wannacry | hxxp://youtube[.]com

Resubmissions

24-03-2024 19:35

240324-yaq5ssad6y 10

24-03-2024 19:29

240324-x69rcaac9y 10

24-03-2024 19:26

240324-x5lywsac7v 8

Analysis

max time kernel
342s
max time network
344s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2024 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://youtube.com

Score

10^/10

wannacry discovery persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Downloads MZ/PE file

Drops startup file 2 IoCs

Processes:

WannaCry.EXE

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD9528.tmp	WannaCry.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD953F.tmp	WannaCry.EXE

Executes dropped EXE 29 IoCs

Processes:

WannaCry.EXEtaskdl.exe@[email protected]@[email protected]taskhsvc.exetaskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exe

pid	process
5372	WannaCry.EXE
5028	taskdl.exe
4256	@[email protected]
2360	@[email protected]
3196	taskhsvc.exe
6008	taskdl.exe
1788	taskse.exe
5276	@[email protected]
3264	taskdl.exe
2800	taskse.exe
2420	@[email protected]
6628	taskdl.exe
6768	taskse.exe
6772	@[email protected]
6708	taskse.exe
6712	@[email protected]
4856	taskdl.exe
4916	taskse.exe
6876	@[email protected]
5160	taskdl.exe
6572	taskse.exe
4816	@[email protected]
5484	taskdl.exe
5516	taskse.exe
3972	@[email protected]
6772	taskdl.exe
5584	taskse.exe
4228	@[email protected]
660	taskdl.exe

Loads dropped DLL 6 IoCs

Processes:

taskhsvc.exe

pid process

3196 taskhsvc.exe
3196 taskhsvc.exe
3196 taskhsvc.exe
3196 taskhsvc.exe
3196 taskhsvc.exe
3196 taskhsvc.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2968 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
3196	taskhsvc.exe
3196	taskhsvc.exe
3196	taskhsvc.exe
3196	taskhsvc.exe
3196	taskhsvc.exe
3196	taskhsvc.exe

pid	process
2968	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hijlbxdnsg426 = "\"C:\\Users\\Admin\\Downloads\\tasksche.exe\""	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

150 camo.githubusercontent.com
153 camo.githubusercontent.com
188 raw.githubusercontent.com
189 raw.githubusercontent.com

flow	ioc
150	camo.githubusercontent.com
153	camo.githubusercontent.com
188	raw.githubusercontent.com
189	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

WannaCry.EXE@[email protected]

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	WannaCry.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exemsedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-566096764-1992588923-1249862864-1000\{08008957-AAFC-4D1B-BEF9-43E8EDFCD1EC}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-566096764-1992588923-1249862864-1000\{D60D19F5-2A08-4DDC-89E1-5ED00CE96B65}	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1136 reg.exe
NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 620120.crdownload:SmartScreen msedge.exe

pid	process
1136	reg.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 620120.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exetaskhsvc.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
2192	msedge.exe
2192	msedge.exe
3096	msedge.exe
3096	msedge.exe
6016	msedge.exe
6016	msedge.exe
5280	identity_helper.exe
5280	identity_helper.exe
5244	msedge.exe
5244	msedge.exe
3568	msedge.exe
3568	msedge.exe
3196	taskhsvc.exe
3196	taskhsvc.exe
3196	taskhsvc.exe
3196	taskhsvc.exe
3196	taskhsvc.exe
3196	taskhsvc.exe
5056	msedge.exe
5056	msedge.exe
5072	msedge.exe
5072	msedge.exe
6520	identity_helper.exe
6520	identity_helper.exe
5312	msedge.exe
5312	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

@[email protected]

pid process

5276 @[email protected]
Suspicious behavior: LoadsDriver 6 IoCs

Processes:

pid

4
4
4
4
4
648

pid	process
5276	@[email protected]

pid
4
4
4
4
4
648

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs

Processes:

msedge.exemsedge.exe

pid	process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

AUDIODG.EXEWMIC.exevssvc.exetaskse.exesvchost.exefirefox.exetaskse.exetaskse.exetaskse.exetaskse.exetaskse.exetaskse.exe

description	pid	process
Token: 33	1672	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1672	AUDIODG.EXE
Token: SeIncreaseQuotaPrivilege	1036	WMIC.exe
Token: SeSecurityPrivilege	1036	WMIC.exe
Token: SeTakeOwnershipPrivilege	1036	WMIC.exe
Token: SeLoadDriverPrivilege	1036	WMIC.exe
Token: SeSystemProfilePrivilege	1036	WMIC.exe
Token: SeSystemtimePrivilege	1036	WMIC.exe
Token: SeProfSingleProcessPrivilege	1036	WMIC.exe
Token: SeIncBasePriorityPrivilege	1036	WMIC.exe
Token: SeCreatePagefilePrivilege	1036	WMIC.exe
Token: SeBackupPrivilege	1036	WMIC.exe
Token: SeRestorePrivilege	1036	WMIC.exe
Token: SeShutdownPrivilege	1036	WMIC.exe
Token: SeDebugPrivilege	1036	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1036	WMIC.exe
Token: SeRemoteShutdownPrivilege	1036	WMIC.exe
Token: SeUndockPrivilege	1036	WMIC.exe
Token: SeManageVolumePrivilege	1036	WMIC.exe
Token: 33	1036	WMIC.exe
Token: 34	1036	WMIC.exe
Token: 35	1036	WMIC.exe
Token: 36	1036	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1036	WMIC.exe
Token: SeSecurityPrivilege	1036	WMIC.exe
Token: SeTakeOwnershipPrivilege	1036	WMIC.exe
Token: SeLoadDriverPrivilege	1036	WMIC.exe
Token: SeSystemProfilePrivilege	1036	WMIC.exe
Token: SeSystemtimePrivilege	1036	WMIC.exe
Token: SeProfSingleProcessPrivilege	1036	WMIC.exe
Token: SeIncBasePriorityPrivilege	1036	WMIC.exe
Token: SeCreatePagefilePrivilege	1036	WMIC.exe
Token: SeBackupPrivilege	1036	WMIC.exe
Token: SeRestorePrivilege	1036	WMIC.exe
Token: SeShutdownPrivilege	1036	WMIC.exe
Token: SeDebugPrivilege	1036	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1036	WMIC.exe
Token: SeRemoteShutdownPrivilege	1036	WMIC.exe
Token: SeUndockPrivilege	1036	WMIC.exe
Token: SeManageVolumePrivilege	1036	WMIC.exe
Token: 33	1036	WMIC.exe
Token: 34	1036	WMIC.exe
Token: 35	1036	WMIC.exe
Token: 36	1036	WMIC.exe
Token: SeBackupPrivilege	5892	vssvc.exe
Token: SeRestorePrivilege	5892	vssvc.exe
Token: SeAuditPrivilege	5892	vssvc.exe
Token: SeTcbPrivilege	1788	taskse.exe
Token: SeTcbPrivilege	1788	taskse.exe
Token: SeManageVolumePrivilege	5840	svchost.exe
Token: SeDebugPrivilege	1472	firefox.exe
Token: SeDebugPrivilege	1472	firefox.exe
Token: SeTcbPrivilege	2800	taskse.exe
Token: SeTcbPrivilege	2800	taskse.exe
Token: SeTcbPrivilege	6768	taskse.exe
Token: SeTcbPrivilege	6768	taskse.exe
Token: SeTcbPrivilege	6708	taskse.exe
Token: SeTcbPrivilege	6708	taskse.exe
Token: SeTcbPrivilege	4916	taskse.exe
Token: SeTcbPrivilege	4916	taskse.exe
Token: SeTcbPrivilege	6572	taskse.exe
Token: SeTcbPrivilege	6572	taskse.exe
Token: SeTcbPrivilege	5516	taskse.exe
Token: SeTcbPrivilege	5516	taskse.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exefirefox.exemsedge.exe

