jigsaw | b3a6c5f70cc35fa5a756e489b545d495309b2abdc5efaa7a78abbacdc2aa8f2c

Resubmissions

19-06-2024 05:03

240619-fpp7yavama 10

19-06-2024 04:58

240619-flwwbathrc 10

Analysis

max time kernel
598s
max time network
610s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 05:03

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

StepMania-5.0.12-win32.exe
Size

49.4MB
MD5

605ba6b62e64df3b2f0425ca04cedd8d
SHA1

f8845d9be37439411a7f588a3d1fd8bbd266466a
SHA256

b3a6c5f70cc35fa5a756e489b545d495309b2abdc5efaa7a78abbacdc2aa8f2c
SHA512

eb27737bad275bfc0e55404e2610ca49556cfd0a65c70d92e205aaf45fd543dd864a9274a98b6576458fe77f338e5c25db6e84e7915e7e91e37c292c631239a3
SSDEEP

1572864:7hkWrKNvdEimW99HuP2L8BUIAnFCJwHlN:7uv5mwS2LRnFCJwHX

Score

10^/10

jigsaw wannacry bootkit defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Signatures

Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
ransomware jigsaw
Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (6866) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MEMZ.exejigsaw.exeMEMZ.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	jigsaw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Drops startup file 2 IoCs

Processes:

ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD3152.tmp	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD3159.tmp	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

Executes dropped EXE 26 IoCs

Processes:

RobloxPlayerInstaller.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exejigsaw.exedrpbx.exeed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exetaskdl.exe@[email protected]@[email protected]taskhsvc.exe@[email protected]@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]

pid	Process
4664	RobloxPlayerInstaller.exe
5696	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
3544	MEMZ.exe
5076	MEMZ.exe
4280	MEMZ.exe
4976	MEMZ.exe
692	MEMZ.exe
4632	MEMZ.exe
4872	MEMZ.exe
5740	jigsaw.exe
2392	drpbx.exe
4192	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
5600	taskdl.exe
5936	@[email protected]
2492	@[email protected]
5060	taskhsvc.exe
6084	@[email protected]
6448	@[email protected]
6996	taskdl.exe
7016	taskse.exe
7024	@[email protected]
7116	taskdl.exe
4040	taskse.exe
6416	@[email protected]

Loads dropped DLL 13 IoCs

Processes:

StepMania-5.0.12-win32.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exetaskhsvc.exe

pid	Process
4564	StepMania-5.0.12-win32.exe
4564	StepMania-5.0.12-win32.exe
4564	StepMania-5.0.12-win32.exe
5696	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
5060	taskhsvc.exe
5060	taskhsvc.exe
5060	taskhsvc.exe
5060	taskhsvc.exe
5060	taskhsvc.exe
5060	taskhsvc.exe
5060	taskhsvc.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

Processes:

icacls.exe

pid	Process
5304	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

jigsaw.exereg.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe"	jigsaw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bindxefohygk561 = "\"C:\\Users\\Admin\\Downloads\\Ransomware.WannaCry\\tasksche.exe\""	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

RobloxPlayerInstaller.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

Processes:

flow	ioc
446	raw.githubusercontent.com
451	raw.githubusercontent.com
516	raw.githubusercontent.com
517	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

MEMZ.exe

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe@[email protected]

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Suspicious use of NtCreateThreadExHideFromDebugger 3 IoCs

Processes:

RobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exe

pid	Process
5696	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 63 IoCs

Processes:

RobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exe

pid	Process
5696	RobloxPlayerBeta.exe
5696	RobloxPlayerBeta.exe
5696	RobloxPlayerBeta.exe
5696	RobloxPlayerBeta.exe
5696	RobloxPlayerBeta.exe
5696	RobloxPlayerBeta.exe
5696	RobloxPlayerBeta.exe
5696	RobloxPlayerBeta.exe
5696	RobloxPlayerBeta.exe
5696	RobloxPlayerBeta.exe
5696	RobloxPlayerBeta.exe
5696	RobloxPlayerBeta.exe
5696	RobloxPlayerBeta.exe
5696	RobloxPlayerBeta.exe
5696	RobloxPlayerBeta.exe
5696	RobloxPlayerBeta.exe
5696	RobloxPlayerBeta.exe
5696	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
5696	RobloxPlayerBeta.exe
5696	RobloxPlayerBeta.exe
5696	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

Processes:

drpbx.exeRobloxPlayerInstaller.exe

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\eu-es\ui-strings.js	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeBadge.scale-150.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedSmallTile.scale-200_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-400_contrast-white.png	drpbx.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\9SliceEditor\Dragger2Left.png.fun	drpbx.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\ui\[email protected]	drpbx.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\ui\Settings\LeaveGame\selectorWithIcon.png.fun	drpbx.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\avatar\compositing\CompositShirtTemplate.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\loading\cancelButton.png.fun	drpbx.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\PathEditor\Tangent_Handle_Selected.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\R15Migrator\Icon_ScriptConversionTab.png	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.GrayF.png	drpbx.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\ui\Controls\xboxX.png.fun	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-disabled_32.svg	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\s_agreement_filetype.svg	drpbx.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryNewsletter.dotx.fun	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-cn\ui-strings.js	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-16_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_anonymoususer_24.svg	drpbx.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\ExtraContent\textures\ui\LuaChat\graphic\ic-checkbox.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2019.807.41.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteWideTile.scale-100.png	drpbx.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\ui\Controls\[email protected]	drpbx.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\ui\MenuBar\icon_leaderboard.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\ExtraContent\textures\ui\LuaApp\ExternalSite\twitch.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover_2x.png	drpbx.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\fonts\Kalam-Regular.ttf	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-200_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\PublishPlaceAs\WhiteNew.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\ui\PlayerList\[email protected]	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\bootstrap.js	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\LargeTile.scale-100_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\ui\Controls\DefaultController\[email protected]	drpbx.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\ExtraContent\textures\ui\InGameMenu\TouchControls\touch_action_move_1.png.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\avatar_default_large.png	drpbx.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\ui\CloseButton.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Outlook.scale-100.png	drpbx.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\ui\InspectMenu\ico_favorite_off.png.fun	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ko-kr\ui-strings.js	drpbx.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\MaterialGenerator\AddImage_48x48.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-72.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\trash.gif	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp6.scale-125.png	drpbx.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\ui\dialog_purpose_help.png.fun	drpbx.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	drpbx.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\ui\InspectMenu\[email protected]	drpbx.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\TerrainTools\sliderbar_button.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\ui\Controls\DefaultController\[email protected]	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\MedTile.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageWideTile.scale-400.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarBadge.scale-400.png	drpbx.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\MenuBar\icon_emote.png.fun	drpbx.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewComment.png.fun	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sv-se\ui-strings.js.fun	drpbx.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\StudioSharedUI\menu.png	RobloxPlayerInstaller.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.scale-100.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\share_icons2x.png.fun	drpbx.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\models\LayeredClothingEditor\mannequin.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar.fun	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-80.png	drpbx.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\content\textures\StudioToolbox\AssetConfig\[email protected]	drpbx.exe

Drops file in Windows directory 1 IoCs

Processes:

mspaint.exe

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exechrome.exemsedge.exeRobloxPlayerInstaller.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

RobloxPlayerInstaller.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133632470792528078"	chrome.exe

Modifies registry class 34 IoCs

Processes:

RobloxPlayerInstaller.exechrome.execalc.exechrome.execalc.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-2cca5ed32b534b2a\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-2cca5ed32b534b2a\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-6fd80b49a9674f97"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-2cca5ed32b534b2a"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-200405930-3877336739-3533750831-1000\{481879AA-444C-4434-B35B-A0AF20105EE9}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-2cca5ed32b534b2a\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-2cca5ed32b534b2a"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-2cca5ed32b534b2a\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

reg.exe

pid	Process
7128	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exechrome.exeRobloxPlayerInstaller.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exe

pid	Process
2648	chrome.exe
2648	chrome.exe
4896	chrome.exe
4896	chrome.exe
4664	RobloxPlayerInstaller.exe
4664	RobloxPlayerInstaller.exe
5696	RobloxPlayerBeta.exe
5696	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe
4280	MEMZ.exe
4280	MEMZ.exe
5076	MEMZ.exe
5076	MEMZ.exe
4280	MEMZ.exe
5076	MEMZ.exe
4280	MEMZ.exe
5076	MEMZ.exe
692	MEMZ.exe
4976	MEMZ.exe
692	MEMZ.exe
4976	MEMZ.exe
4976	MEMZ.exe
692	MEMZ.exe
4976	MEMZ.exe
692	MEMZ.exe
5076	MEMZ.exe
5076	MEMZ.exe
4280	MEMZ.exe
4280	MEMZ.exe
4632	MEMZ.exe
4632	MEMZ.exe
5076	MEMZ.exe
5076	MEMZ.exe
4280	MEMZ.exe
4280	MEMZ.exe
692	MEMZ.exe
692	MEMZ.exe
4976	MEMZ.exe
4976	MEMZ.exe
4976	MEMZ.exe
692	MEMZ.exe
692	MEMZ.exe
4976	MEMZ.exe
4280	MEMZ.exe
5076	MEMZ.exe
5076	MEMZ.exe
4280	MEMZ.exe
4632	MEMZ.exe
4632	MEMZ.exe
4280	MEMZ.exe
4632	MEMZ.exe
4280	MEMZ.exe
4632	MEMZ.exe
5076	MEMZ.exe
5076	MEMZ.exe
692	MEMZ.exe
692	MEMZ.exe
4976	MEMZ.exe
4976	MEMZ.exe
4976	MEMZ.exe
692	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 47 IoCs

Processes:

chrome.exemsedge.exemsedge.exe

pid	Process
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
2648	chrome.exe
1460	msedge.exe
1460	msedge.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
1460	msedge.exe
2648	chrome.exe
1460	msedge.exe
1460	msedge.exe
2648	chrome.exe
2648	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	Process
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe
Token: SeShutdownPrivilege	2648	chrome.exe
Token: SeCreatePagefilePrivilege	2648	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe

pid	Process
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exemsedge.exe

pid	Process
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2648	chrome.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

@[email protected]@[email protected]OpenWith.exe@[email protected]mspaint.exe@[email protected]@[email protected]@[email protected]OpenWith.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exe

pid	Process
5936	@[email protected]
5936	@[email protected]
2492	@[email protected]
2492	@[email protected]
2408	OpenWith.exe
6084	@[email protected]
6084	@[email protected]
5516	mspaint.exe
5516	mspaint.exe
5516	mspaint.exe
5516	mspaint.exe
6448	@[email protected]
7024	@[email protected]
6416	@[email protected]
7108	OpenWith.exe
4872	MEMZ.exe
5076	MEMZ.exe
4976	MEMZ.exe
4280	MEMZ.exe
4632	MEMZ.exe
692	MEMZ.exe
5076	MEMZ.exe
4280	MEMZ.exe
5076	MEMZ.exe
4280	MEMZ.exe
692	MEMZ.exe
5076	MEMZ.exe
4280	MEMZ.exe
692	MEMZ.exe
5076	MEMZ.exe
4280	MEMZ.exe
692	MEMZ.exe
5076	MEMZ.exe
4280	MEMZ.exe
692	MEMZ.exe
5076	MEMZ.exe
4280	MEMZ.exe
692	MEMZ.exe
5076	MEMZ.exe
4280	MEMZ.exe
692	MEMZ.exe
5076	MEMZ.exe
4280	MEMZ.exe
692	MEMZ.exe
5076	MEMZ.exe
4280	MEMZ.exe
692	MEMZ.exe
5076	MEMZ.exe
692	MEMZ.exe
4280	MEMZ.exe
5076	MEMZ.exe
4280	MEMZ.exe
692	MEMZ.exe
5076	MEMZ.exe
692	MEMZ.exe
4280	MEMZ.exe
5076	MEMZ.exe
692	MEMZ.exe
4280	MEMZ.exe
5076	MEMZ.exe
692	MEMZ.exe
4280	MEMZ.exe
5076	MEMZ.exe
4280	MEMZ.exe

Suspicious use of UnmapMainImage 3 IoCs

Processes:

RobloxPlayerBeta.exeRobloxPlayerBeta.exeRobloxPlayerBeta.exe

pid	Process
5696	RobloxPlayerBeta.exe
6100	RobloxPlayerBeta.exe
4512	RobloxPlayerBeta.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	Process	procid_target
PID 2648 wrote to memory of 184	2648	chrome.exe	101
PID 2648 wrote to memory of 184	2648	chrome.exe	101
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 2724	2648	chrome.exe	102
PID 2648 wrote to memory of 1184	2648	chrome.exe	103
PID 2648 wrote to memory of 1184	2648	chrome.exe	103
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104
PID 2648 wrote to memory of 1940	2648	chrome.exe	104

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exe

pid	Process
2236	attrib.exe
4720	attrib.exe

C:\Users\Admin\AppData\Local\Temp\StepMania-5.0.12-win32.exe
"C:\Users\Admin\AppData\Local\Temp\StepMania-5.0.12-win32.exe"
1⤵
- Loads dropped DLL
PID:4564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8989cab58,0x7ff8989cab68,0x7ff8989cab78
  2⤵
  PID:184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:2
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1780 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2260 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2876 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2920 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4236 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4416 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4548 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4632 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4628 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4420 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4612 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3352 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3324 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3328 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2892 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2780 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4060 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=6116 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5776 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=1640 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=4392 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5352 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=848 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5336 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2912 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3328 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4912 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2872 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6304 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:2808
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4664
- - C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\RobloxPlayerBeta.exe" -app -isInstallerLaunch
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    PID:5696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=6300 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=6656 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6880 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6876 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:5180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=7100 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=6796 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6792 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:5804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1480 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:5592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=5508 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=4540 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6784 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6496 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:5912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=6212 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=5556 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=5508 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6368 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:pbWv2In37RScOcD-eRxrqBchf5f7iBC6XSkv5C2bz46I37SyeN1Twsi6cAilWINoVeAko-MdbtlTm403X-g70wtxYvw2DglB6eWsQ5BZnahImo1xSi6IJ6A3eNCes3Bnas4GHY4dfedgDwd-87ltWX4AoP6qBC5seSWkzBinvS3DHbd6cTpa9gmUAfWLpu4ITcYfxpcLdt7SiBsueNNAS9IaCjvJ5nPQAQVgb-Ea6wE+launchtime:1718773590129+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1718773507243005%26placeId%3D18108417018%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3Dd4562c7e-6866-4c4a-aca7-9fbdd8191b22%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1718773507243005+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:5576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --mojo-platform-channel-handle=4640 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:6704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7064 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:6804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6420 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:6816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --mojo-platform-channel-handle=6484 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:6604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --mojo-platform-channel-handle=2472 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:7116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --mojo-platform-channel-handle=4220 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4020 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:7036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6000 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:8
  2⤵
  PID:6364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --mojo-platform-channel-handle=6552 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --mojo-platform-channel-handle=7028 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --mojo-platform-channel-handle=4624 --field-trial-handle=1904,i,11523686086777341656,8565270774449844383,131072 /prefetch:1
  2⤵
  PID:448

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3300

C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:6100

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5676

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MEMZ-virus-main\" -spe -an -ai#7zMap20371:92:7zEvent21168
1⤵
PID:5828

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Ransomware.WannaCry_Plus\" -spe -an -ai#7zMap10410:110:7zEvent16550
1⤵
PID:864

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Ransomware.Jigsaw\" -spe -an -ai#7zMap27484:96:7zEvent16192
1⤵
PID:1456

