
a0a511be0bdafacc89924dc02a96c9b68bb23cf5

SHA256
412a480981688a11639c1b6d622e9654963d183f00454a3ad116667ac1e8aae3

SHA512
e38366596a7c1ef56840b594e06e861fef4249d386339adc64145a429c1afb8eec3bedf08b4e94ae1b6dec8f100f611370af1fe8951173ac0dd8b1ed86a2baba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
93eb924ec552a1f169fcdaabb74f21a8

SHA1
cd0e013889026f95a6d16cb82bb0667b1a8a26fa

SHA256
78092e775209049079e4891fcb34ad3bd47f15ab6b38f09904136da46be625b6

SHA512
1fb1188bbdade6c1950d7085566a4029c795f986fe5b1300fc3d3eed16146aa8f9f022ab9d05ac39df0637eab3e371f32537019e64e77d0d87e8b52b1cf46af1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
7577a8baa8aea4d5b98d0b9aae0b1ef1

SHA1
a34f1d4d10b21199349be93a318b478e3bc3902b

SHA256
443bc630262e1bdb1f0a7816d0e6677ff0781151e801eb4a22723a183148e5ab

SHA512
ab4e58523baadd2342cf584ee6847c12f9046694cd260df337631764ee88084bdbf4c05860ee06a2464558846fd39af4d241a1b981ea3dd0b97dfd7e450e948f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
3c6ac6a9e70362e4e6facdbd6039b1ef

SHA1
34b2efb561d9be00e21e35eef8988c882da3a6a1

SHA256
0719ade63154dd97b5c966c7f22ddc8e35a483ff3f4a140b71ca4919986fbb50

SHA512
d50dd76d2b609514fd529f29dbcf4e7b8ac646bbb1c1b35b275b1d3125148fb27628f65b9d0253dd04cf19315688a8cb6a61a9074ad123c4c39e15ee294857b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eb20b5930f48aa090358398afb25b683

SHA1
4892c8b72aa16c5b3f1b72811bf32b89f2d13392

SHA256
2695ab23c2b43aa257f44b6943b6a56b395ea77dc24e5a9bd16acc2578168a35

SHA512
d0c6012a0059bc1bb49b2f293e6c07019153e0faf833961f646a85b992b47896092f33fdccc893334c79f452218d1542e339ded3f1b69bd8e343d232e6c3d9e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\74a4de20-959b-412f-a9c8-6e03ea442750.tmp

Filesize
4KB

MD5
aae7db88133c2a8c2e507587ab7f8f63

SHA1
822c4159f4ced166bbb72494f19542042671ef41

SHA256
d3dd394230080ff0b203ea0e49adc14c502c91511fea2856af200a0323efbca4

SHA512
17d8d6eb0eecc3e0b075e155dde40f8af36f99bada676d79e62550f79f9d771a9e18abd723ae47d0f344f5245dcf7696eddb57ad45038a9db40ebe6abd08b762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
29e93f1004edcbfabf13b3dbb8afaa3c

SHA1
615121e35a7a91086ff80a2ecae0e862a0a55cf8

SHA256
3f5a944134e3d71d80dfd98b111f2a7dd1411095ac1748fb01fa35fc3501c7e9

SHA512
56e02f8438e3131d948641e4a16cc2c2a5569bf1af350333156a5d4a9db783b4af13b4cefcba2056a010a7ec2dd58380458c20ddf88e58130a60851b79cacc5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
4bbd9bfc01135c83d9f77bad0cf3d985

SHA1
0eb917c8b20cdc4815006b19ed4f47fa7b1739c8

SHA256
dcdb0d39643effa19723aa2a7a6b956179a64d7be9c53559df760a39005bfc58

SHA512
9708c1916edd8a07ccf972ba210c9cddebc2e2326da309652ddadd6ad6bb78e4de9a67fbc3e286ed8809e975d2902037b28b0879ed52310a9d069245c8d7e16b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3a7a765cf1d07994e1b6fa0c9a58d4f9

SHA1
e0e7d9c4f65850279b8b3e1c456f5059a1dade17

SHA256
2e1df897dccad2bab968b5301a5ddd382db30f807e79f102ea3fe875d2866683

SHA512
aa8b5e7128d786400582d310109b3e18f7785bff64898b1b07ec417a33d33f19e96f184e42b95d935abe9a7e9eb60f3306a8b44b85cc6f27cb55e6c9ad1701f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
edd3485e1b9483d0f71392fe47906a3e