pid	process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
1472	firefox.exe
1472	firefox.exe
1472	firefox.exe
1472	firefox.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of SendNotifyMessage 51 IoCs

Processes:

msedge.exefirefox.exemsedge.exe

pid	process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
1472	firefox.exe
1472	firefox.exe
1472	firefox.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

@[email protected]@[email protected]@[email protected]firefox.exe@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]

pid	process
4256	@[email protected]
4256	@[email protected]
2360	@[email protected]
2360	@[email protected]
5276	@[email protected]
5276	@[email protected]
1472	firefox.exe
2420	@[email protected]
6772	@[email protected]
6712	@[email protected]
6876	@[email protected]
4816	@[email protected]
3972	@[email protected]
4228	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3096 wrote to memory of 4400	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 4400	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 384	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 2192	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 2192	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 3756	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 3756	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 3756	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 3756	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 3756	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 3756	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 3756	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 3756	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 3756	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 3756	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 3756	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 3756	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 3756	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 3756	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 3756	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 3756	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 3756	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 3756	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 3756	3096	msedge.exe	msedge.exe
PID 3096 wrote to memory of 3756	3096	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

5964 attrib.exe
408 attrib.exe

pid	process
5964	attrib.exe
408	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://youtube.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7ebd46f8,0x7ffa7ebd4708,0x7ffa7ebd4718
2⤵
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
2⤵
PID:384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
2⤵
PID:3756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
2⤵
PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
2⤵
PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
2⤵
PID:3760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
2⤵
PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5360 /prefetch:8
2⤵
PID:1832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5456 /prefetch:8
2⤵
PID:1192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
2⤵
PID:5312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
2⤵
PID:5764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5888 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:6016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
2⤵
PID:6036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
2⤵
PID:1908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
2⤵
PID:5792

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6628 /prefetch:8
2⤵
PID:5220

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6628 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:1
2⤵
PID:2560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
2⤵
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
2⤵
PID:5460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
2⤵
PID:5264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
2⤵
PID:5252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
2⤵
PID:5732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6116 /prefetch:8
2⤵
PID:2476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
2⤵
PID:5328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6940 /prefetch:8
2⤵
PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:1
2⤵
PID:5304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7008 /prefetch:1
2⤵
PID:6072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1840 /prefetch:1
2⤵
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
2⤵
PID:5876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3592 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,13483417238009418991,9883946210336446234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3580 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4812

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x4e0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5552

C:\Users\Admin\Downloads\WannaCry.EXE
"C:\Users\Admin\Downloads\WannaCry.EXE"
1⤵
- Drops startup file
- Executes dropped EXE
- Sets desktop wallpaper using registry
PID:5372

C:\Windows\SysWOW64\attrib.exe
attrib +h .
2⤵
- Views/modifies file attributes
PID:5964

C:\Windows\SysWOW64\icacls.exe
icacls . /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2968

C:\Users\Admin\Downloads\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:5028

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 275321711308641.bat
2⤵
PID:384

C:\Windows\SysWOW64\cscript.exe
cscript.exe //nologo m.vbs
3⤵
PID:4024

C:\Windows\SysWOW64\attrib.exe
attrib +h +s F:\$RECYCLE
2⤵
- Views/modifies file attributes
PID:408

C:\Users\Admin\Downloads\@[email protected]
@[email protected] co
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4256

C:\Users\Admin\Downloads\TaskData\Tor\taskhsvc.exe
TaskData\Tor\taskhsvc.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3196

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b @[email protected] vs
2⤵
PID:5624

C:\Users\Admin\Downloads\@[email protected]
@[email protected] vs
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2360

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
4⤵
PID:5792

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1036

C:\Users\Admin\Downloads\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:6008

C:\Users\Admin\Downloads\taskse.exe
taskse.exe C:\Users\Admin\Downloads\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1788

C:\Users\Admin\Downloads\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5276

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "hijlbxdnsg426" /t REG_SZ /d "\"C:\Users\Admin\Downloads\tasksche.exe\"" /f
2⤵
PID:1348

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "hijlbxdnsg426" /t REG_SZ /d "\"C:\Users\Admin\Downloads\tasksche.exe\"" /f
3⤵
- Adds Run key to start application
- Modifies registry key
PID:1136

C:\Users\Admin\Downloads\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:3264

C:\Users\Admin\Downloads\taskse.exe
taskse.exe C:\Users\Admin\Downloads\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Users\Admin\Downloads\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2420

C:\Users\Admin\Downloads\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:6628

C:\Users\Admin\Downloads\taskse.exe
taskse.exe C:\Users\Admin\Downloads\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6768

C:\Users\Admin\Downloads\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6772

C:\Users\Admin\Downloads\taskse.exe
taskse.exe C:\Users\Admin\Downloads\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6708

C:\Users\Admin\Downloads\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6712

C:\Users\Admin\Downloads\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:4856

C:\Users\Admin\Downloads\taskse.exe
taskse.exe C:\Users\Admin\Downloads\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Users\Admin\Downloads\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6876

C:\Users\Admin\Downloads\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:5160

C:\Users\Admin\Downloads\taskse.exe
taskse.exe C:\Users\Admin\Downloads\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6572

C:\Users\Admin\Downloads\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4816

C:\Users\Admin\Downloads\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:5484

C:\Users\Admin\Downloads\taskse.exe
taskse.exe C:\Users\Admin\Downloads\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5516

C:\Users\Admin\Downloads\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3972

C:\Users\Admin\Downloads\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:6772

C:\Users\Admin\Downloads\taskse.exe
taskse.exe C:\Users\Admin\Downloads\@[email protected]
2⤵
- Executes dropped EXE
PID:5584