C:\Users\Admin\Desktop\MEMZ.exe
"C:\Users\Admin\Desktop\MEMZ.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:3544
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5076
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4280
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4976
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:692
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4632
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /main
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  PID:4872
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=mcafee+vs+norton
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of SendNotifyMessage
    PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8941b46f8,0x7ff8941b4708,0x7ff8941b4718
      4⤵
      PID:5184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,2738917332846682036,4184878637272444914,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
      4⤵
      PID:1152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,2738917332846682036,4184878637272444914,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
      4⤵
      PID:864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,2738917332846682036,4184878637272444914,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
      4⤵
      PID:432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,2738917332846682036,4184878637272444914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
      4⤵
      PID:2056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,2738917332846682036,4184878637272444914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
      4⤵
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,2738917332846682036,4184878637272444914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,2738917332846682036,4184878637272444914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
      4⤵
      PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+2016
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:1460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff8941b46f8,0x7ff8941b4708,0x7ff8941b4718
      4⤵
      PID:3280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14432691615105570739,4571153953408590009,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
      4⤵
      PID:3464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,14432691615105570739,4571153953408590009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,14432691615105570739,4571153953408590009,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
      4⤵
      PID:2808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14432691615105570739,4571153953408590009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14432691615105570739,4571153953408590009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
      4⤵
      PID:4220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14432691615105570739,4571153953408590009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14432691615105570739,4571153953408590009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14432691615105570739,4571153953408590009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
      4⤵
      PID:928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14432691615105570739,4571153953408590009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
      4⤵
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14432691615105570739,4571153953408590009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14432691615105570739,4571153953408590009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
      4⤵
      PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14432691615105570739,4571153953408590009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
      4⤵
      PID:5784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14432691615105570739,4571153953408590009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14432691615105570739,4571153953408590009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
      4⤵
      PID:2072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14432691615105570739,4571153953408590009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14432691615105570739,4571153953408590009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
      4⤵
      PID:2752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14432691615105570739,4571153953408590009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=692 /prefetch:1
      4⤵
      PID:3532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14432691615105570739,4571153953408590009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
      4⤵
      PID:3664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14432691615105570739,4571153953408590009,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2272 /prefetch:1
      4⤵
      PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14432691615105570739,4571153953408590009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
      4⤵
      PID:6992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14432691615105570739,4571153953408590009,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
      4⤵
      PID:7044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14432691615105570739,4571153953408590009,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3652 /prefetch:2
      4⤵
      PID:6460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/memz-malwarevirus-trojan-completely-destroying/268bc1c2-39f4-42f8-90c2-597a673b6b45
    3⤵
    PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8941b46f8,0x7ff8941b4708,0x7ff8941b4718
      4⤵
      PID:1376
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    - Modifies registry class
    PID:4480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=internet+explorer+is+the+best+browser
    3⤵
    PID:7160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8941b46f8,0x7ff8941b4708,0x7ff8941b4718
      4⤵
      PID:5536
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    - Modifies registry class
    PID:7028

C:\Users\Admin\Desktop\jigsaw.exe
"C:\Users\Admin\Desktop\jigsaw.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:5740
- C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
  "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\Desktop\jigsaw.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3220

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Ransomware.WannaCry\" -spe -an -ai#7zMap8705:100:7zEvent14693
1⤵
PID:1888

C:\Users\Admin\Downloads\Ransomware.WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
"C:\Users\Admin\Downloads\Ransomware.WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Sets desktop wallpaper using registry
PID:4192
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - Views/modifies file attributes
  PID:2236
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:5304
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:5600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 52971718773975.bat
  2⤵
  PID:5072
- - C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    3⤵
    PID:2236
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - Views/modifies file attributes
  PID:4720
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected] co
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5936
- - C:\Users\Admin\Downloads\Ransomware.WannaCry\TaskData\Tor\taskhsvc.exe
    TaskData\Tor\taskhsvc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  PID:4720
- - C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
    @[email protected] vs
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2492
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      PID:3792
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        
        PID:1456
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:6996
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:7016
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:7024
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "bindxefohygk561" /t REG_SZ /d "\"C:\Users\Admin\Downloads\Ransomware.WannaCry\tasksche.exe\"" /f
  2⤵
  PID:7036
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "bindxefohygk561" /t REG_SZ /d "\"C:\Users\Admin\Downloads\Ransomware.WannaCry\tasksche.exe\"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:7128
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:7116
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6416

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2408

C:\Users\Admin\Desktop\@[email protected]
"C:\Users\Admin\Desktop\@[email protected]"
1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:6084

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\@[email protected]"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:5516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:2492

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:6208

C:\Users\Admin\Desktop\@[email protected]
"C:\Users\Admin\Desktop\@[email protected]"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6448

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e0 0x4e8
1⤵
PID:6656

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:7108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.fun

Filesize
720B

MD5
75a585c1b60bd6c75d496d3b042738d5

SHA1
02c310d7bf79b32a43acd367d031b6a88c7e95ed

SHA256
5ebbfc6df60e21044486a5df3cb47ccdcd7a4d5f197804555715ffd9bf6c5834

SHA512
663a302e651b9167f4c4e6ae30028307b4d8da0dda3a0e5fd414104951d50419862fc9396c5b39fe5c4b696efd3efbf0b575688983b1d341f3ef38becf500505

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png.fun

Filesize
7KB

MD5
72269cd78515bde3812a44fa4c1c028c

SHA1
87cada599a01acf0a43692f07a58f62f5d90d22c

SHA256
7c78b3da50c1135a9e1ecace9aea4ea7ac8622d2a87b952fc917c81010c953f7

SHA512
3834b7a8866e8656bbdbf711fc400956e9b7a14e192758f26ccf31d8f6ab8e34f7b1983c1845dc84e45ff70555e423d54a475f6a668511d3bcbdd1d460eeb4b0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_ie8.gif.fun

Filesize
7KB

MD5
eda4add7a17cc3d53920dd85d5987a5f

SHA1
863dcc28a16e16f66f607790807299b4578e6319

SHA256
97f6348eaa48800e603d11fa22c62e10682ad919e7af2b2e59d6bd53937618f2

SHA512
d59fa9648dc7cb76a5163014f91b6d65d33aaa86fc9d9c73bf147943a3254b4c4f77f06b2e95bb8f94246a982ea466eb33dac9573dd62f40953fd23de1c1b498

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_retina.png.fun

Filesize
15KB

MD5
7dbb12df8a1a7faae12a7df93b48a7aa

SHA1
07800ce598bee0825598ad6f5513e2ba60d56645

SHA256
aecde4eb94a19095495d76ef3189a9abd45bcfd41acbed7705d22b4c7d00aa77

SHA512
96e454ebb4c96573e8edc6822290c22d425f4c7f7adbab35e6dc4b3ce04a5916ae9254c2c312c98299835ecbf3c5aa95da2939b8408ac25fbae44ba87a3795dc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons.png.fun

Filesize
8KB

MD5
82a2e835674d50f1a9388aaf1b935002

SHA1
e09d0577da42a15ec1b71a887ff3e48cfbfeff1a

SHA256
904372666ca3c40f92b20317d92ca531678958affbc34591401e338146fe0ecb

SHA512
b10a8e384d0bd088443a5085f5c22a296f6f4d295a053d4526690ba65846e887daec47d01cf18fdf1160db98061a8b7c4040de56e6e604451a821fadccf32698

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons_retina.png.fun

Filesize
17KB

MD5
150c9a9ed69b12d54ada958fcdbb1d8a

SHA1
804c540a51a8d14c6019d3886ece68f32f1631d5

SHA256
2dee41184747742fbdc527b2023d67fecec1ccdfdf258439a06cd75d4fd33f43

SHA512
70193ee6f0919eb14311f43b5a5da041deacb568db55fc43290ee76e17af902ac468435b37a150630ea3b7871c724073915ae5dcba3c301ac42f2d68dd598e2f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.fun

Filesize
448B

MD5
880833ad1399589728c877f0ebf9dce0

SHA1
0a98c8a78b48c4b1b4165a2c6b612084d9d26dce

SHA256
7a27d891097df183fbf0031e3894bdac0ce77aef15d666ddd9f6a04e9836fb27

SHA512
0ddf247892a72a390437390d535debf6e41d12e51b31eb4f0353b710ec380c5fbc531a48e76935088063a41aca843287d3def9c1cd46be05b8dcb69f5017a464

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.fun

Filesize
624B

MD5
409a8070b50ad164eda5691adf5a2345

SHA1
e84e10471f3775d5d706a3b7e361100c9fbfaf74

SHA256
a91790b778026db625c9dedfe1c6d94b884818b33d7977e86b2f9c2f3c500796

SHA512
767a75edd37d29b3433040ce21cda849cd11ba549f27581f7edc6416c433ba7047c56908d40956422393ab0f35ede61617d4bd2aad0bde3d1ebd276584c858c7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.fun

Filesize
400B

MD5
2884524604c89632ebbf595e1d905df9

SHA1
b6053c85110b0364766e18daab579ac048b36545

SHA256
ae2facd997527426fc4def82e0db68be29b44499bfff86a28c36f7c31b177d4f

SHA512
0b506397627823a1768796129c6b37d146821471b89338b5f2d0fd3aea707fd46a8e197ee0e298ddfb3b50eef0a0b064946006346b060f733ef19cbd5d24fc90

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.fun

Filesize
560B

MD5
e092d14d26938d98728ce4698ee49bc3

SHA1
9f8ee037664b4871ec02ed6bba11a5317b9e784a

SHA256
5e8ec278a273be22199884d519a79f748801baa3a45b76e57569fdfffe96e7fb

SHA512
b2fcb5d46339cdf6b5a954f2a083cf913779e57cb6e8699bc5da1fba1c370c41117b7ddefb50075622067eb7b02a20268bc047171bd883bcda4a497c2ec64ea4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.fun

Filesize
400B

MD5
0c680b0b1e428ebc7bff87da2553d512

SHA1
f801dedfc3796d7ec52ee8ba85f26f24bbd2627c

SHA256
9433084e61062d2b709c1390e298ddaf3fb0226656662c04c0b7026a44dee750

SHA512
2d1399a6bf225b048d2b12656e941ad912636acae2dec387f92f33ac80629a1e504bca63580ba73a8ed073788f697274d5eb76ea1b089f0555fd397a8f5cbbff

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.fun

Filesize
560B

MD5
be26a499465cfbb09a281f34012eada0

SHA1
b8544b9f569724a863e85209f81cd952acdea561

SHA256
9095e9b4759e823e96984981af41b7a9915a5ecaa6be769f89c13484cef9e0f5

SHA512
28196e5de9670e9f63adcf648368bd3ea5926a03e28a13adc2fb69c567fba2f84e4f162637c487acb64eda2e30993f849806f2313820ba693c7e70303542d04f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.fun

Filesize
400B

MD5
2de4e157bf747db92c978efce8754951

SHA1
c8d31effbb9621aefac55cf3d4ecf8db5e77f53d

SHA256
341976b4fe312824d02512d74770a6df9e1c37123781655532bd9cd97ea65fa9

SHA512
3042a742c38434ae3ee4fe10f7137462cdebad5cae0f9a85fb61063d15a30e1b54ac878b1af65f699c6ca1a9d2c3e58d245e54bdebfadc460cbd060836734e11

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.fun

Filesize
560B

MD5
ad091690b979144c795c59933373ea3f

SHA1
5d9e481bc96e6f53b6ff148b0da8417f63962ada

SHA256
7805ac9d0e05d560023e5aabed960d842e4f3ec2aa3db45a9cfb541688e2edb1

SHA512
23b4c799a7b25f70962e8dd0ec7286ba7150053cab7c88f5fb1efc1095c2987bd6f3572e7fb3ee4b2238958e52a763de2c84a74615df7a6d3a19a034584fd687

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons.png.fun

Filesize
688B

MD5
65368c6dd915332ad36d061e55d02d6f

SHA1
fb4bc0862b192ad322fcb8215a33bd06c4077c6b

SHA256
6f9c7ebec5a707de439e3fd2e278fdfa07a39465d56157b70b24f091509bf76f

SHA512
8bb9a7690aeb3c0b9e14e1a6ebc5741536d354cf2324fd74ee0c3e4ef511718f7795039a94c8d2df94b6e6d0fb1762191cb649089d1def12abdf34003f0cdd0f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons2x.png.fun

Filesize
1KB

MD5
0d35b2591dc256d3575b38c748338021

SHA1
313f42a267f483e16e9dd223202c6679f243f02d

SHA256
1ca0cfc2df0354c8d886285ae5e743d9c7cc030e1afd68ac113c0f2ce43ad5fa

SHA512
f6c58c27bbde7508a866bd0e7fabadb13a4f020378cd8b8cfc0c9fa23f645d811d6cdea04b81afdf30c064c6248152e74b3e6a78ec7a3d1d19037a0db8897d7e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png.fun

Filesize
192B

MD5
b8454390c3402747f7c5e46c69bea782

SHA1
e922c30891ff05939441d839bfe8e71ad9805ec0

SHA256
76f8ed1dd50e50c7d62b804a0d6901a93e5534787d7b38467933d4c12ce98a0d

SHA512
22b26c62473e80d17c1f78df14757ccfb6c7175faa541705edc153c02baa7ab0982b5daabe8dd2c8c9efb92af81f55ccaeeecffe8ed9a0b3c26e89135ca50923

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png.fun

Filesize
704B

MD5
6e333be79ea4454e2ae4a0649edc420d

SHA1
95a545127e10daea20fd38b29dcc66029bd3b8bc

SHA256
112f72ef2bc57de697b82b731775fba3f518d1ae072120cd11b732bf4a782e36

SHA512
bed5906c7373814acc8a54c1631428a17f0aa69282920447a1575d8db826afd5dab262301dc6da610ff8bb81d24ec6babd3d9fb99fd6945f1aca9cb9c76ec2c9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png.fun

Filesize
8KB

MD5
3ae8789eb89621255cfd5708f5658dea

SHA1
6c3b530412474f62b91fd4393b636012c29217df

SHA256
7c5b1d8469e232a58359ccbcb89e619c81c20e6d2c7579e4292eb9a19849bc5a

SHA512
f6998dbae1a2fa56f962045261a11a50b8e03573d9d4cf39083da3be341cc104e0ecf5908076f03961bcdb1356d05a7450d69940ec3aaab73623a6fe180e7051

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png.fun

Filesize
19KB

MD5
b7c62677ce78fbd3fb9c047665223fea

SHA1
3218c7b6fd8be5e0a8b67d3953d37d5dbd0c71d8

SHA256
aa638be6e1107ed1f14e8430abedd6f6d0a837a31b1b63e6a7741d6d417eddc2

SHA512
9e0cc29835845f2a0260a6989c1b362bac22a8e0c2825bc18f1dde812ce7868503881d2deaf951429a80b5017b6ce31e785ff524883e08d730aa38b36a2fb074

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.fun

Filesize
832B

MD5
117d6f863b5406cd4f2ac4ceaa4ba2c6

SHA1
5cac25f217399ea050182d28b08301fd819f2b2e

SHA256
73acdc730d8a9ec8f340c724b4db96fc222bb1eaf836cec69dfe3fab8d6ac362

SHA512
e10883029c1e0fbc64bec9aac0a6957a8499af255e1790843717212077926474e02b2870c5dd04b057c956b97ad4bb1747fe73e731ea61b891f4b38dd80494d7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.fun