SHA1
f22ec4c2802b317dd049a79b6ac7386d81068ea0

SHA256
7b1f692f2446df2322ca18a7e1c5f67b983d0d11bf337817aea9324e20781644

SHA512
b5b124c4a31054bb551f0d488e9c6894771f211ac9eb9911dce54c21ec05ec861eedc0ed15e992bd92f048b9a43abaada89bbddfadad162e05020e796100bbe6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7887789cac4a88dd947cce92e6eef195

SHA1
3cb0fc5b7c9f73f71c7bc857f1193504841bf79b

SHA256
cef8e3e28cab4459fc931264ec4d7660b6f1cbdcd7df67bf8c525785f7504ec7

SHA512
cc39b76cd42339724ce2502ea7caf66bf849567604403a85cc1c8db7544126783cc6c34185d262db99f3a7176d34a75d7b36b4e0865f9325ce744c5f7f388d91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
711f1c64ac123059e05d4b7cdcc021f7

SHA1
39812f2179aa86b249abba0c18cdc1d77e2000df

SHA256
d520a8fcadfbe54db81727cab383a12d34c09ccc13ad2a02d6dc4339c16d580a

SHA512
4ee4461c83d87b5965998757d163518e16d6ddd01e76053c26a97c799ad5919463ad8439b1ce6430340cdf9f3db67395d7a124142a9a22e45c33f64193d15d61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
db0d1674894913984450ceef0d2c2494

SHA1
81093aa05c9fddeb50cd009b113e1c2f0c0c5778

SHA256
f25bfbfb8d383532e25247b6f9e165faab6353cee86f29e1fe38c272efa3983e

SHA512
536798e8162b04575520690d1f1dd81d7ae75b00137c9d6446fa49ac1e96242b31159f23d362f5b4456bad7182f8d934d20e6e7e818a4251531a8dfa48223df7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
da72376181891fa935f66318d6db0293

SHA1
88e611b9a2c97afa0cdf6e803de2af31386625d1

SHA256
ee5b9ee8914c3f91eb8aaa0bc8a0848710be145225894ee36f625e8e4f9812ab

SHA512
e4987503fd1d9179109a1ca0c8316e9045b9839b15de8aece5b3e4fa705880041e6d12b42c6d00dcbd4917557f4d5c9609fafbc6de2b0b481ec0497f8b64a59d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ce99980126297e725dcb6724f277c707

SHA1
cc41c09b9b25f4fc95bc1f9fab4ee62decc20c8c

SHA256
6637eeba8a6e68e0c1c6a5c5d270d140fc6b0c947679d34c18270a883cd94e69

SHA512
ee72ffb16a1e513bdbe84e2557c4a71d30a043bda2560a55a85cce5b1f83bc22d2689b5d2b754d018bd1dd26c073ef5b9318d415ee9e2a672e9a94137879d819

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f593c045acdc4b643d99385f41e7a4bd

SHA1
31e3edad6ae971640f19054f8df535ca9ab542a5

SHA256
7ef9253e9dab79002988aecc3ae8bb53cdf0a4c037d740e5f1ef2b108bb12aac

SHA512
ebbf9af9617b1a9b5c84db66765fb7ce9048fe382caa4a38a73ece8d3bad11973543782698a71e06c703b27a99ac7fa52b7b5418c3b30c25989434130cd0e91f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bc48eff1c1642032a04dc61cece94eb0

SHA1
5c32f933f5a53825530dd276b70cd991f5c4c534

SHA256
3fd73a7fb9ffb6ba64873424d3455ef3e25e4c0992a0a4ad9fd094dd8f17378a

SHA512
0452b445dca76c8223ef4231ef5041eba42faa259ce5392bb9b3fc7f2715be349d9bd3d756adb7d528b0fe06494041a0486a9d96a1dcadb0d786440dfa6fa507

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
2bbbdb35220e81614659f8e50e6b8a44

SHA1
7729a18e075646fb77eb7319e30d346552a6c9de

SHA256
73f853ad74a9ac44bc4edf5a6499d237c940c905d3d62ea617fbb58d5e92a8dd

SHA512
59c5c7c0fbe53fa34299395db6e671acfc224dee54c7e1e00b1ce3c8e4dfb308bf2d170dfdbdda9ca32b4ad0281cde7bd6ae08ea87544ea5324bcb94a631f899

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
48d19430190e236e7c2fa971fc2d7ed7

SHA1
894ed55f8347cf5ecee7fd62e01731402b389ac8

SHA256
3e0416a2555f0d389ede44d10963606ed417299a4e11f1550d17b39387ff13a3

SHA512
c83bc33a5ffaf0f663544b9ec0fa648769125966644103ccbc5168ec4477cf7d1bda62addb1c053764d9486d8b5e105710ef830fc992e721aa780c9100a1262a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8c9cbb3fd0d7d3d15329b1681dfd74a9