C:\Users\Admin\Downloads\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4228

C:\Users\Admin\Downloads\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:660

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5892

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5840

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3808

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1472

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1472.0.1159006640\599748455" -parentBuildID 20221007134813 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {45cc6a85-082e-490a-8240-960cb9281575} 1472 "\\.\pipe\gecko-crash-server-pipe.1472" 1964 23f178d8858 gpu
3⤵
PID:4660

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1472.1.2006982576\1417669511" -parentBuildID 20221007134813 -prefsHandle 2356 -prefMapHandle 2352 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df769424-8877-4264-aacb-5318b6d0ffbb} 1472 "\\.\pipe\gecko-crash-server-pipe.1472" 2364 23f0ad71c58 socket
3⤵
- Checks processor information in registry
PID:5264

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1472.2.2101332366\708897929" -childID 1 -isForBrowser -prefsHandle 3128 -prefMapHandle 3000 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1488 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf85251e-997c-41c1-bbde-b2fb5199b1d7} 1472 "\\.\pipe\gecko-crash-server-pipe.1472" 2972 23f1b80a858 tab
3⤵
PID:5220

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1472.3.1651398788\619410129" -childID 2 -isForBrowser -prefsHandle 3608 -prefMapHandle 3604 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1488 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {876b6b05-3b8e-4bb0-a2e7-1390a587f959} 1472 "\\.\pipe\gecko-crash-server-pipe.1472" 3644 23f0ad62b58 tab
3⤵
PID:3540

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1472.4.1486342735\1614982674" -childID 3 -isForBrowser -prefsHandle 4652 -prefMapHandle 4644 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1488 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {512926f5-3afc-4e48-aed5-2e80afd3742b} 1472 "\\.\pipe\gecko-crash-server-pipe.1472" 4640 23f1cb82358 tab
3⤵
PID:4064

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1472.5.1278297761\109541999" -childID 4 -isForBrowser -prefsHandle 5036 -prefMapHandle 5032 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1488 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf6fb78b-2a57-45bb-af87-52520950f029} 1472 "\\.\pipe\gecko-crash-server-pipe.1472" 4984 23f1d84d858 tab
3⤵
PID:4304

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1472.6.2049400546\2119007483" -childID 5 -isForBrowser -prefsHandle 4940 -prefMapHandle 5124 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1488 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e44cc94-7965-4475-adc3-5d343d8804c4} 1472 "\\.\pipe\gecko-crash-server-pipe.1472" 4660 23f1d974758 tab
3⤵
PID:2172

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1472.7.1525846563\568175921" -childID 6 -isForBrowser -prefsHandle 5316 -prefMapHandle 5320 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1488 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e6b2059-9602-4d63-89c9-f0e6e7487c75} 1472 "\\.\pipe\gecko-crash-server-pipe.1472" 5308 23f1d976258 tab
3⤵
PID:5916

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1472.8.887069989\111232557" -childID 7 -isForBrowser -prefsHandle 5836 -prefMapHandle 5776 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1488 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df9a24a8-3576-4077-8d8c-44462be9b582} 1472 "\\.\pipe\gecko-crash-server-pipe.1472" 5888 23f1f7c0358 tab
3⤵
PID:5472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x40,0x120,0x124,0xfc,0x128,0x7ffa7ebd46f8,0x7ffa7ebd4708,0x7ffa7ebd4718
2⤵
PID:2560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2400 /prefetch:2
2⤵
PID:5808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2740 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
2⤵
PID:2800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
2⤵
PID:6628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
2⤵
PID:6640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1964 /prefetch:1
2⤵
PID:6404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
2⤵
PID:6412

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3624 /prefetch:8
2⤵
PID:6508

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3624 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
2⤵
PID:6568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4988 /prefetch:8
2⤵
PID:2156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4940 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1
2⤵
PID:3696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
2⤵
PID:6884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2204 /prefetch:1
2⤵
PID:1380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
2⤵
PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
2⤵
PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
2⤵
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6508 /prefetch:8
2⤵
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
2⤵
PID:5796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6204 /prefetch:8
2⤵
PID:6412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2332 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
2⤵
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
2⤵
PID:7116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,8204206028206643684,10084944585314108023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
2⤵
PID:4760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\@[email protected]

Filesize
585B

MD5
b7a1d7dd8d8f18ca96dbe6a8a7a73eac

SHA1
e2399f9369d52acd9ab46e23ddbc2b015168f172

SHA256
424b26710dde6cbfb56113ce979bc9bb3b72cd217b388cba602a8a4d00f62333

SHA512
b091e0c42fd2741830330ea38f76d53b9674509893f7ed3bb888af4316f845248b78366ec9e34fd50212d397c3bc002feb53c4a4f02b8eb419a672b72f9ecd86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
23e1cc1e0d8fea99e0ab2dd02f426ced

SHA1
9955b6fb5394a197adc0b80a8ebcd02d0cfb1bc8

SHA256
fcd1c65451e66df70bda7eb85eca1df1f0c01678fe91458aa37fcecf7a33ffca

SHA512
f4681016f658da451c0555a36f4f24b3f17512b075608d0d6090601e3a9b0ff95967a188d9baf4cf09834021fa1e9b2e592d0d40986b7ec607fb1be4a7691ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0c79a4e4-fb1d-4550-9d68-26ebc99f99a4.tmp

Filesize
8KB

MD5
60502db25531ff292c99cbd121d708bd

SHA1
e43e24b2cd1b2c17430e8fddc106622121ee3269

SHA256
b75771330087ec992ea5e323c36c2af81626cee13e83f1083fd8a7e5ba2bcea4

SHA512
17f2c534bd0888e215d532c1c3a8a90ece07ffd12382ab3c95bf21daefb113c1c3308f383cfde50180b595bad81be577f0ff5c64d888f3dbe9af43f78678c552

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
69KB

MD5
a127a49f49671771565e01d883a5e4fa

SHA1
09ec098e238b34c09406628c6bee1b81472fc003

SHA256
3f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6

SHA512
61b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
34KB

MD5
02214b097305a8302b21e630fa201576

SHA1
90c2a31521803b73e847f7a3e0cfceec84df9fa5

SHA256
1d98076cfae6a0a8f0b0b1c654270b900de83e633cc01d98ef63e6a8e485a3f4

SHA512
553c81eb51880f83b9918aef766ff0f41170895b1cda2589f0b69c3d1362de8e8decf14a413f6b5df1fb7ce07fc939211407b29046188b37c290133c9d5e1cd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
1.1MB

MD5
fcb3b79b4ee2a97d69020a59b8d5caee

SHA1
4c8c8dc00b8c71694cdadbfd1fe70358d34a0883

SHA256
36b4ec7a0ae8d3b2f907b88735287ffc68c0c35e472b3c8cc30f49f4387c9f8b

SHA512
7874b3e78d0c0ef2f1f2e417a989550208c20aab398ef9ec800104dc047ec3866863dbbeab379fdbda7643210b03e20d7305a5fb776df88bef72ad89023cb558