Filesize
1KB

MD5
433755fcc2552446eb1345dd28c924eb

SHA1
23863f5257bdc268015f31ab22434728e5982019

SHA256
d6c290e942ee665d71e288229423a1f1866842988eac01f886910b0ec383aa9b

SHA512
de83b580ce27012a7677e1da867c91e2a42dbc6b5872dcf756ace51c2862801814665ecca997171f2e550e8b9a3de19994d2516a4e5d4d57e16c7b4b823236c0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.fun

Filesize
1KB

MD5
781ed8cdd7186821383d43d770d2e357

SHA1
99638b49b4cfec881688b025467df9f6f15371e8

SHA256
a955039cd9e53674395f4b758218e4d59c89e99a0c4d2a909e49f6008b8f5dd4

SHA512
87cb9c4288586df232200f7bbacee3dee04f31c9444902dd369ad5c392d71e9837ebf8b3bb0fcb4a5db8a879cf757e97ce248939e3316c6bf3a3fe7cbe579534

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.fun

Filesize
2KB

MD5
51da980061401d9a49494b58225b2753

SHA1
3445ffbf33f012ff638c1435f0834db9858f16d3

SHA256
3fb25ddd378ab756ec9faa56f16b76691cf6d9c7405bb9a09ce542a6f5b94e44

SHA512
ecc5eb2a045ce2508d461b999f16caba6cce55aa0c00b34bd73a33e0458795f93a77caff5026212912684164057be016f51dc57ec83821c2a1f2e27417c47b2c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.fun

Filesize
2KB

MD5
2863e8df6fbbe35b81b590817dd42a04

SHA1
562824deb05e2bfe1b57cd0abd3fc7fbec141b7c

SHA256
7f1238332901b740cde70db622abcfb533fc02f71e93101340073552f4820dad

SHA512
7b2d95465ea66951ea05c341549535a0a939d26dbde365b212e3983e4047fa6912c37d737cb8054c41bb1a7d92586d968a0154c666572a70ebc59a4776897f38

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.fun

Filesize
4KB

MD5
79f6f006c95a4eb4141d6cedc7b2ebeb

SHA1
012ca3de08fb304f022f4ea9565ae465f53ab9e8

SHA256
e9847d0839d3cf1039bebdc49820ee7813d70941347ce420990592e5e3bd998e

SHA512
c143a4cf1ccfa98039b73214978722408188535ee4aa3dac08a34760b94bdf6d36ad0ff0de893da5b17fd69c96a6dfb25098ab7fec219fad1a77532113d0353e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.fun

Filesize
304B

MD5
b88e3983f77632fa21f1d11ac7e27a64

SHA1
03a2b008cc3fe914910b0250ed4d49bd6b021393

SHA256
8469b8a64e80d662eec71c50513f6d295ef4a3a9992763dbcac9d81253cef9d5

SHA512
5bf93d4f4250ca96169f3d27d4e648cc5d6e00b7558a3ef32e07edcbae36dadb8008d7ba5f83ac3ed812b72c9d52730e866191b4de7a339df57b5697e00df50d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.fun

Filesize
400B

MD5
f77086a1d20bca6ba75b8f2fef2f0247

SHA1
db7c58faaecd10e4b3473b74c1277603a75d6624

SHA256
cf10d2a22b638cf0978cf30ecaf39ecb5bb0e3ad78cd920afa433ad60cc1290d

SHA512
a77a897c0b41f4052cb9546d4cfd6e0856b288b6b8583a86d6c7e79059a05b19cc2593599251581e79107235e9d5cd589c392bf490452be04ff57e944cd19df3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.fun

Filesize
1008B

MD5
e03c9cd255f1d8d6c03b52fee7273894

SHA1
d0e9a9e6efd1746bc9ccb4eb8e7701c1cd707e2e

SHA256
22a34c8321384fc7682102e40d082e7812232a9109e4d4e8fa2152fda3f260f6

SHA512
d4bd002197b725316e1f1f2dd0a70ee44a82a53ac0dafa8c6b1166343adc406e147d0c4cca30d65a32aa545f1b327c6b69c0ec1d15330af48a6faa234dc4b5ac

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.fun

Filesize
1KB

MD5
62b1443d82968878c773a1414de23c82

SHA1
192bbf788c31bc7e6fe840c0ea113992a8d8621c

SHA256
4e96529c023168df8dde241a9acdbf4788ea65bc35605e18febff2b2071f1e24

SHA512
75c8604ea65e0cdd9ea74b4802930444dd16a945da1e7f0af4a9a3762259ee9eb41ea96973555d06f4814ee2f6b73ab662c6b314b97876e9628fa5d4536e771c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.fun

Filesize
2KB

MD5
bca915870ae4ad0d86fcaba08a10f1fa

SHA1
7531259f5edae780e684a25635292bf4b2bb1aac

SHA256
d153ed6c5ea8c2c2f1839f8dadcc730f61bd8cd86ad732bab002a258dea1d037

SHA512
03f23de6b0ae10e63c41e73308b3844d49379c55d2df75fa1dc00771b26253d832c21081d8289f04260369df996e31273b7c0788cf3b5c78a27ec909f14a283a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.fun

Filesize
848B

MD5
14145467d1e7bd96f1ffe21e0ae79199

SHA1
5db5fbd88779a088fd1c4319ff26beb284ad0ff3

SHA256
7a75b8ec8809c460301f30e1960b13c518680792e5c743ce7e9a7f691cfafc38

SHA512
762d499c54c5a25aba4357a50bb4e6b47451babeda84fa62cfbd649f8350bca55204ad002883b9147e78dda3dbabaae8da1dc94b716204226bb53326030772b7

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.fun

Filesize
32KB

MD5
829165ca0fd145de3c2c8051b321734f

SHA1
f5cc3af85ab27c3ea2c2f7cbb8295b28a76a459e

SHA256
a193ee2673e0ba5ebc5ea6e65665b8a28bd7611f06d2b0174ec2076e22d94356

SHA512
7d380cda12b342a770def9d4e9c078c97874f3a30cd9f531355e3744a8fef2308f79878ffeb12ce26953325cb6a17bc7e54237dfdc2ee72b140ec295676adbcb

Download Submit
C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe

Filesize
5.4MB

MD5
f899ed8284f9df71e4dd43b152dd60e9

SHA1
715796f8e8c83699dc2672f5acee91dce08715cf

SHA256
8d886a250762d21047a8a579251909225f5adab2e372a7f03e2c1c8c3d294152

SHA512
49b6ec6cc9b7256a19ec18ae5045fb01118b5ae1b2aa5b6e4d9b66daca8b7b3dcbfdde84c20a416378ece260fbb06addaed2c3d6af7eaff4958934fbb81dd796

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-2cca5ed32b534b2a\RobloxPlayerBeta.dll

Filesize
17.0MB

MD5
8a4ba9c73cd602129a42b31da97e1a0b

SHA1
434bf090957aab51bf552838dc576c3b6b1e0a5a

SHA256
c1711ca27b266ce9a3c1866bec5056fe64982f91b9d53bed4f0c78634d568a3f

SHA512
052e536857d8dc323058d5b949179088c64b968a2a124d4026bc74ee123369e7b49fe5164df149e5325186013d85301aee1b38e1e78172f528c84eb630801ade

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.fun

Filesize
160B

MD5
580ee0344b7da2786da6a433a1e84893

SHA1
60f8c4dd5457e9834f5402cb326b1a2d3ca0ba7e

SHA256
98b6c2ddfefc628d03ceaef9d69688674a6bc32eb707f9ed86bc8c75675c4513

SHA512
356d2cdea3321e894b5b46ad1ea24c0e3c8be8e3c454b5bd300b7340cbb454e71fc89ca09ea0785b373b483e67c2f6f6bb408e489b0de4ff82d5ed69a75613ba

Download Submit
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\@[email protected]

Filesize
721B

MD5
a0b72173da49b90538b2bdac7594cb09

SHA1
55b755bf05df4ee138d78b7faf14cba2576ff0f1

SHA256
f26a92088ec6d5a8a06611e5117eb9749d5c07af850ececcdd40658c3df12bfd

SHA512
6ff58511a4cee0625e5b1454b06a73f4cb8705e1599fcf1d1abbe51b6a062bf0586287433e928faff51525e492589600d8ca05d0c09103d3a646d37fb1c01f21

Download Submit
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

Filesize
283KB

MD5
2773e3dc59472296cb0024ba7715a64e

SHA1
27d99fbca067f478bb91cdbcb92f13a828b00859

SHA256
3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7

SHA512
6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\5351466f-039e-46f0-9fee-5d2595fff69c.dmp

Filesize
622KB

MD5
fe67fa073cace7c3b3828610e281a285

SHA1
b5119d3566fe8609f0090550aa47ab7cf262472b

SHA256
3232e56cf4dda15d44d63af7d541176760b3629960353a973969ef6f9a20f8d1

SHA512
18343187df8e08603b4490c065fa61dd8039477a9ed5d6bab4af3da44e02d9a9499d370d2dc8942e70ef401e3376fe5ecaa5acd931041cd2dea88dadd1f88ba8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
af873f81d62e6e6abde00f10c86b771a

SHA1
ecad5e3ad5f4692eb0555064f2da7dfb48f16b33

SHA256
2f37458c46adee6619a3f457dd9f7547157a3243ac22663776696709e8f75cec

SHA512
297a9bf9900f2dca7d44f613150e9948ced2bfd6da46d52da981f2571647e9b19243f4b160cd633c18e30ebf992ee0ff8515601f0f47df090756c45cdc2aadab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
59KB

MD5
caaa5222d179a24ca5540080c7018b99

SHA1
1f415a7a73a12a4c16f25709504f4e4e4beae9dd

SHA256
b729255f2e984a20fa0f0eb07e08368cf468fd17ff27a7d1dbb4042ec261d8cf

SHA512
71b4f878aa154ba4a8523c2e36faa8dbe3cfafa082b18796d8b69539dee9506253b9e55fc9b71cc2c9027d22ae08587b0e2ddadbc8d3395dbb73584d1ca1ebcc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
41KB

MD5
cfd2fdfedddc08d2932df2d665e36745

SHA1
b3ddd2ea3ff672a4f0babe49ed656b33800e79d0

SHA256
576cff014b4dea0ff3a0c7a4044503b758bceb6a30c2678a1177446f456a4536

SHA512
394c2f25b002b77fd5c12a4872fd669a0ef10c663b2803eb66e2cdaee48ca386e1f76fe552200535c30b05b7f21091a472a50271cd9620131dfb2317276dbe6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028

Filesize
33KB

MD5
8af49d7d1e2c47a8f4d69c1e03c70b2b

SHA1
7d59d1c170dad9af31d328a0a96ba61b96db1446

SHA256
4cb6fa4953b993c9172b1c1f6fb03d23346c1181b08b8e57f1d7f61750cc22e2

SHA512
67290e4ed118f08c10b55f29b2ecb06ebb5aa3b7fe3ba979b5ac6b5d26e51da51a19fe3c16a0b3b3fc09711f34be1407d7cd233db51879802fc968491b5d64c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029

Filesize
59KB

MD5
776153414e02d5d56ce2005feb1f2046

SHA1
78d85185b844f256e76c1ee557b64885b3ff7f05

SHA256
efe1f5d882c13b0bcd75ae2c7582929ed5b89011b58aacdcf9cff5108df48a0f

SHA512
feb08766192b8f20eaa3910c46ae0cac9543f126048ca1a9f0688e0d6353ab42421ec6f04f23879525ce187147bc221962902b4e705c2b0e41ba2e243136062d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b

Filesize
27KB

MD5
341fc21c5adeb6d68b9c807615078b43

SHA1
451b59a7ea70af0a37601fc41c51c67ce47c641c

SHA256
a66a252b8f98068c5f81e7df50606462407c64fb82711513f3bbac503b937dfc

SHA512
7a4b55171bc786101ad723e449ad703727ba657903439e3c3d78dec0f67b1333eff11809ced95f8dcf9580d7da9bd70abe054d5de600ab6a4b0a7fa1dc7f76c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000031

Filesize
119KB

MD5
2e49331cff9c22b8473e061ea31d4124

SHA1
b434bacf00c48f98903dc1ac6a15cc10bd4a9207

SHA256
2036651816ea5aa0d45ea68bb0d6b87b5a2ae86dc019eabbeea135649a73f1c8

SHA512
4af091c097418a21b8148a334aa9c5b49ac38d9c1ad596a151271aeea0c167165ed82b992bfc12389ff7cfc521d38b657f60316f46ba840dea0b7e8a8bd27760

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000033

Filesize
64KB

MD5
7e374697a774e37b7a7a7966eb344b22

SHA1
152ed201cc529fa83085f7021d69b7f77f503263

SHA256
9261cbe6e58fc389f55702d81b19996cdc693482c52030dcc1465945931c34ac

SHA512
97a42cd2efa668bf48ae5d49cf7a637be36037abd1ef69348fdda89877af6b2c073352c7d9e1c22216585df37c1d79b58d480127cdbbbb65fa9cc614e1955c80

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000036

Filesize
87KB

MD5
d2895d96341b1d0c1eefec5fb110bbbd

SHA1
3e8cfcf221da48d743936a5acce94851d0a3a3b2

SHA256
d389e6eb3728840e524e4aa67ea2e0cda842ba753df9390539fb3768651d27bd

SHA512
15623935d525a08f663296543a43483551b4d888367147d7def69d5752b88a169ebfd96ef425a5cde9c1263a35c8059390ace0f94c79c390a936bf52e1e84c38

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004c

Filesize
147KB

MD5
759ab24cf5846f06c5cdb324ee4887ea

SHA1
41969c5b737bc40bbb54817da755e3aa7d02f3c6

SHA256
7037e6c967c38477a5fcd583c74892e16b7a9066cd60287c7035bf0760d05471

SHA512
3470ae07eb7c54feee1e791e63a365cfb0da42f570a66e6c84faf5db6bf8395173c6cb60e8c5cf28eae409f26ea5433c3c5d6ea32eb07e5997c979c6e3ccf4be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000065

Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000119

Filesize
24KB

MD5
87c2b09a983584b04a63f3ff44064d64

SHA1
8796d5ef1ad1196309ef582cecef3ab95db27043

SHA256
d4a4a801c412a8324a19f21511a7880815b373628e66016bc1785a5a85e0afb0

SHA512
df1f0d6f5f53306887b0b16364651bda9cdc28b8ea74b2d46b2530c6772a724422b33bbdcd7c33d724d2fd4a973e1e9dbc4b654c9c53981386c341620c337067

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00011a

Filesize
69KB

MD5
921df38cecd4019512bbc90523bd5df5

SHA1
5bf380ffb3a385b734b70486afcfc493462eceec

SHA256
83289571497cbf2f2859d8308982493a9c92baa23bebfb41ceed584e3a6f8f3f

SHA512
35fa5f8559570af719f8a56854d6184daa7ef218d38c257e1ad71209272d37355e9ad93aaa9fbe7e3b0a9b8b46dfc9085879b01ce7bb86dd9308d4a6f35f09e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00011b

Filesize
326KB

MD5
7ed6b0b2aff652479142b1ee63c18176

SHA1
53a58bfb882233dfe735d0c618d863a9823ac59d

SHA256
ecb3eab2d237929501a6b8d6aa70e3be4e96277f37af643b0007a0d2779f11f4

SHA512
e94cc2cf0f80d1c2be8b33e53f1a6cd45961c9f951e54ececf41b741f61c567c1db8851403994a70c100a7bb3f626b58a0c5b44b78fff7978b270d41ffb3314c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00011c