SHA1
3866fd14df2cd932396c05882747d79947854f1e

SHA256
1411e7f827976920b578928702811d50e83e69b5b9084d6e65eac15e984f8f19

SHA512
4a126c77c84ed9533348ea077bb8964bfcd3f654cc63ba699cdbc07a6774b0e7643516106d415bfdbdaa6d46e1e0165c7f23eab6f3bfa09b750c03882902f6c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
ea3d184d8e88e537795474dcc5a50326

SHA1
6bb0e5d662f1765f3cd5b3b47857cc2a36d8e3eb

SHA256
8b8d2ea35679d191614b72b031cc45bd6a03f7cc15c7770c06638ef05c8a8ab6

SHA512
785cf77aa28f75ddf19f2b794ed9adbba71632bf5d9f1cce363a1f2c0dfd4edf6779d69713da2b3f7c7e73a8764baddc4a92acd5e3a9b5498e3e9a1d4e18d9c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
fb5c2282d97e0024cb9260a4e9112b5e

SHA1
41ae81b99ee069a366981f2f2c8fc2791cf3a73e

SHA256
f2e81057e51ae7f1add13bc8b54b6ce7fb95d03b4f096f74f49e9014b644ad04

SHA512
f6159f45da7a61730b5733b2842a4e4ac7f454a21496273a5d07ac62c658e6d7b5d769b8834379404b5a2f31bc925fc08c6927887814d6909aaadb748c2df6c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
baedc75932662987f6ea9b2c0d51a465

SHA1
7032f532bff1057a43aa2a978bb2d014ebbad3d2

SHA256
a71369ce975abe7c3cfd1010ff5cb0684cdbc8bbed6bf2eb7b63b07918d8cc51

SHA512
ea063a4db94595c90c952bd9d5e5f10b67d4254141df2cc299bbe534ec33cc11f7fcc283947488ff7417e0f625a6bb21f8ca2124b9ce17ffec54c67bb1f94624

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
04515f6aa4ea9c5b7e628cc5cef002b8

SHA1
89756efe5060b2c7f24f0f301c230b2caa91b04c

SHA256
ac8a328808429cab22cf69d028e0e3712fd93c8f1b942e892f6ba2a1c84b09d9

SHA512
a3ebd7a257beb45d14adab86e153d88765a6a639eb640c5802b33f7a9a6068520a13342e361e9721197e3a7bded8163053e64a933959ffee0e85d9d8730f3ff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
cff223d4cf8b0343520f65775f33b42b

SHA1
2f3f5e1c3739748771735ccdd153321178a809fb

SHA256
601db620b341800e59561c23522c534d66ac4c480285301e3f2e19dc314258c8

SHA512
fa5858e6f44242736b17c30eb2d5b8005558c0222288d632a0c884194a0a8104a72f160877a552012d575d615a9ea377243b2d20ca013d3cf222b3ef8ac22a7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
db0e2c47665638f4dae535d1403dbe35

SHA1
b75709b7296747b5d4fa56b44df84bfaaca1f810

SHA256
2aa29b60ddddab2c2b7c68179edc4e4952730e6d59297da097757b9a4b0d2069

SHA512
fdf74d67f28b65610d2139fa033fe1959357b91c5368d54a65a8c1993942a751c1690b9ae4c9c92e726877cc115ecae2a1b1f81fa70d07e421db569c40535d7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d1be9764b052948f906188883daad2ba

SHA1
da99495738330f78290f76ecea3106f4d212503b

SHA256
d50a3b74cc33a0e4ee044d3804ec8556dcb2da8ee07d8431a60b6a9e45408d2c

SHA512
05ec32581b27f6fb7bb86945ac61f42da2189eb8b4de9d55d98867677b0362204dc9b3585b52d9093f88dd8139528947bdfb7d2e8871a4e970746d468c68ceba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8fe1f43fa1d5a6f86d40ca8c4fe38349

SHA1
d3cbcf6b535fd3b1ec1da27878a57857655a378c

SHA256
a27c5ed41a0cee7c262fa8c5ed225a2e546585014f48b721d4f4ed7cf5fb395c

SHA512
0f7cb37ed35faf08ea8917377362e127d4836b408b9457c32e40f093cce5e9533fb6f72eb03f60652e6386c2f148e7ffe077ba09029e14f50b4f2510887fd0c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
38743d3c1309141012aaa79edca86f9b