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
20KB

MD5
8b2813296f6e3577e9ac2eb518ac437e

SHA1
6c8066353b4d463018aa1e4e9bb9bf2e9a7d9a86

SHA256
befb3b0471067ac66b93fcdba75c11d743f70a02bb9f5eef7501fa874686319d

SHA512
a1ed4d23dfbe981bf749c2008ab55a3d76e8f41801a09475e7e0109600f288aa20036273940e8ba70a172dec57eec56fe7c567cb941ba71edae080f2fdcc1e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
69KB

MD5
ba50ded8130e34ef9fc2112355fd098d

SHA1
e8758ab2c51ef8c5cc184674e628fd02f909bdc0

SHA256
d25d431aea4df29473ef2cc3869f36f7f9438875ba39de57f21505549e108e58

SHA512
72c4f56cbcb14e9856e018088a2588443e3a16a69fcd6c286ff345edeb096741770e48e9bf251739dfb20e064485f07f8f2d85722c54d497d58804639b8fd0e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
c02ff449115190a877284202a26f46ad

SHA1
a21f1dcf1190a590c8e5a7081bd750faf4deb89e

SHA256
0d767ef635cf292c1c29f6f6ed81520916ad70f06af290891890120d974bc4f9

SHA512
07967d216235736a2c3cd88216816dc605a2d72ccf6ce7fd50118bb739775c407f1168386def68bfc83df4aec3a6b9755b3ad15c5911a1a5d0471013c9f332eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
5b99b5b30cd0e23e68c296f848eef0fc

SHA1
0e46f13f84c4327759bba273a1ea6638f3105b45

SHA256
be2eddbb6ecad1a1c23b690e628e30b7add2ffd3761d29898f34619a33245572

SHA512
be2262e4065c20bbf3a7693de747a61fb064197558642636c0ef3f741d00f18c27ec56d5cf87fbf66359c4ebb3963a9fba5e4dd1f47338a5b97d1b4a71e9ed19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a693b.TMP

Filesize
4KB

MD5
4531824fcef5d687e495bea1452471c9

SHA1
2a3d1f49a9e408d3e27a40345d460a53cb8dea7b

SHA256
f9591a641548b769cbbcb9315069332a2c29778e2430f5b23715b81faad52df0

SHA512
9aa0d4ba90402015d9d75c299eb1ad5ec64fca78a5418240d116d8d0682b42c5ebac1091731fedda7c40cfe2863b3a5e7aa4fdbfa438784e5faa58799f351576

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
dcdd305196b7acc115ddd6009b0a86b3

SHA1
982887d10cc43ffe3502769b8758a61c42b91278

SHA256
b2260eb7671831bc3bf033dfbbf8b1e9587fba5361d2556370b703a20c8fb0e6

SHA512
fe6f11b4cae7ba288579d9f615617526195f9bd8a4b9614d8ce443c74de8b7b7a17d0590c9f2492abb904969323d7eb9dcd45526f12f8316af5e1b5ad4be13a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
44f9d035879ce06920a8d825ceedbfed

SHA1
59d4ddae0ff204c59f2943383c913498c246590b

SHA256
6473424601c45a3c398e295ddcb7375ed98efbfd8227267d4b2e98652eef4b5b

SHA512
5d945d8457510c7697239ed94a851d5afda3328c190553b8c14e266ea5d5b7859310aea3a3361b4d0212b84582cc6a57ac5845ab3a1d4532a19255f53bc936a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
64669a4719ca09e022f6f67d05bb9c71

SHA1
e1a58b67a3628f2ecba70502a2c194cf27a617ec

SHA256
fd18ceeef84d94ecdb0e3962d6deab6b4db06c0b8f147330a2df0f8ae0210d22

SHA512
0d2d35fa81b93309814ef8632f54f541e982af514769f0d23cfbbdb100674ac23c9ec6cce156916c5cd7bcd98797acaa3c32daa1b3fe9149ec16acbb07d0e8f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dfb5d83889ffd35a498927690e654c3e

SHA1
bbad29ac057b0d365f6bef3b04ccb843ad9a1b69

SHA256
c91a6e2fee43173415e382ace0abd4d39eb259b0a21731e0c70630b34bb2ec6c

SHA512
56ac8e9279120341834e6c18e377c907d7d995af7ffe258644d205a92b659f434626353bbaf333e4d34556f3428962e6beca9e7b40dc58fa3a91a6ad918954a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
85bc53b56997719d29bd5f96d702c5db

SHA1
7e1f1f5cec636730177d7602241e79bbfbbbdc72

SHA256
948315a0969f3e2d7e515134b5485bdaefc25cb7769cb08a83b0b65a9e891556

SHA512
9a2046d99a92bc718145b776ccc6ee7b09d496561ba576736d7a09bd1773ac82245aca789fc8a3815b751e386bb5617333622b15b786d9c0075b2bec05423c4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
18fd3d03063b34f2746636f042e967b4

SHA1
1cdc0206cfd760e85c2e606ec848b48c10d75069

SHA256
4d4303d7bc132f9235bf92827995e1440e23c900102e62b27f2824e0d8f17815

SHA512
9b3628ac1574a0d6a5a72388cae5be49814816d1f64773a3919c6a7defbf4fb41ae6dde9b7ecc1a294ef17d56ae8d646452704c36eb8fdfa68f9704dffe8989f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
63363539e5ec342b59ef3a9d12ef6a03

SHA1
382536ce83f92e3f446355d15e39e60cb023ea43

SHA256
682f40f1ca4d98efc8dba03f5be6f271b953458b42eb9d1f2f6229123c44c90f

SHA512
2cec498f6da92069e88c872729515a367dcb0f0b2ff4dc589243aad567f9ab4cbbd78eb305bcfee1007e66e0b3ed8b951a3a9976771505eba11d8d04e45718b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
797356b4c2028eae518fe4b04ed5b840

SHA1
505173a2ec6071e005ee94457ed3d2ef1cff5a74

SHA256
1706d344ea90c579affe7825a77cf430188c189034c97ef434b9fa5a8c8b681b

SHA512
e6dd188f00a7540c11d1c47b7e46a742b3561b726b95a0717b298c4694fdbee3b3e26a018db8521db827868b1fc069546fe168fdd7fd4b1311f016dbe7489a11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
fe3b5e55db6e28e94b625fb24aa3da49