Filesize
106KB

MD5
c054cddd96069f22fe75e7a2c17ae412

SHA1
d38822115595dad9af041a2ac43dd74c782276c3

SHA256
5f2af02562178807d98ae12e1a8e1aeac6928440ed40276a8c3ea791a733ae71

SHA512
64506610fa6074e56f710f5e7b21ea47662237751121e2b73d77a9c1fc72ae61f2b3a2fd7cfd95c9b6a9500f56c307d0176f365e426aaa641b2afda81aa136c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
9KB

MD5
b68581f4e935d8cf9e55ed8a06af5a8d

SHA1
b0fce69ad8779a49c52af194ced6b8f331353d57

SHA256
4fa03ca7cb9e1053a04b74f54a0d9b24e3f533e76973e9da0214ae33335bc6e1

SHA512
5111dc7e02cd0c4abaa33e85c3b36167283ee1f64cb318dda7dc2e3de3210bf8e7e0f677b8391e81f88169437c7340fabd1d0b5b7b5472ccc83efdb90b00bc74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
4b340b35b488568707c9abf447805440

SHA1
6023cde07c8d4aadf0ae0835fcdcd9e1219254b9

SHA256
49cfe0ff99c9754d6b45fb81470d721e410b0b30a776002f3ba9b46d8c3d5f57

SHA512
323206d5bc62a824fa127ddecfceb1fa3ab4c2e5182b8028c04de75bc1648e2e189b3500488343a5f86c4e2a1c44ab5389c17e736ef3006b2d12df04a71e442f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
4128d741ea249d42530ea5f7ddd2f26f

SHA1
12c97a7d15d6b5e9184439b57a3febe217d05c97

SHA256
3e68b1cb5ce7fd3354551186b0e5a99e5af1876d1f550b4d58a5c68036272e24

SHA512
acc9bc2f87a6a07b7ae8c34b3007e69d07a6519d7e4685e44d0af99b450944bb0570a99c7d7cf9a11db91b32db28f1b5008b96befcdd172615f720047454b167

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
41c9a9648a72040c9f3f9c7de04f4582

SHA1
5bad90d6fd60c004127f22d8b43c9946ff855346

SHA256
61cadc4c4ab0c912fcaab78aa0be60b60bcd306d1e111ccf149596154035a64a

SHA512
fb4ec2c8e831e571235700214e75a14fd2720fbce16c06550dd299e69824619fda73392192b9474c68ead14e0f0f2460b5a8ffdb94cb886557a51f711569e38e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
692cedee312144f307b4ada3df9aec84

SHA1
083757e3244fa8766c977e0b1a0a7db89edd8479

SHA256
05f717123dbdaeb0ea6a117c8b5e79fa2eb66b7a8a721329629570d44fbf0234

SHA512
07e2fe2649ccd1b0cb3ff4d484b7472cf82f8884ee8e5644f68e81d149d318a924f9a869469a5033202280986cd7061e25f2f9b000d494c92f363baa30f7632e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
387B

MD5
06a9b560d18c7d521b6f45d9eb61ad68

SHA1
c1684819f7ab352864188f5565c3f0fc55ea135c

SHA256
6cbb13d61525d37167e6260ea321f49fbf33396bf7b6bd0f181aae1c9a6a8bd1

SHA512
c9b14d2a683011a576bb3f2b3aca13fce02c35d02f72c156bce8adfb7904c18366af409a32e622eb7eddeb677b3fb5431d539c9a6a71f4771db9477aaba9104c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
387B

MD5
41f10e33f20fa477d3aa3b400a3d7e17

SHA1
634f41240eed8cb56f949b84db7f6adc4042517f

SHA256
5553459f44573dd46ae8950d439820628d77779a963618bb44815552eb8bbcfa

SHA512
610b1f321bd367fd58b2ae145fde6c82b7b661f9aa24927567c127abf22ebd836953449d13750f4236e2057b988d4bb0b5537203cc28368e768e2e20d9ca1d47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old

Filesize
387B

MD5
69e276eb384d3f10abcacb09ac1f9552

SHA1
199f19a5caec8d4c8dd624a8c2a3bf3d3b496009

SHA256
ab11c896e1639dae349e1694cef5b290b2521758e2d009e6598d797888eaad28

SHA512
702734723da31c17ec01df3926135ff2a110daca4d7229352ab3336b399eef82689a181be65f0eca16d7d728ddc1df9fd1425c8ce8fe7f6517e1f15b12f04611

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe58cdab.TMP

Filesize
347B

MD5
4a2c82928db346b6125c91656866f7bb

SHA1
571968aa7361fc0ef287237ee3d21c8e65d25cd1

SHA256
1a9ad465dd69a4a2010ab92b4bd1567fe74982b377f7a6b2668b8288fa286287

SHA512
6c4e62689b8898ea9ac084e61280860ae673d763d148220d6ecc7a8e4d53578cc9ea55a5266342dca24178ebfb8566ccee1267b86b40c2ff258895a72f971930

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
42f49cbd13bcda205ce1207463fa2bea

SHA1
2fcebb488b151097f16be5c61d14e3b6df4d0132

SHA256
eb06f7197d31c0a0742ac67de89e95be1aec5908644d8f607e4cc9a3f4c951a5

SHA512
48f8c5d4cdb0bbbe7df8bf3adb3cb2b4f764f6a744b4c7a892229800fde979df0fdff0f8ec9036f4c634a07f9fd3095928d2a3b7862cd5692f592f7a734754c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
12KB

MD5
8b1487d2817d654eaa9c4d6ac439cb57

SHA1
100d86935115e9f3f138b95e783856be4b80e08c

SHA256
38ce952988ea89d2f9b2f5db5449e4fe2ae472c495bc51c8593aa6a2f0f41202

SHA512
3eb72f3c80b5e2d6dfdd99fec3c7c322296aefe34f50cc082602bca9b7892fe788a7af94ea37d5ce71f847d3165295c320f52518072cad9b4a8fcd33e13d798f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
13KB

MD5
bc5599d0b4184cb054504bdcde1fc0f9

SHA1
ff08b27dae839d1766fe3882ec08211b2a57a993

SHA256
420dbd668c4322e792b4fb916c1a30c9ced55ae409ef06e5adbdb6ea490ebf09

SHA512
ca4122681489655c93e3fee1c159f1eb472612a77e01cfbaca5bad83fea96eb8e0f58c05b5a9118361b567e4531eee7d94236b1d42c7d48c142307eed1cfecbf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
90352603f44b0b2cfc1c0ccfb0c746c8

SHA1
59c5760a2d24a3432b33ee8389525a7075de8f96

SHA256
af3bc21b967db1722cffd8081f607f80b44f8924818c2bbc4aee3b568c8d6fb3

SHA512
a7935c594cce11e2fac40073d6ec63a91bf509c2dd53dd10329961e03088bb767d9d2ff379e35a12c69fa2debf9483bcb4fb4612a9aa6cc5b187e0d1be7df831

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
692B

MD5
43d81fe674ecad6c6657b6e9b003d30e

SHA1
1adefa7e19a3aea73863881ab36c87d14d473b35

SHA256
b06f23fe78d02f72b44f719021b4f709f854c23b39b5c354888a7d43bdee8b86

SHA512
d198de229511b716514f6a01ba7ce87c08c07bc538680cddd19175512fed359755f0ad9a4093e50967000a27dd3d8129cfec0094601c7248121f733a44e9ac8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
349aee1e6c7431a1c4968303d353fa9d

SHA1
cd552c7bd3deabf42db8d2d314d22411404943db

SHA256
6a586949f37f374215d2cea8e57bc8836b5abf15b2c92f4c3cec4026b09b20ba

SHA512
b8a30f70b810e273553b6043267c7ddd9e2d2c772f5e04319a8336562315a7843d1db865fe8503f75697323742b7981c1c2a26f9a75d52ec4b00666e93c07a0a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
428f93e1303ad9793d79dad79031cffc

SHA1
76e5a9ba809038cedc663ef0944974e24300284f

SHA256
9a439d8f248beb8fd57d107c988e60cd1ed448fb11c9f951fa83d0c0fc283219

SHA512
1200d271ff7c2d3bfae214afeeaf98ec8ddaf18e788415517cdb4f55bc0290feac4aa3464e590914c327034a813d7e1a3b3ec0b1273d863631537fea64c678ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
96604e19f29a269af0568425fb35e845

SHA1
ebfa6383f06cdd2c94686ff63f56530971928637

SHA256
fd429fcfb4695d3cd3851bb162b19c69a02690b69ba61eff899c47d4b52ad2b0

SHA512
192df3a3bc4f99d6bcb741e7df0c24d422e5ac4f8d25f1f0da13812847598254d8cde8975a77b2cad1abba4704764c4754d9d2549ae409c3e01cef76ace0f7df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
98894ae4a4358b5067b6f522262fd9c0

SHA1
89eee0eb382c3697fb414969b3b260aea87b28fe

SHA256
fdb50206c847d9933ca7953fa24df066dfc86c3e80742018b5e6cc63c605255a

SHA512
9f1e861dc147c764506c903e22ed5899f186fed5e1ec9c151d487eeb55a9f0eb3bcc916eec1e58d52e434b836ed0fae37febf3fa1dd0bee52ae5f1aed4f07ee9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
bddeecfa26db1196fa7494b7c2deee42

SHA1
6d4ec2b348a2e565f4d331f82cf9bce43afc2e4f

SHA256
737e4eecb2c92c9c64a5fe8c2c37ecaf608c52ee06af50fc50dbf7f3bcc1f486

SHA512
a75a88e00ce72ff72458a217cb27ca5fdb95f162fa69c9db98f62aef9502bac9f058f8548a89079570ad73b2d3f26fca278b7de8a9d8d2780803510b11e4a57b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
0a59637981cb3ab96b09e008bd47c229

SHA1
690f74860ed0fd7a454fd74509a0100204aaa8dd

SHA256
df0bab81045f4279eed38fd84ccee178071614b6a585e5794a0577a743976cfc

SHA512
b61e5b41bd3401499e1a74de2492abdf88c7e5edff24a7ca41d0e717e2a17bfcbee8cde1333196bebb434f19fb3bd4d3fd7e996235a6369c0fa0d91173cd4264

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
da563d8221d01907f1459036dc714cb9

SHA1
24c59753d70dc17a433f7a6c24a6ad6ce529000b

SHA256
d0f941aa6317da535cc6051c73661af27f58150bb490cf1e7ed411276a903a7d

SHA512
e47235838d37057091a29001d5bcdd1d35a5cb7fc092fe1cf65689392ec043bb81c84833a6c8a6180b69bf8899b13b50f0d88fcd473fb083854651a0e5b4d25f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
3653609f26379d2f0cfc060bbfac096b

SHA1
a7ac0fbb08e99b6b7951fda7d4a7c7f571302eff

SHA256
2a3c26ce7251565bb6e39204bdc6b1350e232f54017495b7bc52ea639ae74580

SHA512
e9ad1c0ac1bc01796ad012c4b041d6afe4e28ed152fd8b49c075e59f73bb1e7fa1cc097f007013b11a93fd9e73a1dd26bea29f0fe3601e0a12f84a2c0258cb39

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
e541fe974079618be301cdbb0fd38b0e

SHA1
e9d9afa83abb825aee2a09d2c8d177c4335070d8

SHA256
cd1d15fe70f2db0d8eed3340ef3d3766559ea474f012f14bbfdbecbcd59c79ee

SHA512
d19a73f6e085e133454722e61e8d9b6711f144832d6117ffcbc2f46422f332ca51fcaa707a4dd5ff1228e5ace170ceb692e76c56550512fdcd0f45204ae3260a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
72bc0f38e8078c441ed463413c1e8caa

SHA1
7742ad8a5d8810d8150657c844a8fcb78c383966

SHA256
5191d2ad8172a639c8a523b9e58176d74f533fd9d27943fef4ba12b2cf70b432

SHA512
f0b41a5b7c51383642252e8149d70b7f2dc1dcfb85869fa07be3b54ced4fa28872f4f1644649f5837a64cae165bae4a3cb88a70a4876766eb220145a7d8ef19b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
d08a889441434c8040b661a27663952e

SHA1
4a886248f981148e90f834b84199912a38040116

SHA256
a1874498eee61f68e639c5cc6a6934262b4e1b6139c44eefc070936cb3d0e0a2

SHA512
863d166cbf262ecac19c59a1d57197f9e3abc7a551a2a05d932c1bc22dc99fcadf2051186ae1ee3c0f7d9aa48684e178daf04fa8f654835dd7599d610f23c512

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
bba516571bb9c0af7a3fe1059fbb5dc2

SHA1
f7b1da26aa43ef451b45cda73453b0471cd4722a

SHA256
80c0e04f28576a9e0d0f0b8b2a6a435b74e20816868255559a98858464f96610

SHA512
e4f55715a1257893326c34acef9b5e8abd70d2352eb2a55631bc940258b5480f5c47e4f4d20db25c5e0372b8ea2937fc41d9116c29667cac0be0df2ff8c82f10

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
d64c7efa333b793f439354941af8275e

SHA1
b4914b80ce880f921920048fa9a995912d666e0e

SHA256
134e5e26479c3c813a69b8b3ce008d5aa8a53784230c894e57db03d81a47b523

SHA512
c79719fc02d553f4ca639a6bf7078e20785a367c90c4761457c6a4473736d3a22c98f81c194b85f27826eff86de8171b706a8718cccaed7bb3acfc84c38c5d9f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
d25465b93e0f2d18d86d62f94953da1c

SHA1
961e62e5dcb586169d7a0705bbd7c21f2f47fef9

SHA256
819c1a17dd44e540d41455df46ed0a06d5a7fc174afe1f9621fb880acb92d28f

SHA512
4601b0bef151cbc089174e9aa5b38ee10caaf71b26c9a12d6cc7ace0dd28d0e3b01c913b56195626d9b5ae9e3caec47c3fca1ac3a22ded4d8c0a17e844ff4e50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
6f267465abb2d2f75b601739dc1a653e

SHA1
9a053ad4b93e6e3fd3b2aa138b6442693a1acbde

SHA256
ab5ab38b2789c09cc4d8ce5ad246a15b13de52e01348d5d6aa142d59fd51c2d2

SHA512
2f1b961258d74ace008d4ee818e87a597b6cff96d0e71eeed60cb1aca969e06931229798a69395c2e99c594c7bec9a8b5ddf6514e110027611053af6cc26c62e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
c5a6e84d2bd990adfa1ba0608bc57440

SHA1
9d92db4eaf8694216cc62c00e365db22cb554b18

SHA256
24132f02ecdfcf25eafee78d9f5831c80a5afda49c8946d66e8e4d6b02757cc0

SHA512
da473aef171200ce9a3c0184727e32eeb2088eb47ad77d43ee927dc73936170a2d4515718cc746e6fb8960a35b32897d6483e61462028f181862e6b63f968f02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
ba5d9b881b286baea4cce09245d44c5f

SHA1
808307605c67d05e646c285ebbe7b8693dfd0c4e

SHA256
d5235bad729d684f067c3f2879a7cb1a588446f5d1a48b9320f05ef07089e8a1

SHA512
9c8ef40d8ce7d81ae7a397f7971a09181ece1ef2243ffc298aca99fe95b095c488c9753f96dd3b0bf12f0b1ae009b6acce654043353c05890174a19ad3a8fdfa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
5c3ce1fa2705f0dd06758fd67c36d0e4