SHA1
3bac2220320e84ae516a3e61338b82ba7daf6011

SHA256
e9090c31c989e93c9b86325d2964a9c3ec377a0bc50354f845e1b6317aca6292

SHA512
56d14167460ca8b2cc624998c5edb39000ce923018620a85a910af2780dbf0f21150e4899a6bdd4d3baa6df78e5d800ddcc0b85740c08b1e2d8a84c1f1ec56d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c29ec8ef0ebf6660229e5a652f91495e

SHA1
98ea34a1cc34567bb27f0825f7ffc69756b09f04

SHA256
05db6e7901ed81bd6fb476aa99530b23fdb2bbfa80a6bab9e927faf2638afa50

SHA512
274f844b50ab773943566db894fbfef6f0b6f35d1958ac3702d2b300bcb478e1b6de5d1250be42fcac59e88a06a7ce3a4251795f01d7ca1c79a2d14516c966ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6b3d792a797d2570ea0c5470c331ec9a

SHA1
e147b38736a27bc4cc7f21c698e3b178c62ddf1c

SHA256
1d63c01e97b582efc55f2edd928d2d7ea8f9fc2c90c89e6e384df181ab959622

SHA512
af200df52859a8202823db7e61883f51e60f1ff933cde1b7108b57ec16df1f74391d61688bf60c0b6a2d23b0c2d6ebb7682a065a74c9a18f91b84ffd74d49e5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5860e8.TMP

Filesize
1KB

MD5
886a8bb9593fb9de7b94907148f64235

SHA1
04e78cff6725ee97784c5c4f6f67bcbff18d60d8

SHA256
f2417387e5f286aa593cf83bc55edf8dafa284f93cb7dced604be84debff111f

SHA512
58cc5c8b45c7e91303096b097a638f8ceac2ea9eb98d4f8390ebadea99883d15a3be2f94d919c66e0173746086051e56e959f9d08dbbe8d36d9e53504b9a1ff3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
67b40a5256ec1c6e05a593c97a5dffe0

SHA1
be7c9cc221470442fdba05a9cf8af38362cb245b

SHA256
c317c5087c851c9c8f3a306d4c3a3f9db74a05265c47b95f94c98860a1b7efe1

SHA512
4fa882acb46713b5751ce3fd23d5f4f430bbd465b46672d2bf0a33c778b3d737e4bfef3dfe845fd722fc3631b2a6e60857e649cdbc8d6fd64343f9742941d2a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f0597e900239d87a0e361304a41ef1d0

SHA1
84c0d5da8344666c5664d30a7c82a89b9ed45b58

SHA256
f60a942c7172900bf2d15384a5973dde36002f3586b976ff35812f710f8643a3

SHA512
035acbb38f01253674294ed1b844478c7e948dac3aa787a6d2b428248af168d43e23ebd192a491d4714c3537017040561b53f0227eadede283deed60202a68b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d63380caae8c138b5a83a8824171797f

SHA1
ab73982f537052e81938e751b12cac7122e86e18

SHA256
07ed8a5a24d2955ff68af045f0f30a86b07957401acfeaf173a88eafd4bddd0b

SHA512
5b16d71abf35c9fbcfb800b4c808e1a5080b6042c53306219f618e3d1b290d82b7cdf57aef47ccbabb9eadd2ce091a26bf1b571cb5ad587fd2bd744eb970dd68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
876df417f34488c6dbd8db40a8c1b240

SHA1
5fe8953aa4de7f6302373c0713b92ba4bf536543

SHA256
88b1e396b442ebb7fda670e38d5a556f22260713b00b2ae93bdfa50a8a4e508f

SHA512
d20d7aebf3fb65f2bd6f3d80391324ad5a19ebb089bcdf832d7ebdb1365a99731eb38847efa471ed0e008e7f03cf0ae69d2dd69362686377ea77adffdeea0c08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1f1dd7572defb335e5edec34188da136

SHA1
46ef8271b3472d813af76ad633cace3ef0fc0412

SHA256
a687df42fd0149e2b1e607fc9ae94b5d825f329b32b3b663f8e01221637aa95e

SHA512
112fb5f9cb31e30e9f9be41c669f567ec6331f8fc5da2f31daea45225fac1ce6787d25f7d5fc1c0dd6d7353de39921d6a712c0010a2b720fd1879e5653e85ae1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2a682cf702ecb9dc975e9777e8d075a4

SHA1
7ca26f2ed8b493cdfeeb6d46e252256a652b75a8

SHA256
fa492a0c15440c7f864197164af4bf0d8bf1f31bc7b871144a3006b563b5f357

SHA512
9b08298f959eac85c90c9a256019a5321c79a702d93fde44e22846dee0e6fd7e38bd99a501677993a148eeb092ae85961f7708aeeb1f6ff3e51956fb23ee7d28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
bda74b9a9addd3b358433d6930840207

SHA1
1e1515b830d54627a9194b8c4a669df6f0126b95

SHA256
9a11edf61d1f819f52163fae601ef23fda873e967f1511e933844391f1516381

SHA512
e26ec168e160db8eaf24b597b9163e752f30e6c3264f6cc99158c11af1d1a9d520d09c482d255f5435e52ffc46441d8e8087f3fa41a40f90337e837e09291595

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0f7571362dceaef8aa82451c925b7efa

SHA1
6ded744b955740b1a830b95d7e6672262d79914c

SHA256
9857504df856276eff819c9a30e420793000e0f2c5c690342dbc0b57cb5ae2ad

SHA512
8848a58f86383541af7f201ff212bed514da74b63c9eee80912530bbbfafe0b5d7e032ee358966d3f6af83a5d7ed9c6d23fb93d3bfdb2288501f9b3a5aa88cd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7c018562be2058412dcd41ae3d23b1a0

SHA1
9fc8c3a3b60b6515a61f8c5de234c476851e117c

SHA256
d43a0b4be71a1e3f8c5842c5c5a809323ac811b80a6e66347742adf38da927c1

SHA512
c61be89a3e956023f4c99b79e37bb3be59670bb12e385fe71a0b4f292257e1f24de38e25539024b4245956f968dcb6b689684ceeb1d6ccbc3dd805f8403d04eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b81974394bb25eb5a74ca5d49ba19607

SHA1
ef87181767c45e798b7308a0a9d14460b6699c86

SHA256
0a3d995bc5c597cf70c19b106b4e8675672e88ed0b8ed04bc43e5437a0a7e0bc

SHA512
fea4ac4e9cd6c23aa1e899b27305406ef714cf5012ad930938e05e6f879e05c21c633bb81e7109b84ad734e4349213aecf9dabe398444dfec3a5a07fd151b9c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__0AF77AA08ABF42A0\Setup-client_cae2be57.zpb

Filesize
5.9MB

MD5
007acc9f4cf1d2037876784d7a10a9e0

SHA1
a761d0d7e507b711aeea95e877a9f63e1901f2ef

SHA256
5a27919e72079d7898abfca342ee7980734203ab2ef4f718d81d5fca9132c4fd

SHA512
0f3d2d9ab6e01e982a99304c7bf9cac60cdfc45a1789ad623ecce157b32d16277b3c516e19fc05aeedb1b59b6a0421bb27fec46529e1278aafb6d751b560515e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__0AF77AA08ABF42A0\Setup-w64_ee21e6ac.zpb

Filesize
263KB

MD5
ee6bb1966c5d3af6fa6e9c74c90c419b

SHA1
e501a11c8ab1fb96f3090b07921a0e33d31c431b

SHA256
a8575b3800cc26991bde8ba09353ea32bd2d7ee35b082645985fbb1bfa59dcdf

SHA512
6fc26eefcc3b21e71010add7943b728757cd3a4cbc59f593e760b2239d9349dc6e360934c909217f5bfb7f210ee18e05e385af5da93c8d470f82ccf6ba486212

Download Submit
C:\Users\Admin\AppData\Local\Temp\{51064CCE-BAB0-7891-9429-BB126A8B219D}\Setup.ico

Filesize
31KB

MD5
dd7f9d6e00b90c9d463bb00d105a3b85

SHA1
7d645f32dfaf4f977965fef03bd693f66b2b8af5

SHA256
4f524c32357af8de0bd65cb9fe1bc3139683bbc5bccc64d8cbafdc72bb4da0a7

SHA512
0c46deb0016ec877e56caad2f3c1d5123e877aa032fdc03f536f3fab5ccc3792504b23135296a572acccb7b75b456efa5b8c9f6a08fc0077698a1bf4c06897dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\{51064CCE-BAB0-7891-9429-BB126A8B219D}\setup.exe

Filesize
1.1MB

MD5
8de9de6410fedeedc1d66cb1aa7e6b55

SHA1
c95531ac2408c2b2ce684e982e22f51c5306fe8e

SHA256
1dcbe2f9fbab8f1c71cd39edb981b4647f0700d1a30cd3bab87c34a7e41e17b7

SHA512
39f46897579db309294997dfcd4d6a70ad4e875eddc18f810c73c5e1a9e60eaabbb49d12badbf86f3f06d67324c4fa43f0b68bbc87320484f6bdc75b2fc6787b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{977AF665-BAB0-7891-A266-6565532A3FA7}\setup.exe

Filesize
819KB

MD5
cf8315f94f78db61ad3568d1e641ff7b

SHA1
eb9882caeaeb3c7be4c38f08894603b49652c8e3

SHA256
6fa9bcc08dfc07190dba85286565c5cdc42ed1c1571c82e644c81877a67a9eea

SHA512
c059cc093434bc69f75f8a8d430f9f6ca2be4b0467a351f6ee2dac1afc8c5a27ddc6870919f90cef00f04b729243b310690e3b6da1900b3b473317a5fb82d60e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C765FA97-BAB0-7891-BE7D-BE77F5491009}\AbortPage.aoi

Filesize
172B

MD5
7ac8227fb82182da706dfbb26044c977

SHA1
00c29bd1e6c04f265e6ac70d9b56c8da7855f78c

SHA256
a509f4b818e7fc359cf104cd4f320b3116c4b1e4e06c826b4279808194eaf276

SHA512
272f89b7a4bcecfac91f0ee7f73e372f13fa172bb31a734904a09a5300465a6cad0cac1920f45a6a47813564c29706d2a5327c166a79e3dfbe72170b6a3f664a

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C765FA97-BAB0-7891-BE7D-BE77F5491009}\ClientSetup.aoi

Filesize
190B

MD5
c7cefa16289de8830edbe5a693386f74

SHA1
393cff22ff616d03e2623b42c49d163fd3548536

SHA256
794d60dfd8d3652d914f6210113657a552c39f8a972c58236f172a6d57bffe2e

SHA512
d6eb73a2c8daf679961017567a712eca709c27640825d736e748fafc5341d3e82bf7e959d02032a018d1dad1337cd880dd651bb95e2b12144a0df9aa14e4b157

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C765FA97-BAB0-7891-BE7D-BE77F5491009}\ClientSetupStart.aoi

Filesize
86B

MD5
1408225f8c6c919c3f7fdc3a0a70d9c4

SHA1
6ae23a3d57d0d09d182dd3fa24c8173c311aaf64

SHA256
4b91c539986a1083986741a3472b1b2e91ffa06d57f3916c82b0ec731ac568d4

SHA512
df359c41ad452c5833cb3693f829b95c2d4466b74dd655fd622f2f040912cd1debbe402a407e12ce1189e92449080286ea1290fc2797a3844eccd3107e53d295

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C765FA97-BAB0-7891-BE7D-BE77F5491009}\ClientSetupStart.dll

Filesize
8KB

MD5
b76864cf7b4b3e220e14d108df981c57

SHA1
0571e35974a218650bd2ef487c4f443962b01a0c

SHA256
eb689b0bfcab08794f7ad33c63aeef12b26e0cc5183f11cea87e01e9ae7b8493

SHA512
17a28cef3fba618d498608c22a18e568ab3deb003594bc003685020838ff52d46e31b4356ff464934385cff7304866d5cfd0df50d730dadef53e07f8958c2ba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C765FA97-BAB0-7891-BE7D-BE77F5491009}\HtmlScreens\loading.html

Filesize
644B

MD5
3e800e2e002f460a1597e673fd8e8585

SHA1
d4f92749d9a9247a550a883466eb837dd1aa4ea4

SHA256
0698229d787a96a822a730a8a7670b8e8f7a4e7f7879db9d1bc2d5637db3913b

SHA512
b5770ff44df49b87198be5c7298228df9474e3fef7c6819eaa64b5ef03d5907fa1313610f460b1c11d190b33ebd579bc1c43d3eeb51d1d8fe2973806797b0418

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C765FA97-BAB0-7891-BE7D-BE77F5491009}\HtmlScreens\navError.html

Filesize
926B

MD5
2a5c2cb4033acbe233c5e496021e3442

SHA1
12a8076e400cd9c401c980b7f9d938cf599bd302

SHA256
f2eada05599a0e054380c20bad2456459ddbf61c0bf9170b1c7bddbc96ac4517

SHA512
1b92395231be355ac751f9733080a8c8c69cda7992b4c1dcf68d922f0f5194bac8c5bdf717af88f9e50a83fd96812569013092cd0bc9484e403c16b44d6004b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C765FA97-BAB0-7891-BE7D-BE77F5491009}\HtmlScreens\pBar.gif

Filesize
3KB

MD5
26621cb27bbc94f6bab3561791ac013b

SHA1
4010a489350cf59fd8f36f8e59b53e724c49cc5b

SHA256
e512d5b772fef448f724767662e3a6374230157e35cab6f4226496acc7aa7ad3

SHA512
9a19e8f233113519b22d9f3b205f2a3c1b59669a0431a5c3ef6d7ed66882b93c8582f3baa13df4647bcc265d19f7c6543758623044315105479d2533b11f92c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C765FA97-BAB0-7891-BE7D-BE77F5491009}\Setup-files_fd926fac.zpb

Filesize
159KB

MD5
72fb5450b0d0e9242d5c7ff6cf62e4d1

SHA1
da27e88635e071e94126ca3acab4f50a5991ac2c

SHA256
9929a83ffc94bda7baf732ace3316aca085afcbd3b0de45a6bf8f4d40a351e6a

SHA512
64708300946b9fa1db6206b8d067615296a9af4baa6a63edcf80e72cf42728a8e50c9e39a2a2079f9b23c075afd3f8483767e87347756a0491b0b76c6ae1883b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C765FA97-BAB0-7891-BE7D-BE77F5491009}\SetupStrings.dat

Filesize
16KB

MD5
29f499560e54ace4ac6d95c20f7a5e85

SHA1
d6e99033ecede912fb0403ae02d60141e1e6c67b

SHA256
1a13997c37bed6159085726f844de6455172cda3812be9b557422e3c6ef789d6

SHA512
cf71be7260776c84389a9ac34689a7f456ab3f806bfd9e04201ab068bb83c0bff890c7c7b4a644c061a30092a2554b9861058bd60293d3cd3fc1304ab06762c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C765FA97-BAB0-7891-BE7D-BE77F5491009}\sqlite3.dll

Filesize
508KB

MD5
0f66e8e2340569fb17e774dac2010e31

SHA1
406bb6854e7384ff77c0b847bf2f24f3315874a3

SHA256
de818c832308b82c2fabd5d3d4339c489e6f4e9d32bb8152c0dcd8359392695f

SHA512
39275df6e210836286e62a95ace7f66c7d2736a07b80f9b7e9bd2a716a6d074c79deae54e2d21505b74bac63df0328d6780a2129cdfda93aec1f75b523da9e05

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C765FA97-BAB0-7891-BE7D-BE77F5491009}\stp_bbl.dat

Filesize
280B

MD5
7722e3fff6c99bddaaf66252c322ea93

SHA1
64d936780e1a598b1e3d08a252bc3a1acd59d738

SHA256
0c7d9669aad062e26eb592f27772a15778842c1d81da280fc45f8c9fe4d08f6a

SHA512
f16caf5991cf3ce20d59378d954b75978c6c7c3c11d09ac871bf29fc9463e82387f81b29cf99cc3ad3d45d2c05be3b1572266e6610deb5b7b6a62d6d57c03831

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C765F~1\IECOOK~1.DLL

Filesize
9KB

MD5
abd901c6fee432c162aa229f5b45ff46

SHA1
c75aa78967b501bf285e1f902c75979169981806

SHA256
ce53a29075d1317863c453b74c1bbae045b00fa85b10e969d0cc93be3fccd030

SHA512
f55906fa73f06d01503ccf18431d3064055f8539b831c61344bb0dd2f0dde420ba6d3979e150e74aee420e482fa953ab4978f3a7797a271c7e659d573b290728

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
7ddf9fc9d8b380f40e13b6a6e892a105

SHA1
8a401cc91b00e4d3de0fb979fc76007e73b7d77d

SHA256
6639a698bc7cc0ee1350ca627c127b84cc31107bdcc159cf396a5970cbee9fbb

SHA512
629e127b3e31d9328dfefda552fca26c22e465c6a6e594ec3d803f9ea13529546854958f1df265a5bbad41fd5c39c787178aa2b54341884c2d8acbc43753ff71

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
426086e40560a7f5a3e8498405c6a435

SHA1
4d81f37a86da57ea2d04e7a539a297e891fd3601

SHA256
ca83d1288d47d4767eab18b75af4b47c4ff15ce0021004c13c8fb701abb9ec0a

SHA512
4561d6ac315d15c3728b8f82da67711ad6c5f4ac366166737cc8dc77b3b120b2c67cb53b24bf25926747d0d2cd327a4fe2cbf56c877f6f33f0167029e0be1c71

Download Submit
C:\Users\Admin\Downloads\!Please Read Me!.txt

Filesize
797B

MD5
afa18cf4aa2660392111763fb93a8c3d

SHA1
c219a3654a5f41ce535a09f2a188a464c3f5baf5

SHA256
227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

SHA512
4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 170512.crdownload

Filesize
670KB

MD5
5cc9e44078f5a9740fa7692c8252a25a

SHA1
ad2256d2cf6d13e8aef26089bafa70c480c73623

SHA256
3ba30ffbb1a0059f5d0c2de7b38a33ba05031404d8cd8c970e50861e4c892475

SHA512
e024c97ca1273cd0660d128aad5ba44aa020701f50b9b6fd391576c652967876a7ea5cb18a84ef3a6b95a376d0cfe1d3c2119d9afd32d34378235ee369b002fa

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 539377.crdownload

Filesize
84KB

MD5
9d15a3b314600b4c08682b0202700ee7

SHA1
208e79cdb96328d5929248bb8a4dd622cf0684d1

SHA256
3ab3833e31e4083026421c641304369acfd31b957b78af81f3c6ef4968ef0e15

SHA512
9916397b782aaafa68eb6a781ea9a0db27f914035dd586142c818ccbd7e69036896767bedba97489d5100de262a554cf14bcdf4a24edda2c5d37217b265398d3

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 684354.crdownload

Filesize
48KB

MD5
ab3e43a60f47a98962d50f2da0507df7

SHA1
4177228a54c15ac42855e87854d4cd9a1722fe39

SHA256
4f5f0d9a2b6ef077402a17136ff066dda4c8175ceb6086877aaa3570cabb638f

SHA512
9e3365c7860c4766091183d633462f1cc8c30d28871ae2cd8a9a086ce61c0bccf457f919db6826b708f0cf4f88e90f71185420edc4756b7d70137e2096f8797f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 845154.crdownload

Filesize
224KB

MD5
5c7fb0927db37372da25f270708103a2

SHA1
120ed9279d85cbfa56e5b7779ffa7162074f7a29

SHA256
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

SHA512
a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

Download Submit
C:\Users\Admin\Downloads\t.wry

Filesize
68KB

MD5
5557ee73699322602d9ae8294e64ce10

SHA1
1759643cf8bfd0fb8447fd31c5b616397c27be96

SHA256
a7dd727b4e0707026186fcab24ff922da50368e1a4825350bd9c4828c739a825

SHA512
77740de21603fe5dbb0d9971e18ec438a9df7aaa5cea6bd6ef5410e0ab38a06ce77fbaeb8fc68e0177323e6f21d0cee9410e21b7e77e8d60cc17f7d93fdb3d5e

Download Submit
C:\Users\Admin\Downloads\u.wry

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
memory/460-1178-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1148-1092-0x000002116DAF0000-0x000002116DAF1000-memory.dmp

Filesize
4KB

Download
memory/1148-1102-0x000002116DAF0000-0x000002116DAF1000-memory.dmp

Filesize
4KB

Download
memory/1148-1101-0x000002116DAF0000-0x000002116DAF1000-memory.dmp

Filesize
4KB

Download
memory/1148-1100-0x000002116DAF0000-0x000002116DAF1000-memory.dmp

Filesize
4KB

Download
memory/1148-1099-0x000002116DAF0000-0x000002116DAF1000-memory.dmp

Filesize
4KB

Download
memory/1148-1098-0x000002116DAF0000-0x000002116DAF1000-memory.dmp

Filesize
4KB

Download
memory/1148-1104-0x000002116DAF0000-0x000002116DAF1000-memory.dmp

Filesize
4KB

Download
memory/1148-1093-0x000002116DAF0000-0x000002116DAF1000-memory.dmp

Filesize
4KB

Download
memory/1148-1094-0x000002116DAF0000-0x000002116DAF1000-memory.dmp

Filesize
4KB

Download
memory/1148-1103-0x000002116DAF0000-0x000002116DAF1000-memory.dmp

Filesize
4KB

Download
memory/3268-1082-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3268-1081-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4388-2918-0x00000222F3E30000-0x00000222F3E31000-memory.dmp

Filesize
4KB

Download
memory/4388-2919-0x00000222F3E30000-0x00000222F3E31000-memory.dmp

Filesize
4KB

Download
memory/4388-2920-0x00000222F3E30000-0x00000222F3E31000-memory.dmp

Filesize
4KB

Download
memory/4388-2922-0x00000222F3E30000-0x00000222F3E31000-memory.dmp

Filesize
4KB

Download
memory/4388-2923-0x00000222F3E30000-0x00000222F3E31000-memory.dmp

Filesize
4KB

Download
memory/4388-2924-0x00000222F3E30000-0x00000222F3E31000-memory.dmp

Filesize
4KB

Download
memory/4388-2925-0x00000222F3E30000-0x00000222F3E31000-memory.dmp

Filesize
4KB

Download
memory/4388-2927-0x00000222F3E30000-0x00000222F3E31000-memory.dmp

Filesize
4KB

Download
memory/4388-2926-0x00000222F3E30000-0x00000222F3E31000-memory.dmp

Filesize
4KB

Download
memory/5452-1080-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/5452-1051-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/5452-1050-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/5844-841-0x0000000060900000-0x0000000060970000-memory.dmp

Filesize
448KB

Download