SHA1
5b0d72f0fe58cc632f9f13e9e2c70245ad68f1ab

SHA256
d5574d0a37e769be60bb854cfebd95a9be7b0c4c9ea2fdca7ae4ee4805d49109

SHA512
4dd9f329388de369937fd7b4985ecd9068810389e19a85d899b1594d7c6622fb321ad2952e027333a4e4e10795822679e7f1dce48ad3978351653079ca2eb9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
153cc174b5db25e78d3fa048c416ed67

SHA1
57dd7ee44a692c1feb42566d60440b7d39791521

SHA256
87684ca06e07b41793b73750f128eba2b951ef81b08eeda473d0d2aae47a4c00

SHA512
8bc85776f6bad7a09c86e38d8041665b084a4a6abb165fab4e056d741534642c1546bfe3608e5f375a521e5452e0283dbcffef3908795f7d1fbe683bfe306809

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ffb1faf860fb2f8a3cae7156cc615264

SHA1
570156683a1ddd2b79c9d4e7d98bdd9bfc68e0b9

SHA256
904b4553b36ef5a0e5af5284ab655d21b41ece68a4c3b223283a16e029fb401d

SHA512
3fa9e3889562c8774459f026c8477598d3b3e3023293a92906e69d243e250d00cfae0393cfe7e4698666ab39ab2ca772f5a015990a6cc2013375e28cb97631dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2186c7e4-6ad6-4e3a-9eb0-308e6d421c84\index-dir\the-real-index

Filesize
624B

MD5
8af13ec67cab163c9af3c7eb112e6d76

SHA1
d3fa5b9e89a3ba983bd32dc6d5014f5f73aad96f

SHA256
8a26765921c84cfa7faf289842b069a047913e820e591bb986ba1f688ba261c2

SHA512
091d459acc0898a0083536fcd580ca528f548c3072b3118e80225d84f0aeac6c83fda65e39563521950c3ccbcd06a5a9a8c5823efd0cfcfcea36815879515f73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2186c7e4-6ad6-4e3a-9eb0-308e6d421c84\index-dir\the-real-index~RFe579e43.TMP

Filesize
48B

MD5
357cd44410d0aad3ac8d4fcbc81bba33

SHA1
97666b1dbcca8235c31dfe68087d712ee4220c74

SHA256
2986109aa03a289210d51e5f29304c03ff00b892dee892fcf19c6b46925f1f9a

SHA512
23c2e5c38c73193908ad48633def1367177d14f05c86e9b6c2d338bca6df34df4bdcaf71238805c524029b04365cc3a5c2bcc3d131436d2b5b96a1de474e7a08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f68a412a-6c92-4eac-9392-1722da53fa8f\index-dir\the-real-index

Filesize
2KB

MD5
522e76c6af004f6eab1cab747f8d9503

SHA1
bd9efbd345cda61b63005a65a3350786bb961bbb

SHA256
5ff19eed70da84b6a134a06f83865e306fdcdaa72d7cf1219aeabd40c9f09285

SHA512
4b7ca0c6ffa99ddc74fc599364ee43123d5cc133010f9084d0016e86ef8c1a34861b8a2931e457cb7de02b0b5691d19b264526b0ee0aaec2873bf710e90c245f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f68a412a-6c92-4eac-9392-1722da53fa8f\index-dir\the-real-index~RFe579a7b.TMP

Filesize
48B

MD5
c4f899753732f68b2fdbb7a4bd0e9865

SHA1
6ef610492cc1a17aee2a5c2ffe376805a078324b

SHA256
827d0ec2b7b9fa6cf36cfe469fbc2b24e0c80fbf17dc21feddf9c2ce6eb2fe0f

SHA512
d14b18dce35a65e1cd943b34d66748b79732f3b13174a5a0ca8a902b168d2e459a81de8fe4a6f294b02d2e7dc19b076734e6c77a930ab40f87d8d387d756487d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
4a8c5c2588f535ae34aef370836dc641

SHA1
9e3c94f7cede411e1f035527258ba455c65d9655

SHA256
003ca298f9029d53903a4f2292f36b4556a423f1613134a77acfbd200c0e47fc

SHA512
771c8b18363b30c7de573bdd15d09de99519e3f9919de0168f7f536c49ac6c0cb7dd387944f290b4b21bdf986d59a25231b78e5688e78b40f1d40a419e96666b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
4b9dc74cb869427094cc8e840589831b

SHA1
7930b711145350daa051a2832a28a639242e40cf

SHA256
54a2d2cc13effab47698918a6e040da30378322341b03d23168c76e3dde4af3b

SHA512
362f0600ed39b950607a7c847a8345736631b35b9b2cdb11d6bc9797bc0f44d98364516fdfbe2c43c5722f325e97da271c79e2ad7ddb01f324b025c38f6ddb3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
156B

MD5
a854d170ec66561c24be06236524e2af

SHA1
0d994213332aa79609677bef6a956ce3b6627295

SHA256
9f5458117fc8d220dc946bec7f387390e027a0214c5d98c2656b83cf0cc87a95

SHA512
1625b8e2f8e7c78a87eaeb2be8c90ddf5c9e88c0910ec1dc68caa711e42459081d34e13ff7408619540c89f28fc7df85b58e9228104f88e4684f6ae691ba92e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
b7734a855096d8be14667cad17587ebc

SHA1
973a3a0e6b01b07fa3455d71a5148cd67e024628

SHA256
dc389a7bb862e3ea89d3dc5ace34d90a39fd48230b66245f7b7d2a26ac519eff

SHA512
638a90bd7b45870d5c78cb9918e28a9efd21a54d7e9088798fdddfca90f5ede77ad1ec71dd01f498db457f7436eb5aed2253740c1cb9edc2baa1631f25d90f3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
ccb3e1cee342c3c832ede7ba87beab1d

SHA1
71ebd8d62d71ceea2151acf4b140d56965c01c88

SHA256
33c09bfae40ff1f2b9a5a4f219fd8bac181bda691f36f77369208ded8cb4e6a3

SHA512
9f74fcf5adef6630a0a7f3089cf83c6a093242859c2595e044589b639f20e96c01732f68d4abfe69f40c6efd6a7165d743ccd32272cd0edae52ef456198af2d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
090eeaab6845f288357a8492f99485d1

SHA1
1cf71f97c95395e08521a5c0477ae554338636d9

SHA256
bdf494b73c3d5a6f9f930e742ba91d30446937989796084a62ded71d4d36d07f

SHA512
dde00d5ecf2c384de0964d6b704f9187295de62ba9a81d000050cab337cb9949fa923d759650395be93b08d1706d21d8c0ccc916902cd41e502686e60e1c7f05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5795d7.TMP

Filesize
48B

MD5
ebb7d038b3c43122222f00d0f173c8b8

SHA1
d0042a51ff0b3d9e278967f4bfb63ff39ca22380

SHA256
187b4e0b0ba72f6ef72fbd476c787ed96d042366ed1f70eb39c9755fa568f8ba

SHA512
bddf716d629d70545a95cd7d6dbc5374fcca36571f53ffe2be03a3e866c927a6c2ddd9ccddfcaef6ded3bf9155cb60cf3d56ad536adbeb26dff500b7ad3e23ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
666bb3c782c03c45242275aa3d6fc6b0