SHA1
31ac8826cf585547c562150e0a413c0d08e2101d

SHA256
56fbc069e98ce7094bbeaaa79388d4b331b38eacccb29300a549e9494853ead7

SHA512
b696761d7230782ae13790d09d038f067814b316c546136c492fa955c8ec525442e158b7efdaed581aece20876e7e5e5e2dcadb42e007880a1688a0a38c2f3bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
2f67bc34283be463928ea3ac5c543709

SHA1
be653e3713d1fb8ae115b3442c681aba95647bc6

SHA256
8e390f953ef58979ba58f4f8b0c68878634388776233dfe914d863fb0a019302

SHA512
590ab275e1ead73b6699e0037378cefdc9bf22b20b9d194c4b0331f72163c98136a3af44f6fe279cf0345639aac9d751787b18e60e5ca4f8da4e3c91b7080c08

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
53c68bc2d59bbea7b969c17b78405242

SHA1
d56b81d07870cbf2d0069f043415b22d9734270d

SHA256
f37fb5b8b3bfd9260cb2329d65d6b0ac8c01fdb3f2cb66ef767f1b5c47943c8e

SHA512
bdaac28bbc9542dc3c41f5167e95ced75403d90b3c93dca07e4ca5b8155d305f3106b0b623a4a03eba494d699c96e7a623ed29121c8b6e96518ffceec3130adc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
fd652bd428fa61edf15e9bb8004b072a

SHA1
6b04c3c9e80a8ff0c60f26d4368180f54a85581e

SHA256
ff494dde1bfd8abda4fa5d79900910301175a5a71e28e184cd805092cf9e53b5

SHA512
b7e1a97b0e8c3fc59a0aab7509161793e1dae69457bc17dd32779279ee096cad7ec4c7fa69cc02aca9cde2ef380d49ede10e881087f23f4c45aaaf43b3f9a4ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
edc46bbdb2c7b27896d1cb76061afdf4

SHA1
531c2cda92521234c906faf278aaa87675a8591c

SHA256
f83f668faeca3f2b9fc12689a99a2262ef5297763936ce9bb7b73f0523046bf9

SHA512
b5213c22e179bf85da9a412858aadd049703d9340b4c5f85e6a38476e5f64cbfd46c51f07d63b6177f3adeab4d7d4809f8ebe85fe3e528df6bafc4dd9e1a1f7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
1af3e82c32af1c7dfe323ac8b8ca9047

SHA1
4c947f52378fd61aa7043c80b19b65fd296ec27e

SHA256
6010707a191dc6c980a33c929282efe55974ffc5133694155f6f24b06f1e67ee

SHA512
32ae4f38fab437753ba80d8d4c432e0ac608be94fdf0adddcd334082b7c140257065d93ade5ef09fc714a3b0034196c5d70eac9fb794d6fe447475aa159fc0b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
409545fa0bb1e9a62e722f6b9a65c903

SHA1
eb2d07fefe2fa407e2b442679333b622395f04d1

SHA256
32f97d0e31e3f89debca3912175ecea60e42e8af4a31e531a0cf32b432a7d504

SHA512
16492ba845aad6d20f21cc001e3caa1ad5598d539010927a43310f663fb667e0f5c4c1f239445242209b79934e952d5992dc4d40cef976d2c7eb0c31badb9430

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
65a693213c111c4b49915f88eb2fd3a2

SHA1
96298fb825271d40d856995dd259c41c01155ad1

SHA256
5190ae511d957c49136e320a33cc8a6dce8614d68f384ef8e598ff1f98004c25

SHA512
0948df6c5e9ecbf2a7c8c7ec3a912e4bb0bec932b9219769cc2c3a6cd3bf11c8ceec348095abb674d937ccff03989c65c15026a8be4c0f92e0efd191f8f3370f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
8b4b1c30e9f21ce123306382a61b86e3

SHA1
8028773938389b9c80883a8a84153c79c95de2ea

SHA256
05025c66b23be951b48a0d37c52b4442b5cdae27e023734ffe9d0e11b028ffb4

SHA512
da4ca6ca69d40a5284a0deca1d69acdb230bc559c7d239e8c85a5d93bde50a09eaf525ecf5679203f481b557d3a74d2ef4b5591ea43c7888e718b4f6e449ef78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
f67daa01ffc0166e54772b2dae9480b1

SHA1
8840239df0dee498f4132ecbae559074f26929ea

SHA256
f3cee69b17b447e3d61e96d9ecb9e10bf833ab7b2508ce8d1c427ef1e4fe5eab

SHA512
1e98a920b8532995eed6ae0f71d33a59f867bde5f5e0324752eb9e14f894f517abd2997663ca95484dd17b72fbc723e7d270c08e1cd2c6e8f7264af8f9ab2def

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
b7a4132e4d536a2211430d1a146b791a

SHA1
4c5226f159a521291ddd87a2d521aaded768d531

SHA256
04a0f6d104bb9c351f568862b80c9b204eae83ccf8f57d53ccfec5a5dd886222

SHA512
792c463a8b1e1c51d666afd17037698ce9fae40bc6421f230d78a4a57ed76949e23b561fa142dc17f628e2c0b6adf02416023e13c2ba147913e76a17e0552007

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
e328362fe3957dbeafb5d532439ca2b8

SHA1
4442a575dbed686c29b08da9f3b7b28fc71af178

SHA256
6365d2cc9a8f2f48502c87620cb481c0c8ee0af1a055bf82ffefdab329894970

SHA512
67f063a4a08fd37c5d0ed8dc05ea4bdd94d46bb99f48e4f373b637896f7a959ff2694777478c645427d49dd97e114bdf908e3ce6ab3ba02dd9409588c683b756

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
ee4dcaf625540b0ae3edbeb38a01a988

SHA1
bbeb038243d356ba49b0a46698b0784c1f560fbb

SHA256
fd4eaca61d49334b8c148cd320178e6544f68aeb7f6d1ec697bf65b5f24fabaf

SHA512
ec71f9fa94530b24883d22071636e745025e9d0c90983acb155b2b6418f422add66e4d3b42e6300420cfb6f128c2c733ce2d1be2e04f820391104b99e6795cc5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
608baf0e48e241dd70a3a3b6748113d5

SHA1
98ea497ee153cdc1d4fccb5ecf0f029001546d4f

SHA256
9b34f0f642f4981588e539f07acd49caf55e789ceab6d45cfffbfde5c55d6b8c

SHA512
6e53a219c4be178ea212463d61802e7d5891acd282a071962d7d06b7c3f6064a3bff6b1e9a4327b0c34503e3dde055b4ff14cfa64ddde29398ba305a6c520231

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
0fa292c5c497fe07535d6c8393e74bee

SHA1
f7c17161bbb99a73555e12570a9ccafd9c0c6fbe

SHA256
af6e8bf875c64937af97331a2636a02e09725deb83d831d3fd16c19bb0d82285

SHA512
ed3ac09ca0bd0f9a72810cc622b94c1a95ccbf5566f482a4a40df33aaa7731e69f1baed9a6b4dee9e6f7b9293c845bc9bff4e4f27b201fccbbdb79e9db5a3515

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
4ee04906c57ae0232be663fb6e1b720b

SHA1
0e520af48e346133267063b620b88ab9ab04487d

SHA256
1928f55c16451f0a90b9db1429051c927038ef723ebfb8dc10243af212cfcd46

SHA512
7ab2e4159a03c5e7c88f21e78c906b2c48ee64f6c92c5ece83ef9e055222618ceb13c97dcfa18c854bc2c10905f3811d7c2fb5a8ff382bad1ea3163b9c6ac325

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
fa284487bbd86115042f9ac45cec093f

SHA1
008842b42cd19423629bd4d8f0ac1e686433f011

SHA256
fd4e13126fddf45ac13a1afc3f8604c2f1e7d692baf52a71f2ae6facdbc41ee5

SHA512
c197037b66f03e0e58e07684542aea62c0ca18835a0574c15f566d9ae7ba8d0ae1e2288077ae34cc81251ab23d0012533de84344030d142ff6fe73102c9fed51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
677e5cc4a8985fea854dddf846ab4915

SHA1
ab2539bce69579508793422afeae70f268b0dcfb

SHA256
d52b8d881b241ed28ae0636ebe947d2a89d975125294aeabc89136b0b1f8d125

SHA512
3f588967389660222b73ceee1b92b580304256350c9a83f785abbde905de2d61e83104df0eaf9709bc0a973cb5a493e95fef3bbf18373439cd4c022cd51b8613

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
de9281972c64501c5efe7280a856a729

SHA1
b413e698fa1979f73c252a6bd27603ecb5ea1257

SHA256
02695e1390706c467e5361d798ac6e8e1555c79a3c9ef607ecb1a4c723a467c2

SHA512
46e1db76dd095c729a1617641d5ac6906939a2b0eadd954ee191b8964eae130ba37a10ecb0cdfab20473417c1c43d8045351552d40a6ffdf06edab424cb7a459

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
eb1efab547ada5ce7620902776e5b7b9

SHA1
741802ef84ade118406bc889cb320ce792f027bb

SHA256
5d18402cf65e1cb66f3f27bd7b5c2aad003bf95751a92101cfd558e192ef464a

SHA512
ada2577e6537c0edf5528c33c5523636e4aa8f2de31a76893798c249b0cead753807ea7c5da300fd7eeab6930953b3e34dfb7f9b91c711e48917967cffe3d41f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
fd4add74affc6786b99fa653a46b0796

SHA1
04c3a8d2a7fbe84c266f38fa5b7c06938050654b

SHA256
a5d3dea30d50ad3725ba6cfbedc6c08230a8a4305739219d38f49e6c171a0160

SHA512
580fbf45b3171a17972c9cb2a7962bb712a89414e374b6878c0cd017d966e7991f7360e39af067a06f6f266fe31a75741e9e364044b95ac92486e02f4666ceeb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
3f45c39772f8cc210c26452187dfc9da

SHA1
fd6175ceefd8d3009a92a2381a59a37e4823ace9

SHA256
19cfbf1f42f555cbed9941add93decc18cb1daca9ad1ea98cf008c79f60d2582

SHA512
0a0a8ec585a6728c16fc7c7b36ba7e1bfcc248be40ba3075fff8f4a82b2e12a586df13e4f91ffe0d2e463ed38e5d6c7779c7d643afd0fb7941fa9bde5ff2acb5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
5c7f48ca512e139b96fd31eddfd7cc92

SHA1
322526c3e1924c43615293604c7f8fa085773e64

SHA256
5c0ce17c3214ec9550c9bafd163d26d5596b866ceabf56ced642bea3378aba25

SHA512
94ffb40c9cc3dec49c9d72d560f19693cc9a22f014f190b3e91622547ab6623e4d9715a86b51270744a8fc13f4a5ca1edbe58040d317ed269e7bcde9eafa7e78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
df05d854aa88d8371d65347ba0d49eb9

SHA1
540ccbfb4e26bc12dc8eccc06b38127715761ace

SHA256
b99859e8b9d97b3695d8e1b6a09903d5d03aa14629a20f960881a859e0c60149

SHA512
6991e1dc77951b1a279771a3f6bba41998e4dc00bc46345a7f84fea33c5fbf9d4d38dc67a5a17e2b627c95f99dcbf92158f159159432fb5c9b5106ce3ed9ba50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
81fe17b232489daec0f34f90ceef3f9d

SHA1
f687ab29a2670a8e8b458f9618b66c847edae939

SHA256
0531a69f27a2672dde7cb68af0d03a3e547e52955fb84460eaa105fdde19599d

SHA512
39fb48e1be834addce37103de54ca9334f1e979b3289d72cc6369cdfcbf61bf1fd964f1ef1889ccd9f6fc15a0da74a7d6a9fbea7b6960840ce3b8051336ecb70

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
d7c0d68ad303dc7b229f7dc9261daec0

SHA1
1928860f416a3148585287dc1101bff3dcfc8dec

SHA256
6947909c72b71a6d0cab3e29b1ea20b1411346e6170eee4f212bf68ef2e2cb1b

SHA512
be3abf8c31acda828c926ef3fedc82f943fe7395440d5123c0c72486cc65f0e3a2f752cc30b8d43b8564dd80f67bd7643666961e75f5c31e5a7a70850833add7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
d6f83f41342c4b79a1f9673cc445317a

SHA1
6184175719965cd5e96f2d200b101b90f21d27cb

SHA256
47cf7d9552b348ba43fb9e66698c1c20ca82791ac37b4841e43f4f3a52dc04cc

SHA512
d18075893b37e850e160b0465496469e5d2cf82db300eb0f5a6d3afec67e3aacda0a81d183f6e5f2262f85d3228ce2e493f2cd90f7f0185bcebd9298df3d10b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
76e26ed9a99574788329ca963bb85124

SHA1
63542d5caca1535eb6e398ed4049a9bf035d8be5

SHA256
79742f0b9c8ce205a2ee24ae296e95a051e77e945ad3af1de12da78e42516909

SHA512
8e31197392bdb0ac5f44990296a8449b9d644c102a149a7e8618beeac4d75b3b3e720c3cb8a37c680d94490f3c407f8933856cf3f681049c20857bde04ac4b2b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
71ca4dcd586a2c2f9ca317c30888381b

SHA1
df1525b804274945e145ea3d336259c2f395cccb

SHA256
6c8fac10c5825b7eb13cc635265f58f36a1975f8cfbebbdfe4c8237b8e72836e

SHA512
cef59ba1ba0c2d54297278c57aec97dde7346fc98304a22a99a4edfa0e7415a8245a96809ede6fe9b6fc8e53cbae4fabeffd0a441c8c79ca5885581f89734982

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
2f9dd3fb37b0d73244302cb12cafbf07

SHA1
2057e6920b5101346b53cf70e61454b53a54ce35

SHA256
96190474d53664154f014e78e4b2e4dadfe081f91f22b32f53ac0d16723b0596

SHA512
2a01c422f4657b5ed2ca032f993c7406afad9df2a2f9407ced4ae2f60637ef6f0ac33c805b25f46d1af846a6946d78663425301d68ea4a84f02ab4b5b803b1a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
bdaf972c9cadc9220ab7a4003e6d88e6

SHA1
40599092dd14c2e6dc464b983cbb0647bf184c6d

SHA256
df0fa212be7e9940766409a7f4afc779ef85c8182ba6f019bad3c9a295e6eecd

SHA512
a78074cda78a06baf1f52e669a8391df0a3f29815dc891f606dfaa877ce112313879ec9965e023d7189a1f526d5d415cc093f768b8aa62845d6c980112ef9933

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
39e07bef4c08aa6586011a1f79f04071

SHA1
289250ea5343dfa8b48ee08050eb279267d11cdd

SHA256
27820e919ac5a1d3a1e27b4c8661823b0f2bc985d8bae5fd613da1a6143a87a5

SHA512
2f9eb2232b099d1a904f9be23e9defb33b9c33dc9202e8e2dce19144b82ec054deaa4e6b8dedb2f24ed64e77b265266c5bee5f0197fd5cfa8e046d11b3ac58bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
f3894eb04c059c3e2329f6c30d44ec71

SHA1
69cdb511e760f3a6904c32e489a4f92ea7f24bd6

SHA256
a9317c1072d3b26a1079d099bab6c2afd3ae9732b0d8d28e0bfb2f5c541c270f

SHA512
7fa9a7a970d9eb7d339a54231e37eb2c3733630a3fba8439f420d0a0235f55af5b98446c08cab7342b78127a8fb1b488ccaf1914f850dc77f250f9c6dde80187