SHA1
d895b0e6c7156fc1c3d633e32e53d72991874903

SHA256
10bd2dd576c9ee4e86aceb6b3f96567e2fe6e04d2ca5dd5bbb9814629dc1b79a

SHA512
a5bce9a104993d894c34adf54ca81c963b6d6e3ab3a4d14ec9041520644343c7d44ff15e6f7be3ad55aa685d0d826b1f74e2d94f98e9b9d252568bc3583919d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
30879ccd79f4353f046a2d494fd0f290

SHA1
3d825f245dd61163b614d079f5fc092724de9663

SHA256
b4587ca6e2b7ab753791d7ef01a99dc1c24d80e84ca89c88447c0ccbf12d91eb

SHA512
dddc391f483c725b229c67059c59aceb7f1fd2386cf3ad80fec539205e39a066d495d945b72a29f8e2ac2271fc2418852f7266007c97f5cdb954d0113c6d726e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
111a68e7c0e2a3060203e39d045f2fad

SHA1
25c8a41a2b7ce3f5d4e6f7d9eb620fcd910ade7e

SHA256
67bda9f11ceef3eeb823ffa400e3f6d0f3d03d5f651f18d42609459c5d6bec8e

SHA512
55871717f622dbab1b437ebe4305bc41ade810ca54a43252121089f8fda43a5baabe8480b875802ee12e75fd1671405134aaa0dd5bb2dba98d3d3021ec0dc5c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2c9b163de7a07f6533f8ac41352a7284

SHA1
22e6e9dc456bbdec0f9cb48a4e66ed7fa35472d8

SHA256
dded5de2c9c1f438e8b316d957841a816a526c9351e745578be59fbcd1484541

SHA512
fa94432d6b1d7394393efcb84a1652cdaf6c75b3b36c8bc645967b27a5b9ada50023045f255b809b7382f0ec4a535915851b024673df73f184c764f908290058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f418fd3dc6c571fcf166fd60668392c3

SHA1
c1e7fac6f324f3279b52d0244f1e186c24411755

SHA256
245e163d73bded969dd140eb569331e6703018a55150921c0b0303eb2208d197

SHA512
1114bb68ca71f94b196ff2da983b7ee95aeb2ddf7306f5afcdeaf39b0f411cb5f7f16337f6d5c6a3d7ef908b33c7699bbce6cd77897b8770f0ac10302fb6523b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
00aac5f04d6ef31cc82e828e239bfb54

SHA1
26ec68848e0d5e27ca6b5c58b960170dd06d8fe9

SHA256
754db6e956c72c9fa28f236382218940372890883b620bdfc0117969974318a4

SHA512
0f712a2b75f86b7ae5b5a158d8326b0253e99733172a97775d62db08159ba7436422ecbfa9eeaf1b2c1ebc2ecce270dfc00ea3ebb154e6a8c0595981c975200b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
eb535f851ce00a4e76f3da056ddcdd88

SHA1
ac171936287f8b4710abe966cbe5f32459213783

SHA256
6f8aa272faba647be0d5b601f06682fcbb2a6c4f6b2e60d095ebe4ebfdefc974

SHA512
d7f730492775b76f2abdf722e60ff2489aeed4755e515f3149456fd8313151aa6ea4f5ccdc47154459603369424ceac8356f96a22912d1dad3778ea372ff5a6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a937656881d62c9d27bf563d58773603

SHA1
6704f35d032ac58603e169d5e676698d36c72817

SHA256
d4e5464d23a932ba4961be749a7a08a9f3dc2e55a197f554a393bfa61c6d2220

SHA512
5e117f8a6f24cddc27ee609bb3cd5e0490263b0981a0e051355fc8192123d509b5e84f6398930b0168ad366f7f14d2f2422ccb52ddf7ec595776f52ad23135f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578db9.TMP

Filesize
1KB

MD5
d7921fcfb375ab6d48c0be2d2c7bbab5

SHA1
429d72184bd26588dfc170b2e07d7c5a567bd326

SHA256
dc1da9328f4dff27cba13451ed5d59771dc15e2e47783d965ebee76abb4974a2

SHA512
3c530fcabf0b0576c262849377eda8f86b2e85d7b20fd3c9fe27c19b5421f8e11749be675841c2f44e32c79b19b86c1bc77c2a20b6be701864aa114b0d97b0f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c1353276a03e8e90682f826e56e99acd

SHA1
68f4d87758f29cfb32484c7a4c6232fc1c0e692b

SHA256
135f6d41c603d3eae6f96ae0487f5bb538dcf4def6939fe25ac1cfda4fd462bc

SHA512
ae18de3adf4e4262e9c0c9b05606fd0177d327c1cb8bae13f93af5c9e6f1361304ee39694f2413cef3b6df943d1bd77e0215529cc62c7f0ed9ce0943f19ffd85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1c669c34340a0445f22402597e91c0e7

SHA1
8703c82e54a54cd838d71dea44a71fe90c288a3d

SHA256
6094b04e1416494dc9dfabae59f0f7c213f1c42f7daf6dac512d02eb4e4edbba

SHA512
05816b8f2c3c788dd67de54f62055d4ca4786ada763228e679d043ab726eff23fba6179ef38f8c9f52a75b461d74d0a312ed99237332e2c8a521effd3f2b7513

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
3daa8e0cf5b8509d7160b2f83ef1f67d

SHA1
fe4ebbd6d8bdfb803cfaa3e5a8e50dc6add13191

SHA256
9db313dfdcc1f7ecea52b2f97c0aad307aef1770092a84e5287c03a18d329a01

SHA512
7aa54368c041a9c9e615398bb734f71275821d3efdeb8050d364e9aabffba1039def6ce91263ec9de9d37fcdbd60be09c87cf64246dd5e4605dcdd00530a76a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
56ab781a1603fdf49493896bef27597c

SHA1
223abf54189577c7eba1b673878f4234e1ea7ca5

SHA256
2c1270d5ec9ffbd0d81978031f266eff2f55ef8a66e9a70ea1fa69f64ab4c9d8

SHA512
ee34a59b0e0198f0e26efbc869bc76eaec75fe586d0a28979218fa5dfe97d15bffa0d56aa689eba3c1cd32d19ccb9bb71b6fb513fa2c1e56e5d08547bb90c828

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7c6eb6ee556694239fd39ad490ce0899