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
5db6797091d0004c9e7a6acbbecbbc3c

SHA1
6946bcbf9cfbe971be2c31ca7dffbf7468358ed2

SHA256
c7e6c0ae6c5f3de3f848927378e22359e5f318392a3688b9eb73eeb4a95d619d

SHA512
d5c50eed508001fbfa182a11f4ad0d52c2e7fbd964aa74dbcf8f60d0ddb6629bfbaa72df146ca93c2c8dc358a526902bffde928f1294335e932d5d200964027f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
fadd4bd58c347fbead5e4f6a554a9a25

SHA1
3e72f5b2dadc08ec4c3d1a0fcbba6e0e885f8afe

SHA256
6aa19d4e41df4620b67edde1ebbc75ac9a193b675dd8ed7aadce52501fe47dac

SHA512
237a409adbbcc9d7e1bfd789b9db927043c80bd10691eec98600925fff24bf06a6d2696834546b1878c31dc3d4020e928d34cfc8a084b8e57844429069760069

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
edcdc362ef6c38a9be49c0c3d303e214

SHA1
d04947db2d507c341f0c1bf06cf774fb8697db7d

SHA256
dc07fa268b0278ca3f33a77add69e5b54289297b3058f4c99937c1e53ca571b3

SHA512
37920ffcbe56ce84f62e3e683469655304dcde90fff7cf0dc479964705948473f9b8bb517e4cc3f7add6a3d2e78b4e20303b09253196e90e88435ded38bd1908

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
72fe44d222f8f221ce1f0fe255d9e52f

SHA1
6c3dfeb4959f0db1c6b74b0972ded743a71e1e64

SHA256
91835342ea10c239d445f615567cba26b8a75bf83df850a409ad0bf14d27fa43

SHA512
344272d548c5a2a899d3371f525942e9a9682926961ed1a27b8a717b4011e5f843f051d41b4216fdcf4c0756acd96d021515c0acf1252f9a633a42dd6cdda67f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
1527e50adbee07efbf9bb6cd74e5d581

SHA1
793eae880483a115aa17bc54d3163333a7921c11

SHA256
9ff4c532f4c8d6af2c30a0b51f191f53ebda43d9ceafb07b9b3a01652d670fc2

SHA512
a6297b274608e0e40143bab9bceed1bd426d3d967ef5e4aa6e92fd6ccbc890de9a940dfa26d77f828b1f342204c1cd517c3bdf1990f8f6f89eddb8a2fa82c248

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
488358aafd1474d0f261c4b9a3adfda8

SHA1
d1ae58054d83885bfafbe572cd73ec5855e9244a

SHA256
ed6b14a70385d936d11a8ed505c70057cb9f87454837a4550d3436487033ab84

SHA512
7e96b553b9d2ac98641d44651c9e3a2b1f559296668dddfbb4d395343a9cfcfff94dc17daf0af0f90d3eccc920d18f48f0f7b671ef9bd21bc632cf0b665b2082

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
4d865eb6ef5e0bd6947f97788c884755

SHA1
727c3be4dc52beddba4e8c739c5f34fd0c7a3375

SHA256
419ef93bebc97c5b26d36569850dd53af693dccf5537ed815c356070ba3d7a5e

SHA512
b12887a0eb1f63cc55af143509eb3a48ca505b57325f1454d928813832213f69244cd6e3a39e98de8c0155dcdad053c02cd3337b863670bcfaea33a1bb744691

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
d7899f1a23762337da5b7bd72d22a0f2

SHA1
425a9ac2237a090ec3f9b1fd69f61e3bab4aaad4

SHA256
c3db146019d3dca9a70b728f75eb2d424e08716b44eb2915e1bdb78a45a40d24

SHA512
e14327eb95990bf3bbb8b57de4f6834862397bc103a56c91ac371f533afea8ba721f20ce630fa2123dfbbc36c12c7ed13f8c6bb308e9666a1e749cea1cd94871

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
5cce217a73caf3c7fc0d386cee2f74a5

SHA1
28c4b6787cf7092beb013f86ca8e5174abe7bf2a

SHA256
10a0d663897683624e04b0cde4ff1418a3729a0a6faec7517af5964ca487780b

SHA512
70420ec3af5e98573a927df0d2b9fa942dbf89c166490dfb6fbca2495561508db861e4c95ab192731807f38dc8e6bbc666a9f61932a496e7c529c2a496fe4b8f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
ae2c29272b9be944e018ad6b299152d4

SHA1
079dc34eb6e8f1832c7136535cd6347b7eed003b

SHA256
c3f3aabab964e2b22c25a26dd9c4f8967cd81c9c395771939d6cd376680ae664

SHA512
15a94e2bc5b7ae86eaf840f78a2dcf69bf8369f9b93dba2f24e4393ed394a7e5ef39210cdaa33a6ae7b722d086c81fdd2f6d6dc7196b6b9d199ac1e7eca6763a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
2d8d7d9197b62b6ec0eaf9eb7bfe6a0c

SHA1
12cb6fc3587ca6040fc2726ae154f9b1f45fb679

SHA256
f3e18751af36aaacf362a600df869aff8307b05d276e641c121d86b7dc3f4125

SHA512
fa91ee5ed3cb34805670969e91bcf19bcfee645b155ef0cafee05e745d79f8b22c58f76ba68db10901965e184224d3c41c42b7f26f82c943ada11629055b6c75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
aa5c466e3da97cfa44a0bf37abb69082

SHA1
312d4912a7915220d2fe6bd53a1096ab950ae508

SHA256
c3c8453aef9af505505ba37efdc1368edadfe16f3f2b5b40e4b497d3b09305d1

SHA512
b992e8954bce791e120f245a50bf62dce2f7572e02d30d668973c0e8d5c27897c1ba2ae0c6a96ddeb0b0dd7bed726b463d38006a6384281b10b376de6c50ecb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
8428fbbd5abe7be4b4f803afea6bd0a4

SHA1
f9d3785b4029f7bba2803b0bbf6ac6bfd7dc5a8f

SHA256
e4a77c202ba049002ae5181ff289137fb876b2477f1c21ba500be8268ce5ed64

SHA512
6188d6b630f6c7451cf6b3170926c8aa3dd367519398640be310d34e461a3d2b516ef32a53b2918cc3e74876de7c73ad1e8e3f9e2db8896ff4209c0d1fc81619

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
01b2918825af2f3e23780f17698ef8ee

SHA1
162c304479b912968bca96552509f86d3a2f419e

SHA256
074bc4c541e0ef9311dd3cd8e300564d499beae9b863711524d83079cd4ee6e4

SHA512
c8f2b0242be242d93c6875cf8065de9e38d257fab8cbf88483fe6e9d8376881c32be476e133e60bade4d24e3455371f4f74f65fd8fbdc575decdb2bc1e6342a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
f1150d11dd46d8dccf721f3529fd2ac3

SHA1
9a4f794fc2f5cc57bf33539200967e832b1457e4

SHA256
7feba711f4aca60b2e6f47cf7c761c70719354805002e4d1df4e620bed637273

SHA512
b1454ce202587a839a8ff978e9d8e0cebb5c584cced3b57a3e4e0c70f0119fd6702942fd3f35c4bcf4091f528d48ba917cfb0dbe3d1908647b22739e1040450d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
ec7136823f4032ff2fa3fb4fbd0e3709

SHA1
5e7f9cda15ee4b71422593a3b00b14753f4d20db

SHA256
2fd64b57e023a1aaf547fe5338043f9a510ad606d93928e6eac6141b48c89f61

SHA512
9fc1d4fdb12dbf5a4933b818abedf25379dcfa78f089f15911d36526f1916504fa6b35c30ac2a018a09b91fd9c0e0f17943e71a1268069fb95c080a35b190d6b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
56B

MD5
b6f48def1ad0dc727f479ce8ffec8a6b

SHA1
488a3d7c23f20d7c90d9cd3010d31836d67b4028

SHA256
88b9c140ca5cdbc682401e0cd009ef606ef17510c596d69c12b629f720543aec

SHA512
ff657c31fa12c36894ac6002bbc33c3263739b9727aa255687ff9299087d47b2a6b390cd0bb6ce588b992c245e497f5e9178de97bec3c72a2d696160dd9f3a9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5fc368.TMP

Filesize
120B

MD5
afd9be09186c768b9db11718a55b31d9

SHA1
e4a511291b41378b676fa8942c04cf31baadbd7c

SHA256
a83f8657a2b55a624d69e1c4260b08e7f253704d5b7abdc656d98f27d02f3b25

SHA512
4ff88bd15fc14bbf599920bee5fd493433582048efc03222ec486de2a5c0a1c17bf87ac2c3e3aa2263476c0602bc23fd5023692e1ca24e501ba1983931529f4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
277KB

MD5
0e270d4c210ccf6c0ebfbb6bd1c3be1a

SHA1
4e0283729b912521c0140ea11c237c4c23435ae6

SHA256
7eb5e70e8d9de2ba22051148e21cb0015fb55cfb38d82885427ef803529dec1e

SHA512
d14409b726bb83f3463470486e101f79a5aa9918772bb6c98e64b4d193c5d83c1e77e36778d96b39a2fd15cd31dda315b7472a2376ca6c46fcab0d1779ab5bb7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
277KB

MD5
c292cc7239e43e1d10fed99d36321cbe

SHA1
015b74783033fe6c69e82e8bb7f3a683709fa146

SHA256
b44ce0f66fb2ca447cb7eb556050828108c54635ca85d507681f8ca22d52daef

SHA512
3e2e1fa4bd9563efa426911788761e51a51cdf25f26a8ad550bdd3493974b016a81fabfd27f2f85c8386845b37d51de0be6da7ec6ea762326f3b31a789bdf01d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
277KB

MD5
cb0879f33d0b38845c85295cd436d75c

SHA1
766415c97219a9c94251924a3e849cf0317f7815

SHA256
4cfab33ea3a78584565f25330702aa88f077650a9ca7f7221f4f7a08fde62077

SHA512
7ebd3150bb9e8f16e87a50fa599da9b39a36d136179378967df33d0773390b39574819946dfd7632e5d69f1bcb64edbdcbd0fef90864855237b1e27e87a73fbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
277KB

MD5
cfd1e77dd55d679b794141020dbcf26a

SHA1
8a5daf995e05ea2bf29ee021241669b3952c1ea5

SHA256
480d5d7bc5cbb618cb7b2dd73441d630459b6b9b420f132326ee7113e052a25c

SHA512
a5ef1256fc73377900870f81ab5de24939b2162c3a61c8d996c17adc035bc8c961c02da1b3bf3dc4a9036e61625cc1853eb9750fc212821712a0fa8084c1641f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
277KB

MD5
0583f11b312998aefe3d29d103cb5a71

SHA1
4e3946046706070e815ee209ed1826da8fb2f82f

SHA256
642534f50ebc13d657e22e80dc36a40f564a82c9d60f3e6ad57ce0cfb79eeba8

SHA512
de987b78218aae63f20c27d61d0727e3694c01a42c877831381961bc3bcdac62c45ad218d288bebef2a8b12c62073a90b6c60ad7067247ee7c9729d621a1e601

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
89KB

MD5
df535371ebacbb765f2ce13af32c945b

SHA1
a8a1bd019aed40e6c0a5ffc9cd57cc3d35323920

SHA256
66e9ed8f97f898e9e91574cce0863bc248bc1b3f9e0334e3cbe9d20a630df9ed

SHA512
cc293519a9bae5f9fb060bdd6fbd050e54151509b724f28e637aedebd7ce541d42b2f22ec893609c78b9dbe603baf81fc6970372546fc979444d2037449dba49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
104KB

MD5
9fb21a17a0ae348a68c1e0b6c324ccb9

SHA1
406b18672126b06a1090fde40332bf65b470dc75

SHA256
3045468514bbaa23221641ed8371047e8128324a8a1727474cf56a6d075db53e

SHA512
47b48fa97f0f1d4f040d05894a2799948a185787ee1c862a731c322e58ab10c442e1208613929e7286796f35702c114313462082542c04aad7c646540aa9b54f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
108KB

MD5
ddb251d2e1e47f305efbcd65eb3b67c4

SHA1
6ff81858dfe1e8766f8280e512a06d93d2ae4e29

SHA256
8b9a5c6775b1e20d56f6c0292dc8c68cce42aea60f683c8f575047bb66c4b600

SHA512
15b4a7637ae9d97d0ab54a62f596563e54a378869227417db17fdb13195babf3426ef636700bebea84dbeb756dff13f6d04186c1ec19d2978e0abc544e5ab129

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
105KB

MD5
ed34f51e84738f42d362f0b0965c9b36

SHA1
0198d336e9c15bb76836950f6513c82779b6e247

SHA256
7aa374fce129b563cbbb58eaea95bc5bbf3758880a10488e875cc076e33fd79c

SHA512
3c69c0e10c92bbaec9dd195aa115d49c11c86c6ca80ab64db2df60faff61a2a49ac7fdb842b569dc684adf98fb8eec250833dbc7c74533539356b2d0b3d177e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
98KB

MD5
b1782c05155f9e84e834eaa81694e3cd

SHA1
37daa988aeff5cec9b033045f9d546280d2704f3

SHA256
6cdf9e59e59934784c196e0d389c206403effd1748ddd7a48cc1bfc86eedfb17

SHA512
b784e0eb38929d6df1055b050ce4d4b091ecf7b3028966f3b432b94949cb3fe6292710bd75f0f3b5170286f804a2442ffb375425dc63534cbcd51ffda7416d8d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
92KB

MD5
def501f1170f6499a79f63bf4295710a

SHA1
050a5f479d44cbf900bc62248f9d1573ce73ec7a

SHA256
a1ef7d5d2df045cd4068959b8fa6a54c26587a8ab2baafecffc388b054075743

SHA512
049dfc353272c871697b4a8f3d8c13c1b797861e01442128c0d0dcb3d7dcc48df04a9e3f179f572e52db70517bb113c366985de23bfe3477937545bdfac18cf8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58142f.TMP

Filesize
88KB

MD5
e994317009f422b451664737acb87aa1

SHA1
5db561ebe67c683fd773e314f54777cc9db39f8a

SHA256
47af99596ed00a51cf43123fde1584d09ea0e1f8461b9be4d180882fb44c4419

SHA512
6220178a35063be7c451bd0787dd0b266dcc86ee969388211cee65593740c8246afd9280d697f2354a56301dae357117acaa81859d6dc7278f9944bcfc7a06c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b704c9ca0493bd4548ac9c69dc4a4f27

SHA1
a3e5e54e630dabe55ca18a798d9f5681e0620ba7

SHA256
2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411

SHA512
69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
477462b6ad8eaaf8d38f5e3a4daf17b0

SHA1
86174e670c44767c08a39cc2a53c09c318326201

SHA256
e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d

SHA512
a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a2a45d35f60d2668e8d5b73de1895144

SHA1
3357e11b9661728cf2cc7a25bb56e0cb80258d4e

SHA256
5e250132853ab130d482d9b0135c7f281276ebf500b3d96b6d9d28b355aa10f8

SHA512
40f3112c2bf6501753a945c9ff80c9a6d1b879494f81ba2d3baad54eb8d6953a01a9ed7ad182ff834adeb0017130186a3e6689a759db0a51815332c1c8c652de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4b2392ea482718aa19f169e0a18cbc6

SHA1
4b4c0430bf2aefa6500f71deec0774b07f96cce8

SHA256
991e0ea3561cd949d0b4707bd6512b7715ed2512b6d329a7d84f234ecfb9bfe2

SHA512
b74d09bee9026172aa44999d3607fab2c8eb64a593727abb368cba81bd0f35d26ac92634c9a9a03e4e4e9f9874790a52fc34326d31cfc2e4af0e561be45855d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0ecbfbd4-0f03-4670-a2e4-1ce7dc5540b9.tmp

Filesize
6KB

MD5
eb0907868d437aa10495aa1fe0297b72

SHA1
fcaf97bb5006a5b66a742eb3723bc6461bc2c469

SHA256
032086d572d03a0581caf09a4c8fa917fb2ade05640ed32ca0c3f915eac933f3

SHA512
757ce55811a46641af289f9928dbc14d53652e25c8cc50b0abfde3f08d2fbb64872a4a17f5e29e711e704791f339f0894d07cb8f6cbae83fb90ac5da70735606

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4b4969a4-8646-41e9-9ca0-3fefaa991481.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
203KB

MD5
99916ce0720ed460e59d3fbd24d55be2

SHA1
d6bb9106eb65e3b84bfe03d872c931fb27f5a3db

SHA256
07118bf4bbc3ba87d75cbc11ddf427219a14d518436d7f3886d75301f897edaf

SHA512
8d3d52e57806d1850b57bffee12c1a8d9e1a1edcf871b2395df5c889991a183a8d652a0636d5452068f5ef78d37e08ce10b2b2f4e05c3e3c0f2f2230310418a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
df8f2a6998a201aabcfd927f4fd33209

SHA1
23bb95159b2c5b40b51b7a65e42bcdf2c013db11

SHA256
0e7ba586705c5e6b1d3d45b8fe214c3424781a0324c6ae12ed2b4d1b054a37f4

SHA512
b49a00a0a3fe88e86483980ea2ae76f65fcbd8bc3793b9a4193afd5947679d28578935c4c0282fe5648aa4a5ab8eb5efaf3371b79894166a927a0bc11b4f5057

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
b9241a7e17d1e4a014b06b8b293f8e3e

SHA1
2825ec9dd17d96d2a47dea8b25ce68fc3fb361b2

SHA256
e79f53c342acf4db8e22fcdfa82a0e9faceedb0e241d8b2f7eaa96c78af1d40e

SHA512
252b61ea2b2c88a40cc4b10a97e1ed1209b99bebf2fdf5fc66c9d25c9a6c88b44a63fc16f2481f0afa749a4d3f03358106407310b7354840d984d6f833504140

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
8017cc106e95c25b83f888f05a63adb9

SHA1
a0f9a9a432f40b9546972e4d5471d2b4ed505cdc

SHA256
74a9318e27fc8c3950cae3aaad1bfc234b64e76673fcfb784614eb755175326c

SHA512
e9c25ae6e44c25e30c664da561ecaf7a5eded2b12fbb2245d7c0b46e684b9778fab5419e067a47d2b04d7eca04fff32e56468f731e5700b17ae731cc386c5ca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
40dcd5e317bbbd257e9751a182caf246

SHA1
fa0fce16a2f2fdd8adff4767b5884464e111d263

SHA256
1a1bb942808516ee5ef716b801adca1f333080c0a9355de7498ee40abcf97218

SHA512
158f2a8cedc301568063d489e265c49acc208741baeee59e1f4c83285d5d7c90bcadf4ffbb9dc7b64d167f98c92d97e8ed768aa814a7c28e2e6a5a615e73271f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
815B

MD5
0d774e95c32203ef8ff2d0218b9f2921

SHA1
272d966fa0bcb09322df27ca5f5e8df822fb2b83

SHA256
3db4ff064e24be209029d0b4ded3c0b648bbe55e71dc2de239207c7bf02433cf

SHA512
a4490b5da7c1e7272600d5cab80098fb26e57cb4768fc6452ab8d515a2a50ab5e7e9a1dac49461eb31c8e462a70e050d111d999e80386967e6f3aba9e1418340

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0099083ebc58a0fe16b8d13666a54de2

SHA1
9dfdadf69e8c5b108b8454b768b24f9857d63c12

SHA256
b36c19138730a685cfa2c2b251709ee038118d0c5a1db84987957310ed2ce766

SHA512
5298a6a955187d2a4fed7ef9fa21cb6aa69657556ced4f7be0171ce133ea527c100cfe3e4ae0438e7f466bc1f37f6df56fedf8fc4a0aa8a94d8e464a5c732d7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4155cdb6953f524d781c955c3ab50c26

SHA1
f0e83bbb33c659cf708c03a9829b634b19a59995

SHA256
c7105e08dfee55998bbd9dd4f1854b88676d1ddef71da2154b75d463fe7af4c7

SHA512
b705d8631457b75ef485e2bd88c2af9927942fa98537c503df59a6743fe159c850ce14dba8e0048c1603ea5006eb3b52a985ddc3e73507729980548876c92d40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ce140cb30f7ae9d704f2ee776151b65b

SHA1
28fda2026774dabe02d351710c2bb9aa96013f15

SHA256
5f17b0972ff579a58df6a50695e09953e8cf9bcdfc583a145d26b62c8e5603a3

SHA512
25e8d2d9aa33a285988b41ca2de3379c3555f52d355dcabf512d8fdf159382117bcfe8266bc9e0e07aaac56af8c338539104cfe4498be089b8b7b23a50047b5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f4ae91b03c96c364eda6a86f53d1d873

SHA1
35691823cb58f176b4a8d1f1326640aea1adeb37

SHA256
87a919ff33b05f035bdcf9956e8b733c1330bc6a3ffbc979386e8e9ad182f01e

SHA512
d3668b2f397e2a2e2b569d8e62ada8ad6312e24edb539b2ef50f73622d913ef5ca3fd31cfa9009822dfe33fbfd64f801f21fd4d5907dcb29232ffaf1cc6c2287

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7078ac52d7a482df269aaec35adec122

SHA1
dfc68b3b161edcabfa5bcc7084569f10149a3b53

SHA256
273c0712e54dcf53ba57bae1c9a87f4573bf4f6b4e16e410a999f2e6d213c917

SHA512
b12638ec9744a62db92744fcb287b70aee3386fd02386a2d5a85ca3d6ff1e893b75b50626bf702423361b1ff2fa0f009728e14715722a48fe8103d93146573c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a668fea18ff86947f7a0738dc0015161

SHA1
f06f7d256082528a4e0b0526453567f011c0fd25

SHA256
098fc497390182d4eaff5bb90a1ed7e248ef0a07754962253e94daa821aaf185

SHA512
5db358673fbcf8407d7a9a37eb9b5035296eaf1c0a2a6f512b953916aedb4522b55b90a2c12b9d236325456db4ccf7fe95fde17bd3be1f88bf7cb5adf06d7d3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f9d1ed07b66d546d2ccb2ce016f44c89

SHA1
9b892a5d3d8e1b4dc75084a026c33aa6f42476fa

SHA256
c65e5689b5f20033ec7aaaf589ca1c59dd25bf92c69ea5e7b064d31216bb2c50

SHA512
545779c1354622226b8e93f1753cd1b55a42e78cb2bbed9328157ac944766e476be245ca7fc8f2f5a8276b87f0e0fe69e059ff3d65b76ef2a8534905e8128572

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
421b00a450b505c9251dbc5ec80bcfc0

SHA1
b3093b95a93ae33824af42b9d71501466ae72da6

SHA256
f0f74bc083d9505ce472c6aa046f9b285c15ef7c9dcdda53fed8482ba134c19d

SHA512
f35fed4e1b3b3993111d3d8feb02deecd099a094275fb88700bba3e67a93ed120dd6fb8c5b861e8c682a5901e5203e6a1655de3f647571d3442842b99679c2ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6f60c612ee0ad255e5f4fdf3e3f38a67

SHA1
b0ae7b4f82b93087863b98896b282701449cd39d

SHA256
8e0b7651d80d1345204654ed976810d97d5c363e8c9602ec622611ff22897dd7

SHA512
c53da8e0cb7351ef656ae81ad058b127dc9b5a0af06b74fd59d2cbe09dee3d2efbc73919aec3bbddfc601f4e4608a30cdd7f18ae19252c15e6d13fd5e1c8a9b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5f4976.TMP

Filesize
1KB

MD5
f59b8bbe453ec2d77a14cd80a2b2c988

SHA1
c63d08c586db8b741ab193760afa604a248dde1e

SHA256
488b1a5dd385cd4f20ef368f29932409a389b45688c840f977c689281a450c43

SHA512
5349d2fe03305aa0d53d83567d710c6c3f9df6536d038dba1a58db50fbbdb07f2f649ced814243884c18ab26d5c660de8e8b496954636a0b65076f8da01f6911

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5eaaa46e10e8dde7e3bbb5a0bf07c314

SHA1
81319f951df45b7f49b5af0103feb8ad043facab

SHA256
d5302531ef25ba25da525d5b77cf4c90b94e9edaee3af849c8b5a0b6caf6efa8

SHA512
b9ca4e9c8e73a9cf895cc08c2879d9abb5e870fa7bb4f1fe3aff762189785140d7c42da6ead8606216cd96023dc1224686063f58f311d50003da284131fe6c74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
63fab3a450f0883fc9f00a6f4a1f617c

SHA1
c542ce4a241cc895a0341397b8d32c270ba6447c

SHA256
1264d4914837c304afff1daef06b96b5382517d5acd7763d273b34a1ae6c19b4

SHA512
69dfcf77162288a761419259e68356d38002e550c9fca215278ed57fa9dcf73df07f5ec15c1d7283e07864d30e1f9541a76cf481783637013633d40cd9929082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
eb7fe70025b184319c26f6fa45b4e3d9

SHA1
fbdb4063a8706554395a9fcc0711e0bcdec9711b

SHA256
3e2ed262a15b107e17e032b9d15c515f9936aae4d7eb15585465434de8147f2e

SHA512
a2a435317d015021e42fa9eab1af2fa8005264c92a44960cf59c05297b51561b3dbcbda0cf51cacbe2a649a23d87a6654a57ede0ab391fcc27eeaf071bf84064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
eabf5b1ba9680614b27ec914a1b2ce21

SHA1
7b70f6ffe8ae61738799b6d45627de2cc7f7b936

SHA256
e8e876b2e97f783ad3b0e8318768e93d4b808aec99fb17c6b8d776c02c8a5e9e

SHA512
ad67807cd7a789371d1241c2f13225ec174bc2f3ea4f0b5da2ac0f99765ac35aed15c09a1a245f4ee2a99d84088602a5ac9b40fd6eafe85afc1686fe6a9e70c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c05f7d4f8fcb5336af346de3fa5be55f

SHA1
6ea7f236cb7973da6df7b8612c152107efaa28a5

SHA256
6c5d89df1fd6e19eb1313bf93db57dd1529176d58811dd32352fd4a935404e97

SHA512
d55b10ceed880e365aa5c15945ca9233fc5c34642ad34c1fb692828316fb62b9e50ff8b66aefec52f8aa7dcad68f2dbc6bc34e3c8f576b871d75c7560bec489b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bb45f1b9c386dfe78a130f30de31b158

SHA1
ce6bd71b9d17e7d10eb56bb2723518f17d6b8a31

SHA256
a61083a73173b626b39b4f680f53a7afc737d8ae52fb3f6b0e3b8ec346c77307

SHA512
058312df02729d417b7a0fdb34a874121041e6c8908d8606f18fe1a320ffe18b4de3e051a0bdaf29c2fcf0d177bcf6acbe96ac911e9a636e922a5f9d074b91b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\EmieSiteList\container.dat.fun

Filesize
16B

MD5
8ebcc5ca5ac09a09376801ecdd6f3792

SHA1
81187142b138e0245d5d0bc511f7c46c30df3e14

SHA256
619e246fc0ac11320ff9e322a979948d949494b0c18217f4d794e1b398818880

SHA512
cec50bfc6ad2f57f16da99459f40f2d424c6d5691685fa1053284f46c8c8c8a975d7bcb1f3521c4f3fbdc310cf4714e29404aa23be6021e2e267c97b090dc650

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.fun

Filesize
8KB

MD5
f22599af9343cac74a6c5412104d748c

SHA1
e2ac4c57fa38f9d99f3d38c2f6582b4334331df5

SHA256
36537e56d60910ab6aa548e64ca4adafdcabde9d60739013993e12ba061dfd65

SHA512
5c8afc025e1d8342d93b7842dc7ef22eca61085857a80a08ba9b3f156ee3b814606bb32bc244bd525a7913e7915bdf3a86771d39577f4a1176ade04dc381c6d4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{79cdde58-390c-442a-a73b-387be457ad90}\0.1.filtertrie.intermediate.txt.fun

Filesize
16B

MD5
1fd532d45d20d5c86da0196e1af3f59a

SHA1
34adcab9d06e04ea6771fa6c9612b445fe261fab

SHA256
dae6420ea1d7dbe55ab9d32b04270a2b7092a9b6645ed4e87ad2c2da5fdd6bae

SHA512
f778cd0256eda2c1d8724a46f82e18ab760221181f75649e49dd32e9a2558bec0e9c52c5306ad17b18ab60395d83c438742103fe9adddf808e40c3d8384ea0b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{79cdde58-390c-442a-a73b-387be457ad90}\0.2.filtertrie.intermediate.txt.fun

Filesize
16B

MD5
f405f596786198c6260d9c5c2b057999

SHA1
f8f3345eb5abc30606964a460d8eef43d3304076

SHA256
58e3090edb9316d9141065ac654a08169f2833091e6eb3a53b5a774a61b7e30a

SHA512
a0b3573dae218ade265709a6fdee5f7700c9754eb10747de5af34af340ae95909d0a8902159a735e82eb5d7091f50a7997113661a7ec3fcc2b408fb6c78a4c39

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133626156754544810.txt.fun

Filesize
77KB

MD5
8134d2084c399eaff86e4afaaee164d1

SHA1
18aec28569daab54a6fdfabe0a01701c27fa4eb7

SHA256
b28754865c528584756cc3df994772a1f51e62a41e48094437b89798b800b72d

SHA512
663c7722d45da73c04e3a00ed93ea799615acbe34d0745129d8aac32c4ca89603cb994df2cfedbe3d014add7af27e664f252f6ec4413c7e42161b593a7b5490c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133626161888906700.txt.fun

Filesize
48KB

MD5
4f162a341c5623f4f9fb48bde1bd8687

SHA1
3c4f2000b4b73b9e32eb8bc28f2a9b50c06bfef9

SHA256
aaacfbd30fec8f67ef3119075b1ce9e81afc6b7ceffc6e9f55c5fa6fcd13ce46

SHA512
3b6d1146b4a75c5d4def3d80a2981baaaabf016580b0671b65195b555263a05139c2c79b15efa2cfcc24ce3aada0e1c643bec9ef0dc9a12aee454eeeeea8ead8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133626164776283273.txt.fun

Filesize
66KB

MD5
0c4039e2bc1d499f82cc957a90885637

SHA1
01ca3eedaf8d2ea5311722a37755285288b72fac

SHA256
c08e5c75b9dc71a283489dd7e3fd97b55fd5c7a8e1032d1b19ba780f693c39e3

SHA512
27fa753b784246affa1f4e911595503af53a422e5938b481649392c7d8efc1d3ccda19a45d0abad2027298b2dc1f7599dd0bed95c96c9fd05938a978e32d4b6a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133632472397557849.txt.fun