SHA1
4d06865144fd46c2938874b417f064ac559b2e1a

SHA256
3c6d791689c868cdc53e73e37609bec9d1afc355ce396bd3bdf89098abfda256

SHA512
d51bc7f862c8166b6e11a783f90adb71bbaa5699e6e6e499e326ec32dde304ed945e3622d642c8d30d60b7ba9b8aaf024b065f86662527b55e8549834cf844db

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
ccb003ba77a25bc76c238d97c5cd9e44

SHA1
d97634d5ea406c1662666457da6da2866fba6033

SHA256
6389532960fecd90b5afa8547f4789684f42138a03643d3472215688e84bbd43

SHA512
67bf4810bd81e59c055b72955c003e8dc0b3775a05a6a9a43ec62a747f9597a3e5bedcb4d740778c3a987e48963326cd4cd3d3898b1c0a9d9c7bdfbd2bf34e8e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\datareporting\glean\pending_pings\5ec7967a-07c8-4ebf-a17a-01129d7960df

Filesize
746B

MD5
9646281662363d2ab85d46d34fb25842

SHA1
30ad0361ba1793447c61619841542a646647136a

SHA256
e7e7f4a9c23902387d2fd9e48570a60fb2cdfb5e55194a41b694d6a31f9fd61a

SHA512
b0fe988676037174c74f2706780ab74002ef6b43850c43c623c272fc0ff7e6911a06adcdeb236442e4a7964a228173bee8c00901fa01be904bdc7503a65c99ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\datareporting\glean\pending_pings\8214c637-ef78-46f0-9cf6-4b06fd579d02

Filesize
11KB

MD5
66fe3c898b351a53a58b918617913271

SHA1
28bb5a9189290a11e5bd1b19f9dcbeda97877104

SHA256
497c830f72db86ce58f71f4d6688d049f14dcde8c5305b85ea3818039a3cbcda

SHA512
4f4a61b7dc1e6699531c193260ce7595edf66638be1f100bfce0df07bb0e1a4b0157d36934b8c05e1347ad32ab2089e31354e7e03a264c47f5d65850fe6782e9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\prefs-1.js

Filesize
6KB

MD5
656ed273905e77fe2c0c76b60d7ddd8d

SHA1
a66af1a43c46de92e0856971982c676313acfb6e

SHA256
2fccfdecbcc84f53c161dda3ef5aa498c8d389c31a587476746373edc7d1be5c

SHA512
f52e15cb77cf793edab857d472e61c33a7bb3f74782498f8a1407602bde98f5c87c4fd16fb7edb3aeec37f4f9a1a066bf8ca136c447b307395494d095ed6aa8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\prefs.js

Filesize
6KB

MD5
86258d6d15b0d55e36741fb82497a161

SHA1
3b34ad14f265b4b85172254acc35de2c22e57841

SHA256
2a673f7dab5475f5311943b2d66b47d640338ce4651856b610e22bc317e4a283

SHA512
bfa2db7a6a2857822900d3de272549d9553d57bc96aefb9cefe83ffc61a5a23e5ca30058582300f0349f2e414bbc2cc45b5ef4c954cea33c15d64a2f5cfdc46d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
b8e72ff8e266c91cdb0315c756afef9b

SHA1
78e91c03760a82d4a2687b90e0d7bf08289642d1

SHA256
787b2e0d0ad9f7e37a48837ee2bd6f4fb3a5b95bceb40731ca78f85351dcd05e

SHA512
2694f2028b1d79447673a7072e4da7058f2d71c265cd5b4552fc9844a2ef3ab031adfae1a536df55b8bbc6a97229c20023251ca87f0a20d90f58851b78d03420

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\sessionstore.jsonlz4

Filesize
4KB

MD5
f808461c6104fef66ca2c1cc48db5fb1

SHA1
c0ef32627153bfd6ee9371bb5589f73878778409

SHA256
225ca3bd1e5dc8ba31fff9544b803cdb8d9d40437acd1c0f83ab697d058738d8

SHA512
14f85ecf54afdf372c21eeb865437803d4793546fe8780108ed8d27f8b0b03fec9d68f61e25c91045a0958deff16a9c05929177ba97e9a3d63fe8a45260ee527

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

Filesize
6.0MB

MD5
212df9f47e9b51315afb1e12de4b1af6

SHA1
241243e46ae2e50cb132ae359ee954b65a60e740

SHA256
579ce0f1480dc16fdeb357f1ee5c662f1d0832176bd05c5976878cd061e7df3b

SHA512
852251e6940d12c32af92de8b2d5ab1737a907b87899820b6a8136525940dda41f89d1e3891926a541004bf224654a29e153b7901bdb318f2571a2c79db3caf5

Download Submit
C:\Users\Admin\Downloads\@[email protected]

Filesize
933B

MD5
7a2726bb6e6a79fb1d092b7f2b688af0

SHA1
b3effadce8b76aee8cd6ce2eccbb8701797468a2

SHA256
840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5

SHA512
4e107f661e6be183659fdd265e131a64cce2112d842226305f6b111d00109a970fda0b5abfb1daa9f64428e445e3b472332392435707c9aebbfe94c480c72e54

Download Submit
C:\Users\Admin\Downloads\@[email protected]

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\Downloads\Ransomware.Petya.zip

Filesize
538KB

MD5
e8fb95ebb7e0db4c68a32947a74b5ff9

SHA1
6f93f85342aa3ea7dcbe69cfb55d48e5027b296c

SHA256
33ca487a65d38bad82dccfa0d076bad071466e4183562d0b1ad1a2e954667fe9

SHA512
a2dea77b0283f4ed987c4de8860a9822bfd030be9c3096cda54f6159a89d461099e58efbc767bb8c04ae21ddd4289da578f8d938d78f30d40f9bca6567087320

Download Submit
C:\Users\Admin\Downloads\TaskData\Tor\tor.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 620120.crdownload

Filesize
2.6MB

MD5
ed063f927182c70ff79cabbc0d5b4725

SHA1
f4ed031d554b586accfb7e4cde1d5fca75d7a010

SHA256
0540e6f0aa49e3f23c14dbabc88e081439c8a1fd3876f5b1165ee4bb9f29bdc2

SHA512
d5e7a1e7fedcd3671e326f91abb9f43c3f365d789d27e3ff4036da10e55f16af2a8664dfcbd094c10445def16131ea03fe96124251650468878aeae1f3251f2b

Download Submit
C:\Users\Admin\Downloads\WannaCry.EXE

Filesize
3.4MB

MD5
84c82835a5d21bbcf75a61706d8ab549

SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

Download Submit
C:\Users\Admin\Downloads\b.wnry

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\Downloads\c.wnry

Filesize
780B

MD5
8124a611153cd3aceb85a7ac58eaa25d

SHA1
c1d5cd8774261d810dca9b6a8e478d01cd4995d6

SHA256
0ceb451c1dbefaa8231eeb462e8ce639863eb5b8ae4fa63a353eb6e86173119e

SHA512
b9c8dfb5d58c95628528cc729d2394367c5e205328645ca6ef78a3552d9ad9f824ae20611a43a6e01daaffeffdc9094f80d772620c731e4192eb0835b8ed0f17

Download Submit
C:\Users\Admin\Downloads\msg\m_bulgarian.wnry

Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\Downloads\msg\m_chinese (simplified).wnry

Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\Downloads\msg\m_chinese (traditional).wnry

Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\Downloads\msg\m_croatian.wnry

Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\Downloads\msg\m_czech.wnry

Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\Downloads\msg\m_danish.wnry

Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\Downloads\msg\m_dutch.wnry

Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\Downloads\msg\m_english.wnry

Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\Downloads\msg\m_filipino.wnry

Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\Downloads\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Downloads\msg\m_french.wnry

Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\Downloads\msg\m_german.wnry

Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\Downloads\msg\m_greek.wnry

Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\Downloads\msg\m_indonesian.wnry

Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\Downloads\msg\m_italian.wnry

Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\Downloads\msg\m_japanese.wnry

Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\Downloads\msg\m_korean.wnry

Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Users\Admin\Downloads\msg\m_latvian.wnry

Filesize
40KB

MD5
c33afb4ecc04ee1bcc6975bea49abe40

SHA1
fbea4f170507cde02b839527ef50b7ec74b4821f

SHA256
a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

SHA512
0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

Download Submit
C:\Users\Admin\Downloads\msg\m_norwegian.wnry

Filesize
36KB

MD5
ff70cc7c00951084175d12128ce02399

SHA1
75ad3b1ad4fb14813882d88e952208c648f1fd18

SHA256
cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

SHA512
f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

Download Submit
C:\Users\Admin\Downloads\msg\m_polish.wnry

Filesize
38KB

MD5
e79d7f2833a9c2e2553c7fe04a1b63f4

SHA1
3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

SHA256
519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

SHA512
e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

Download Submit
C:\Users\Admin\Downloads\msg\m_portuguese.wnry

Filesize
37KB

MD5
fa948f7d8dfb21ceddd6794f2d56b44f

SHA1
ca915fbe020caa88dd776d89632d7866f660fc7a

SHA256
bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

SHA512
0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

Download Submit
C:\Users\Admin\Downloads\msg\m_romanian.wnry

Filesize
50KB

MD5
313e0ececd24f4fa1504118a11bc7986

SHA1
e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

SHA256
70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

SHA512
c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

Download Submit
C:\Users\Admin\Downloads\msg\m_russian.wnry

Filesize
46KB

MD5
452615db2336d60af7e2057481e4cab5

SHA1
442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

SHA256
02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

SHA512
7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

Download Submit
C:\Users\Admin\Downloads\msg\m_slovak.wnry

Filesize
40KB

MD5
c911aba4ab1da6c28cf86338ab2ab6cc

SHA1
fee0fd58b8efe76077620d8abc7500dbfef7c5b0

SHA256
e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

SHA512
3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

Download Submit
C:\Users\Admin\Downloads\msg\m_spanish.wnry

Filesize
36KB

MD5
8d61648d34cba8ae9d1e2a219019add1

SHA1
2091e42fc17a0cc2f235650f7aad87abf8ba22c2

SHA256
72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

SHA512
68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

Download Submit
C:\Users\Admin\Downloads\msg\m_swedish.wnry

Filesize
37KB

MD5
c7a19984eb9f37198652eaf2fd1ee25c

SHA1
06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae

SHA256
146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4

SHA512
43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

Download Submit
C:\Users\Admin\Downloads\msg\m_turkish.wnry

Filesize
41KB

MD5
531ba6b1a5460fc9446946f91cc8c94b

SHA1
cc56978681bd546fd82d87926b5d9905c92a5803

SHA256
6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415

SHA512
ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

Download Submit
C:\Users\Admin\Downloads\msg\m_vietnamese.wnry

Filesize
91KB

MD5
8419be28a0dcec3f55823620922b00fa

SHA1
2e4791f9cdfca8abf345d606f313d22b36c46b92

SHA256
1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8

SHA512
8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

Download Submit
C:\Users\Admin\Downloads\r.wnry

Filesize
864B

MD5
3e0020fc529b1c2a061016dd2469ba96

SHA1
c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade

SHA256
402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c

SHA512
5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

Download Submit
\??\pipe\LOCAL\crashpad_3096_NOHDHPLHQTAPGMMZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3196-2859-0x0000000073D20000-0x0000000073DA2000-memory.dmp

Filesize
520KB

Download
memory/3196-2876-0x0000000074050000-0x0000000074072000-memory.dmp

Filesize
136KB

Download
memory/3196-2857-0x0000000073DB0000-0x0000000073FCC000-memory.dmp

Filesize
2.1MB

Download
memory/3196-2856-0x00000000740A0000-0x0000000074122000-memory.dmp

Filesize
520KB

Download
memory/3196-2861-0x0000000074050000-0x0000000074072000-memory.dmp

Filesize
136KB

Download
memory/3196-2863-0x0000000000BC0000-0x0000000000EBE000-memory.dmp

Filesize
3.0MB

Download
memory/3196-2873-0x0000000000BC0000-0x0000000000EBE000-memory.dmp

Filesize
3.0MB

Download
memory/3196-2874-0x00000000740A0000-0x0000000074122000-memory.dmp

Filesize
520KB

Download
memory/3196-2875-0x0000000074080000-0x000000007409C000-memory.dmp

Filesize
112KB

Download
memory/3196-2878-0x0000000073DB0000-0x0000000073FCC000-memory.dmp

Filesize
2.1MB

Download
memory/3196-2877-0x0000000073FD0000-0x0000000074047000-memory.dmp

Filesize
476KB

Download
memory/3196-2879-0x0000000073D20000-0x0000000073DA2000-memory.dmp

Filesize
520KB

Download
memory/3196-2884-0x0000000000BC0000-0x0000000000EBE000-memory.dmp

Filesize
3.0MB

Download
memory/3196-2891-0x0000000000BC0000-0x0000000000EBE000-memory.dmp

Filesize
3.0MB

Download
memory/3196-2892-0x0000000000BC0000-0x0000000000EBE000-memory.dmp

Filesize
3.0MB

Download
memory/5372-1377-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/5840-2902-0x00000220F8760000-0x00000220F8770000-memory.dmp

Filesize
64KB

Download
memory/5840-2918-0x00000220F8860000-0x00000220F8870000-memory.dmp

Filesize
64KB

Download
memory/5840-2934-0x00000220FCBD0000-0x00000220FCBD1000-memory.dmp

Filesize
4KB

Download
memory/5840-2936-0x00000220FCC00000-0x00000220FCC01000-memory.dmp

Filesize
4KB

Download