Filesize
77KB

MD5
4df6edae7843a02d67abd54218edbd1e

SHA1
80ad80e781586ebfa9393696840728327d6aa600

SHA256
7c80de0aaa037a8ac65c90f679bd5cd1e2f9c7f943dc82b4dba3cc32ccc4ff35

SHA512
f0e6f51e1a6bdc4aeea60d585513db9fb0b95c27a7f2090f0ba64a87f7cc301fe4fc580f0ead3cf867d83ed01f5cc2938b0082f2c0261950a996eee93c9ec860

Download Submit
C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\e602387055ae7b12c23fbeefeb417682

Filesize
5.8MB

MD5
e602387055ae7b12c23fbeefeb417682

SHA1
4efa866cca9693eafb65a6babfebd64bf99037da

SHA256
8df68686863894e7f47069b854d07d6eb449269f527c09433495efb130f33dde

SHA512
87ee31aaf7929c3ef6ddad322727185efe0702f239d81eeda85ff0bc5c873316a660129aecc3bde5809de1449efd5de0f458db27610d126a69dddf35d38c27f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm4B82.tmp\InstallOptions.dll

Filesize
14KB

MD5
046074d285897c008499f7f3ad5be114

SHA1
159040d616a056ee3498ec86debab58ef5036a55

SHA256
254c5ccbce59ad882f7f51d0bf760cabde8c88c5af84e13cc8ad77ba0361055c

SHA512
ab7436fda44e340dd5909ddec809c6b569a90d888529ef9320375e1aae7af85afcab8c1c1618551d3fe8d6ae727f7dca97aa8781b5555da759d501d2ccd749e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm4B82.tmp\UserInfo.dll

Filesize
4KB

MD5
333fb7dcbcc715bc085b9e93db42035a

SHA1
36366db5ddee12c5aeb8fb93235d8d3e233ab50f

SHA256
4ad013f0d6e3807c786cb25ce2ce602f02e5ec8a1d8d3fba730829fab0798c97

SHA512
8bbf67c64c4ef6b65cbac2563d2979d1dd5e892e7d960c91fe34ff0694500ebd2200f746ad6e541df0438958535ca0f6cc7655ff950fd0290fa45420bdbd2e96

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm4B82.tmp\ioSpecial.ini

Filesize
739B

MD5
5119e13386a44baa8d234526f96e12a7

SHA1
f878c2e26ed903347fe48c6c4e0ad7a72a5d86d8

SHA256
0baf42872c07b62929e63f04af342198e4c333b8f8992364500e2427b993f44c

SHA512
23f6e41b35ab9f283d12954a317ebb54856bf77beba35971a501df459a8b1d78bc167ebea7ff660717d310601f54b4b5f8c8f94b954aae4b63f1d7c3ba7fc28f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

Filesize
7.7MB

MD5
8eb5ce4520e92bd729c99a080fe1ea12

SHA1
4255c7e90d446d46217be97edba59a7f89281ee2

SHA256
98621d6372a62888df79963c44a6381ea7cb1b0c067a070097860fc427bbd705

SHA512
6ad891cfcb4393e4e9212712bfaaf003e3d165f214cda8ef797fd1b71a84d849f44b22e7d7ff92d3e051e89034b18b5aacb1739d1ee80412bbdaa38b6cc9e195

Download Submit
C:\Users\Admin\Downloads\MEMZ-virus-main.zip

Filesize
8KB

MD5
a043dc5c624d091f7c2600dd18b300b7

SHA1
4682f79dabfc6da05441e2b6d820382ff02b4c58

SHA256
0acffde0f952b44d500cf2689d6c9ab87e66ac7fa29a51f3c3e36a43ea5e694a

SHA512
ee4f691a6c7b6c047bca49723b65e5980a8f83cbbc129ddfd578b855430b78acf3d0e461238739cd64c8a5c9071fe132c10da3ac28085fc978b6a19ee1ca3313

Download Submit
C:\Users\Admin\Downloads\Ransomware.Jigsaw.zip

Filesize
239KB

MD5
3ad6374a3558149d09d74e6af72344e3

SHA1
e7be9f22578027fc0b6ddb94c09b245ee8ce1620

SHA256
86a391fe7a237f4f17846c53d71e45820411d1a9a6e0c16f22a11ebc491ff9ff

SHA512
21c21b36be200a195bfa648e228c64e52262b06d19d294446b8a544ff1d81f81eb2af74ddbdebc59915168db5dba76d0f0585e83471801d9ee37e59af0620720

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry.zip.crdownload

Filesize
3.3MB

MD5
efe76bf09daba2c594d2bc173d9b5cf0

SHA1
ba5de52939cb809eae10fdbb7fac47095a9599a7

SHA256
707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a

SHA512
4a1df71925cf2eb49c38f07c6a95bea17752b025f0114c6fd81bc0841c1d1f2965b5dda1469e454b9e8207c2e0dfd3df0959e57166620ccff86eeeb5cf855029

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]

Filesize
933B

MD5
f97d2e6f8d820dbd3b66f21137de4f09

SHA1
596799b75b5d60aa9cd45646f68e9c0bd06df252

SHA256
0e5ece918132a2b1a190906e74becb8e4ced36eec9f9d1c70f5da72ac4c6b92a

SHA512
efda21d83464a6a32fdeef93152ffd32a648130754fdd3635f7ff61cc1664f7fc050900f0f871b0ddd3a3846222bf62ab5df8eed42610a76be66fff5f7b4c4c0

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\TaskData\Tor\tor.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry_Plus.zip

Filesize
2.3MB

MD5
5641d280a62b66943bf2d05a72a972c7

SHA1
c857f1162c316a25eeff6116e249a97b59538585

SHA256
ab14c3f5741c06ad40632447b2fc10662d151afb32066a507aab4ec866ffd488

SHA512
0633bc32fa6d31b4c6f04171002ad5da6bb83571b9766e5c8d81002037b4bc96e86eb059d35cf5ce17a1a75767461ba5ac0a89267c3d0e5ce165719ca2af1752

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 675879.crdownload

Filesize
5.4MB

MD5
a0396f9bb5e0144808cc7c7fda47e682

SHA1
76bef1c55c6f288ca5988d344c4e92ee8f3a6329

SHA256
b5d35eaf2ca4befb5ac6de8680609c9a86fdc257b49d21ce4c8d17eddaa1b51a

SHA512
dd49140d4661d813501d67c44d5fedd6bdc7ce731242fb33973b0b7a5b603344682fe1bc393fcf9fe3f5ad10ed9f1de7dbc42c66ec16b84063fe535f288ab7e0

Download Submit
C:\Users\Default\Desktop\@[email protected]

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
\??\pipe\crashpad_2648_DNYNTVGGFYWYKUWG

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2392-3015-0x000000001AFE0000-0x000000001AFE8000-memory.dmp

Filesize
32KB

Download
memory/5696-1981-0x00007FF8B7A60000-0x00007FF8B7A6B000-memory.dmp

Filesize
44KB

Download
memory/5696-1956-0x00007FF8B7360000-0x00007FF8B7370000-memory.dmp

Filesize
64KB

Download
memory/5696-1957-0x00007FF8B7360000-0x00007FF8B7370000-memory.dmp

Filesize
64KB

Download
memory/5696-1952-0x00007FF8B7340000-0x00007FF8B7350000-memory.dmp

Filesize
64KB

Download
memory/5696-1955-0x00007FF8B7360000-0x00007FF8B7370000-memory.dmp

Filesize
64KB

Download
memory/5696-1941-0x00007FF8B7BC0000-0x00007FF8B7BD0000-memory.dmp

Filesize
64KB

Download
memory/5696-1938-0x00007FF8B7AB0000-0x00007FF8B7AC0000-memory.dmp

Filesize
64KB

Download
memory/5696-1939-0x00007FF8B7AB0000-0x00007FF8B7AC0000-memory.dmp

Filesize
64KB

Download
memory/5696-1940-0x00007FF8B7BC0000-0x00007FF8B7BD0000-memory.dmp

Filesize
64KB

Download
memory/5696-1943-0x00007FF8B7C10000-0x00007FF8B7C40000-memory.dmp

Filesize
192KB

Download
memory/5696-1944-0x00007FF8B7C10000-0x00007FF8B7C40000-memory.dmp

Filesize
192KB

Download
memory/5696-1946-0x00007FF8B7C10000-0x00007FF8B7C40000-memory.dmp

Filesize
192KB

Download
memory/5696-1947-0x00007FF8B7CA0000-0x00007FF8B7CA5000-memory.dmp

Filesize
20KB

Download
memory/5696-1945-0x00007FF8B7C10000-0x00007FF8B7C40000-memory.dmp

Filesize
192KB

Download
memory/5696-1954-0x00007FF8B7360000-0x00007FF8B7370000-memory.dmp

Filesize
64KB

Download
memory/5696-1964-0x00007FF8B5450000-0x00007FF8B5480000-memory.dmp

Filesize
192KB

Download
memory/5696-1967-0x00007FF8B5450000-0x00007FF8B5480000-memory.dmp

Filesize
192KB

Download
memory/5696-1942-0x00007FF8B7C10000-0x00007FF8B7C40000-memory.dmp

Filesize
192KB

Download
memory/5696-2000-0x00007FF8B5940000-0x00007FF8B5967000-memory.dmp

Filesize
156KB

Download
memory/5696-2006-0x00007FF8B7AA0000-0x00007FF8B7AA1000-memory.dmp

Filesize
4KB

Download
memory/5696-2005-0x00007FF8B5970000-0x00007FF8B5992000-memory.dmp

Filesize
136KB

Download
memory/5696-2004-0x00007FF8B5970000-0x00007FF8B5992000-memory.dmp

Filesize
136KB

Download
memory/5696-2003-0x00007FF8B5970000-0x00007FF8B5992000-memory.dmp

Filesize
136KB

Download
memory/5696-2002-0x00007FF8B5970000-0x00007FF8B5992000-memory.dmp

Filesize
136KB

Download
memory/5696-2001-0x00007FF8B5970000-0x00007FF8B5992000-memory.dmp

Filesize
136KB

Download
memory/5696-1998-0x00007FF8B5940000-0x00007FF8B5967000-memory.dmp

Filesize
156KB

Download
memory/5696-1996-0x00007FF8B5940000-0x00007FF8B5967000-memory.dmp

Filesize
156KB

Download
memory/5696-1995-0x00007FF8B5940000-0x00007FF8B5967000-memory.dmp

Filesize
156KB

Download
memory/5696-1994-0x00007FF8B5940000-0x00007FF8B5967000-memory.dmp

Filesize
156KB

Download
memory/5696-1993-0x00007FF8B5AD0000-0x00007FF8B5AF6000-memory.dmp

Filesize
152KB

Download
memory/5696-1992-0x00007FF8B5AD0000-0x00007FF8B5AF6000-memory.dmp

Filesize
152KB

Download
memory/5696-1991-0x00007FF8B5AD0000-0x00007FF8B5AF6000-memory.dmp

Filesize
152KB

Download
memory/5696-1990-0x00007FF8B5AD0000-0x00007FF8B5AF6000-memory.dmp

Filesize
152KB

Download
memory/5696-1989-0x00007FF8B5AD0000-0x00007FF8B5AF6000-memory.dmp

Filesize
152KB

Download
memory/5696-1988-0x00007FF8B5AA0000-0x00007FF8B5AB0000-memory.dmp

Filesize
64KB

Download
memory/5696-1987-0x00007FF8B5AA0000-0x00007FF8B5AB0000-memory.dmp

Filesize
64KB

Download
memory/5696-1986-0x00007FF8B59A0000-0x00007FF8B59B0000-memory.dmp

Filesize
64KB

Download
memory/5696-1985-0x00007FF8B59A0000-0x00007FF8B59B0000-memory.dmp

Filesize
64KB

Download
memory/5696-1999-0x00007FF8B5940000-0x00007FF8B5967000-memory.dmp

Filesize
156KB

Download
memory/5696-1997-0x00007FF8B5940000-0x00007FF8B5967000-memory.dmp

Filesize
156KB

Download
memory/5696-1984-0x00007FF8B7A60000-0x00007FF8B7A6B000-memory.dmp

Filesize
44KB

Download
memory/5696-1983-0x00007FF8B7A60000-0x00007FF8B7A6B000-memory.dmp

Filesize
44KB

Download
memory/5696-1982-0x00007FF8B7A60000-0x00007FF8B7A6B000-memory.dmp

Filesize
44KB

Download
memory/5696-1950-0x00007FF8B72B0000-0x00007FF8B72C0000-memory.dmp

Filesize
64KB

Download
memory/5696-1980-0x00007FF8B7A60000-0x00007FF8B7A6B000-memory.dmp

Filesize
44KB

Download
memory/5696-1979-0x00007FF8B7A40000-0x00007FF8B7A50000-memory.dmp

Filesize
64KB

Download
memory/5696-1978-0x00007FF8B7A40000-0x00007FF8B7A50000-memory.dmp

Filesize
64KB

Download
memory/5696-1977-0x00007FF8B64E0000-0x00007FF8B64EE000-memory.dmp

Filesize
56KB

Download
memory/5696-1976-0x00007FF8B64E0000-0x00007FF8B64EE000-memory.dmp

Filesize
56KB

Download
memory/5696-1975-0x00007FF8B64E0000-0x00007FF8B64EE000-memory.dmp

Filesize
56KB

Download
memory/5696-1974-0x00007FF8B64E0000-0x00007FF8B64EE000-memory.dmp

Filesize
56KB

Download
memory/5696-1973-0x00007FF8B64E0000-0x00007FF8B64EE000-memory.dmp

Filesize
56KB

Download
memory/5696-1972-0x00007FF8B6430000-0x00007FF8B6440000-memory.dmp

Filesize
64KB

Download
memory/5696-1971-0x00007FF8B6430000-0x00007FF8B6440000-memory.dmp

Filesize
64KB

Download
memory/5696-1966-0x00007FF8B5450000-0x00007FF8B5480000-memory.dmp

Filesize
192KB

Download
memory/5696-1965-0x00007FF8B5450000-0x00007FF8B5480000-memory.dmp

Filesize
192KB

Download
memory/5696-1963-0x00007FF8B5450000-0x00007FF8B5480000-memory.dmp

Filesize
192KB

Download
memory/5696-1962-0x00007FF8B52E0000-0x00007FF8B52F0000-memory.dmp

Filesize
64KB

Download
memory/5696-1961-0x00007FF8B52E0000-0x00007FF8B52F0000-memory.dmp

Filesize
64KB

Download
memory/5696-1960-0x00007FF8B51D0000-0x00007FF8B51E0000-memory.dmp

Filesize
64KB

Download
memory/5696-1959-0x00007FF8B51D0000-0x00007FF8B51E0000-memory.dmp

Filesize
64KB

Download
memory/5696-1953-0x00007FF8B7360000-0x00007FF8B7370000-memory.dmp

Filesize
64KB

Download
memory/5696-1951-0x00007FF8B7340000-0x00007FF8B7350000-memory.dmp

Filesize
64KB

Download
memory/5696-1949-0x00007FF8B72B0000-0x00007FF8B72C0000-memory.dmp

Filesize
64KB

Download
memory/5740-3003-0x000000001C620000-0x000000001C6BC000-memory.dmp

Filesize
624KB

Download
memory/5740-3002-0x000000001C0B0000-0x000000001C57E000-memory.dmp

Filesize
4.8MB

Download
memory/5740-3001-0x000000001BAB0000-0x000000001BAE8000-memory.dmp

Filesize
224KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads