wannacry | a251b542f8d816aa389009d8e1cb059d35c5553387362a07b030161b076432b3

Resubmissions

21-07-2024 01:22

240721-brplzascqc 10

21-07-2024 01:15

240721-bmp2yascma 10

21-07-2024 00:51

240721-a7f44asamb 3

Analysis

max time kernel
542s
max time network
544s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 01:22

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

.gitignore
Size

13B
MD5

8de70a2cb48504f474cccade2cc3d20b
SHA1

7cfe378309941545d80f7d6a20348294e02ed9a4
SHA256

a251b542f8d816aa389009d8e1cb059d35c5553387362a07b030161b076432b3
SHA512

221747e0b98083359980b6ec9659703659a2d78715e6d0fdf089e63487c88811352702c9656128238bda8c378cf6bdb713b683b6cf92257db31b375f83de9bf0

Score

10^/10

wannacry defense_evasion evasion execution impact persistence privilege_escalation ransomware spyware stealer trojan worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

RedEye.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	RedEye.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	RedEye.exe

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

RedEye.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RedEye.exe
Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RedEye.exe

Disables RegEdit via registry modification 2 IoCs

evasion

Processes:

RedEye.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	RedEye.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	RedEye.exe

Disables Task Manager via registry modification
evasion
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490
Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

RedEye.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.com	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro_x64.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iExplore64.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill64.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned64.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.scr\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro_x64.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZAM.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill64.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.scr	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mb3-setup-1878.1878-3.3.1.2183.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwCleaner.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.scr	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.scr\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe	RedEye.exe

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

NetSh.exe

pid process

5056 NetSh.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

RedEye.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation RedEye.exe

pid	process
5056	NetSh.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	RedEye.exe

Drops startup file 2 IoCs

Processes:

WannaCry.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDEF87.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDEF9E.tmp	WannaCry.exe

Executes dropped EXE 13 IoCs

Processes:

SafeMEMZ.exedotNetFx45_Full_setup.exeSetup.exeSafeMEMZ.exeWannaCry.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exeRedEye.exe

pid	process
5600	SafeMEMZ.exe
3300	dotNetFx45_Full_setup.exe
2988	Setup.exe
5276	SafeMEMZ.exe
1456	WannaCry.exe
628	!WannaDecryptor!.exe
4448	!WannaDecryptor!.exe
544	!WannaDecryptor!.exe
5732	!WannaDecryptor!.exe
1056	!WannaDecryptor!.exe
5480	!WannaDecryptor!.exe
5556	!WannaDecryptor!.exe
5452	RedEye.exe

Loads dropped DLL 5 IoCs

Processes:

Setup.exe

pid process

2988 Setup.exe
2988 Setup.exe
2988 Setup.exe
2988 Setup.exe
2988 Setup.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2988	Setup.exe
2988	Setup.exe
2988	Setup.exe
2988	Setup.exe
2988	Setup.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

WannaCry.exeRedEye.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r"	WannaCry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\Downloads\\RedEye.exe"	RedEye.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\Downloads\\RedEye.exe"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\Downloads\\RedEye.exe"	RedEye.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

RedEye.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RedEye.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

220 raw.githubusercontent.com
221 raw.githubusercontent.com
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Processes:

RedEye.exe

description ioc process

File created C:\autorun.inf RedEye.exe
File opened for modification C:\autorun.inf RedEye.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RedEye.exe

flow	ioc
220	raw.githubusercontent.com
221	raw.githubusercontent.com

description	ioc	process
File created	C:\autorun.inf	RedEye.exe
File opened for modification	C:\autorun.inf	RedEye.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

RedEye.exe!WannaDecryptor!.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\Desktop\WallPaper = "C:\\redeyebmp.bmp"	RedEye.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Drops file in Windows directory 1 IoCs

Processes:

RedEye.exe

description ioc process

File created C:\Windows\Nope.txt RedEye.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Nope.txt	RedEye.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

NetSh.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exevssadmin.exevssadmin.exe

pid process

2376 vssadmin.exe
2448 vssadmin.exe
628 vssadmin.exe
Kills process with taskkill 4 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

5672 taskkill.exe
3592 taskkill.exe
4416 taskkill.exe
4752 taskkill.exe

pid	process
2376	vssadmin.exe
2448	vssadmin.exe
628	vssadmin.exe

pid	process
5672	taskkill.exe
3592	taskkill.exe
4416	taskkill.exe
4752	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "70"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe

Modifies registry class 4 IoCs

Processes:

OpenWith.exemsedge.exemsedge.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-464762018-485119342-1613148473-1000\{9F8626A1-4B8D-4CB4-9DA3-97EFA40C2E8B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings	cmd.exe

NTFS ADS 6 IoCs

Processes:

msedge.exeRedEye.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 766248.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 55526.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 350404.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 194474.crdownload:SmartScreen	msedge.exe
File created	C:\windows.exe\:SmartScreen:$DATA	RedEye.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 488181.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exeSetup.exemsedge.exemsedge.exemsedge.exeRedEye.exe

pid	process
3416	msedge.exe
3416	msedge.exe
1908	msedge.exe
1908	msedge.exe
2800	identity_helper.exe
2800	identity_helper.exe
5104	msedge.exe
5104	msedge.exe
5360	msedge.exe
5360	msedge.exe
2332	msedge.exe
2332	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
2136	msedge.exe
2136	msedge.exe
2988	Setup.exe
2988	Setup.exe
2988	Setup.exe
2988	Setup.exe
2988	Setup.exe
2988	Setup.exe
2988	Setup.exe
2988	Setup.exe
4228	msedge.exe
4228	msedge.exe
5104	msedge.exe
5104	msedge.exe
4976	msedge.exe
4976	msedge.exe
5452	RedEye.exe
5452	RedEye.exe
5452	RedEye.exe
5452	RedEye.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs

Processes:

msedge.exe

pid	process
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exeWMIC.exevssvc.exeRedEye.exeshutdown.exe

description	pid	process
Token: SeDebugPrivilege	4416	taskkill.exe
Token: SeDebugPrivilege	5672	taskkill.exe
Token: SeDebugPrivilege	3592	taskkill.exe
Token: SeDebugPrivilege	4752	taskkill.exe
Token: SeIncreaseQuotaPrivilege	3952	WMIC.exe
Token: SeSecurityPrivilege	3952	WMIC.exe
Token: SeTakeOwnershipPrivilege	3952	WMIC.exe
Token: SeLoadDriverPrivilege	3952	WMIC.exe
Token: SeSystemProfilePrivilege	3952	WMIC.exe
Token: SeSystemtimePrivilege	3952	WMIC.exe
Token: SeProfSingleProcessPrivilege	3952	WMIC.exe
Token: SeIncBasePriorityPrivilege	3952	WMIC.exe
Token: SeCreatePagefilePrivilege	3952	WMIC.exe
Token: SeBackupPrivilege	3952	WMIC.exe
Token: SeRestorePrivilege	3952	WMIC.exe
Token: SeShutdownPrivilege	3952	WMIC.exe
Token: SeDebugPrivilege	3952	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3952	WMIC.exe
Token: SeRemoteShutdownPrivilege	3952	WMIC.exe
Token: SeUndockPrivilege	3952	WMIC.exe
Token: SeManageVolumePrivilege	3952	WMIC.exe
Token: 33	3952	WMIC.exe
Token: 34	3952	WMIC.exe
Token: 35	3952	WMIC.exe
Token: 36	3952	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3952	WMIC.exe
Token: SeSecurityPrivilege	3952	WMIC.exe
Token: SeTakeOwnershipPrivilege	3952	WMIC.exe
Token: SeLoadDriverPrivilege	3952	WMIC.exe
Token: SeSystemProfilePrivilege	3952	WMIC.exe
Token: SeSystemtimePrivilege	3952	WMIC.exe
Token: SeProfSingleProcessPrivilege	3952	WMIC.exe
Token: SeIncBasePriorityPrivilege	3952	WMIC.exe
Token: SeCreatePagefilePrivilege	3952	WMIC.exe
Token: SeBackupPrivilege	3952	WMIC.exe
Token: SeRestorePrivilege	3952	WMIC.exe
Token: SeShutdownPrivilege	3952	WMIC.exe
Token: SeDebugPrivilege	3952	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3952	WMIC.exe
Token: SeRemoteShutdownPrivilege	3952	WMIC.exe
Token: SeUndockPrivilege	3952	WMIC.exe
Token: SeManageVolumePrivilege	3952	WMIC.exe
Token: 33	3952	WMIC.exe
Token: 34	3952	WMIC.exe
Token: 35	3952	WMIC.exe
Token: 36	3952	WMIC.exe
Token: SeBackupPrivilege	2828	vssvc.exe
Token: SeRestorePrivilege	2828	vssvc.exe
Token: SeAuditPrivilege	2828	vssvc.exe
Token: SeDebugPrivilege	5452	RedEye.exe
Token: SeShutdownPrivilege	2964	shutdown.exe
Token: SeRemoteShutdownPrivilege	2964	shutdown.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

Processes:

msedge.exe

pid	process
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

OpenWith.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exeLogonUI.exe

pid	process
2440	OpenWith.exe
628	!WannaDecryptor!.exe
628	!WannaDecryptor!.exe
4448	!WannaDecryptor!.exe
4448	!WannaDecryptor!.exe
544	!WannaDecryptor!.exe
544	!WannaDecryptor!.exe
5732	!WannaDecryptor!.exe
5732	!WannaDecryptor!.exe
1056	!WannaDecryptor!.exe
5480	!WannaDecryptor!.exe
5556	!WannaDecryptor!.exe
4960	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1908 wrote to memory of 3748	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3748	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 1896	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3416	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3416	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3448	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3448	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3448	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3448	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3448	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3448	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3448	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3448	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3448	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3448	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3448	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3448	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3448	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3448	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3448	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3448	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3448	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3448	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3448	1908	msedge.exe	msedge.exe
PID 1908 wrote to memory of 3448	1908	msedge.exe	msedge.exe

System policy modification 1 TTPs 11 IoCs

evasion

Modify Registry

T1112

Processes:

RedEye.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	RedEye.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "4"	RedEye.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	RedEye.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	RedEye.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RedEye.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	RedEye.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	RedEye.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WindowsDefenderMAJ = "1"	RedEye.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	RedEye.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\.gitignore
1⤵
- Modifies registry class
PID:4316

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe908946f8,0x7ffe90894708,0x7ffe90894718
2⤵
PID:3748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
2⤵
PID:1896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
2⤵
PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
2⤵
PID:1644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
2⤵
PID:2940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
2⤵
PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
2⤵
PID:748

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4352 /prefetch:8
2⤵
PID:2328

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4352 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
2⤵
PID:1068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
2⤵
PID:2328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5312 /prefetch:8
2⤵
PID:1912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5440 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
2⤵
PID:2556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
2⤵
PID:3152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
2⤵
PID:5144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
2⤵
PID:5620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
2⤵
PID:5628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
2⤵
PID:5976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
2⤵
PID:5984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5552 /prefetch:8
2⤵
PID:2556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
2⤵
PID:5332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6396 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
2⤵
PID:5760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
2⤵
PID:5312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:1
2⤵
PID:5176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
2⤵
PID:5452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:1
2⤵
PID:4044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4344 /prefetch:1
2⤵
PID:964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6040 /prefetch:8
2⤵
PID:4076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5592 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2260 /prefetch:1
2⤵
PID:1064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
2⤵
PID:5436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
2⤵
PID:380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1084 /prefetch:1
2⤵
PID:2460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:1
2⤵
PID:416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1780 /prefetch:1
2⤵
PID:1528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:1
2⤵
PID:5948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3656 /prefetch:8
2⤵
PID:5856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2136

C:\Users\Admin\Downloads\dotNetFx45_Full_setup.exe
"C:\Users\Admin\Downloads\dotNetFx45_Full_setup.exe"
2⤵
- Executes dropped EXE
PID:3300

C:\3e698a1cb52894c52e8f74df7a9d53\Setup.exe
C:\3e698a1cb52894c52e8f74df7a9d53\\Setup.exe /x86 /x64 /web
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2988

C:\Users\Admin\Downloads\SafeMEMZ.exe
"C:\Users\Admin\Downloads\SafeMEMZ.exe"
2⤵
- Executes dropped EXE
PID:5276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7312 /prefetch:1
2⤵
PID:2848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
2⤵
PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7288 /prefetch:1
2⤵
PID:5164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
2⤵
PID:5044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
2⤵
PID:2332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7824 /prefetch:1
2⤵
PID:1016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8172 /prefetch:8
2⤵
PID:1632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7860 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8104 /prefetch:1
2⤵
PID:6108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8156 /prefetch:8
2⤵
PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7248 /prefetch:1
2⤵
PID:3004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8124 /prefetch:8
2⤵
PID:6020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,529762157998377066,7019362842501641919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7244 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4488

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2524

C:\Users\Admin\Downloads\SafeMEMZ.exe
"C:\Users\Admin\Downloads\SafeMEMZ.exe"
1⤵
- Executes dropped EXE
PID:5600

C:\Users\Admin\Downloads\WannaCry.exe
"C:\Users\Admin\Downloads\WannaCry.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
PID:1456

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 47371721525363.bat
2⤵
PID:3148

C:\Windows\SysWOW64\cscript.exe
cscript //nologo c.vbs
3⤵
PID:5136

C:\Users\Admin\Downloads\!WannaDecryptor!.exe
!WannaDecryptor!.exe f
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:628

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im MSExchange*
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5672

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Microsoft.Exchange.*
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlserver.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4416

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlwriter.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4752

C:\Users\Admin\Downloads\!WannaDecryptor!.exe
!WannaDecryptor!.exe c
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4448

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b !WannaDecryptor!.exe v
2⤵
PID:1320

C:\Users\Admin\Downloads\!WannaDecryptor!.exe
!WannaDecryptor!.exe v
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:544

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
4⤵
PID:4980

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3952

C:\Users\Admin\Downloads\!WannaDecryptor!.exe
!WannaDecryptor!.exe
2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:5732

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2828

C:\Users\Admin\Downloads\!WannaDecryptor!.exe
"C:\Users\Admin\Downloads\!WannaDecryptor!.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1056

C:\Users\Admin\Downloads\!WannaDecryptor!.exe
"C:\Users\Admin\Downloads\!WannaDecryptor!.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5480

C:\Users\Admin\Downloads\!WannaDecryptor!.exe
"C:\Users\Admin\Downloads\!WannaDecryptor!.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5556

C:\Users\Admin\Downloads\RedEye.exe
"C:\Users\Admin\Downloads\RedEye.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Disables RegEdit via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:5452

C:\Windows\SYSTEM32\vssadmin.exe
vssadmin delete shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:628

C:\Windows\SYSTEM32\vssadmin.exe
vssadmin delete shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:2376

C:\Windows\SYSTEM32\vssadmin.exe
vssadmin delete shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:2448

C:\Windows\SYSTEM32\NetSh.exe
NetSh Advfirewall set allprofiles state off
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5056

C:\Windows\System32\shutdown.exe
"C:\Windows\System32\shutdown.exe" -r -t 00 -f
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2964

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38d6055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\3e698a1cb52894c52e8f74df7a9d53\1025\LocalizedData.xml

Filesize
49KB

MD5
d84db0827e0f455f607ef501108557d0

SHA1
d275924654f617ddaf01b032cf0bf26374fc6cd5

SHA256
a8d9fd3c7ebb7fee5adb3cafe6190131cebfcbeff7f0046a428c243f78eac559

SHA512
1b08115a4ea03217ce7a4d365899bd311a60490b7271db209d1e5979a612d95c853be33d895570e0fb0414ab16eb8fd822fe4e3396019a9edd0d0c7ff9e57232

Download Submit
C:\3e698a1cb52894c52e8f74df7a9d53\1028\LocalizedData.xml

Filesize
41KB

MD5
ff41100cc12e45a327d670652f0d6b87

SHA1
cb53d671cb66d28b6eb7247a1a0c70a114d07e6b

SHA256
ef3de7ab3d80a4d2865b9e191d2311112b4870103d383ae21882f251bbde7f0a

SHA512
f8a2f8db5957a43aa82bd7d193b2ff2a151bba6a9d0ad2d39e120909a0f8939123b389ebb4244a417f9e4d8e46629c49ac193c320231cb614253612af45281a8

Download Submit
C:\3e698a1cb52894c52e8f74df7a9d53\1029\LocalizedData.xml

Filesize
53KB

MD5
51130f3479df72fe12b05a7aba1891d3

SHA1
fbaf9c0269d532a3ce00d725cd40772bc0ad8f09

SHA256
8845d0f0fadfdf51b540d389bbb0a8a9655cf65055e55dcd54fa655576dd70a1

SHA512
b641e22b81babbde85a6f324851d35f47bd769fc0cff74911010ae620cf682f9c7bc4d946d2f80a46a9851f3cc912625991c8a3876f1d958ea4d49d8791d1815

Download Submit
C:\3e698a1cb52894c52e8f74df7a9d53\1030\LocalizedData.xml

Filesize
52KB

MD5
53aa67d27c43a35c6f61552ee9865f55

SHA1
504035de2fe6432d54bc69f0d126516f363e1905

SHA256
5d08b297b867179d8d2ec861dbf7e1dfdb283573430a55644e134ee39083157a

SHA512
7a284076f6f204e5be41eab3c3abb1983fbbc21669130cc7e6961a7b858f30caf83fbcb2ef44cfe712341ab664347df29d58b650f004608b015e61e4f5d4f47b

Download Submit
C:\3e698a1cb52894c52e8f74df7a9d53\1031\LocalizedData.xml

Filesize
55KB

MD5
f8e3a846d4aca062413094f1d953075e

SHA1
09f2aa5b5ef693051862965c7c1063d31623f433

SHA256
5a929328125673d922e7f969769b003f5cb6942daa92818a384d50ac755174c2

SHA512
95fead89ac87c700615deef0b5c75aa818172cb387fb5e7178d0a96adb4a60abe86c3793f1174ad27b3a12fe29a371682a032d83d2c63f50a223e37a9d5fc7c6

Download Submit
C:\3e698a1cb52894c52e8f74df7a9d53\1032\LocalizedData.xml

Filesize
56KB

MD5
8ecac4ca4cc3405929b06872e3f78e99

SHA1
805250d3aa16183dc2801558172633f718a839c4

SHA256
b9e9740a1f29eeaf213e1e0e01f189b6be1d8d44a2ab6df746eebe9cb772f588

SHA512
6f681c35a38a822f4747d6d2bcacefc49a07c9ca28a6b8eed38b8d760327419b5b469698bed37366c2480a4f118d4d36c6ae0f3c645f185e39a90ff26e749062

Download Submit
C:\3e698a1cb52894c52e8f74df7a9d53\1033\LocalizedData.xml

Filesize
51KB

MD5
24fde6338ea1a937945c3feb0b7b2281

SHA1
6b8b437cd3692207e891e205c246f64e3d81fdd5

SHA256
63d37577f760339ed4e40dc699308b25217ce678ce0be50c5f9ce540bb08e0a7

SHA512
9a51c7057de4f2ec607bb9820999c676c01c9baf49524011bb5669225d80154119757e8eb92d1952832a6cb20ea0e7da192b4b9ddf813fa4c2780200b3d7ba67

Download Submit
C:\3e698a1cb52894c52e8f74df7a9d53\1035\LocalizedData.xml

Filesize
52KB

MD5
de5ccb392face873eae6abc827d2d3a7

SHA1
50eab784e31d1462a6e760f39751e7e238ba46a2

SHA256
6638228cb95fc08eebc9026a2978d5c68852255571941a3828d9948251ca087d

SHA512
b615a69b49404d97ce0459412fbd53415dfbc1792ed95c1f1bd30f963790f3f219e028f559706e8b197ce0223a2c2d9f2e1cac7e3b50372ebef0d050100c6d10

Download Submit
C:\3e698a1cb52894c52e8f74df7a9d53\1036\LocalizedData.xml

Filesize
55KB

MD5
75bf2db655ca2442ae41495e158149c9

SHA1
514a48371362dfa2033ba99ecab80727f7e4b0ee

SHA256
1938c4ffedfbb7fea0636238abb7f8a8db53db62537437ff1ec0e12dca2abfab

SHA512
1b697d0621f47bb66d45ae85183a02ec78dd2b6458ef2b0897d5bbbd2892e15eaf90384bc351800b5d00cb0c3682db234fac2a75214d8ade4748fc100b1c85b2

Download Submit
C:\3e698a1cb52894c52e8f74df7a9d53\1037\LocalizedData.xml

Filesize
48KB

MD5
94f3480d829cee3470d2ba1046f2f613

SHA1
9a8ffc781afb5f087b39abe82c11e20d3e08b4f3

SHA256
eceb759e0f06e5d4f30bc8a982f099c6c268cff4a1459222da794d639c74f97f

SHA512
436d52da9c6c853616cf088c83b55032e491d6d76eeca0bf0cb40b7a84383a1fcffcb8ac0793cdea6af04d02acf5c1654d6b9461506ee704d95a9469581e8eaf

Download Submit
C:\3e698a1cb52894c52e8f74df7a9d53\1038\LocalizedData.xml

Filesize
54KB

MD5
818e35b3eb2e23785decef4e58d74433

SHA1
41b43d0b3f81a3a294aa941279a96f0764761547

SHA256
3d8b2c8079cf8117340a8fc363dceb9be102d6eb1a72881b0c43e1e4b934303e

SHA512
98ae09da1be0ebe609d0e11d868258ab322cdc631e3105296c8ce243d821b415f3c487cbb4cd366bb4bdb7f0f9447a25836e53320b424a9ff817cac728ff4ae2

Download Submit
C:\3e698a1cb52894c52e8f74df7a9d53\DHTMLHeader.html

Filesize
15KB

MD5
cd131d41791a543cc6f6ed1ea5bd257c

SHA1
f42a2708a0b42a13530d26515274d1fcdbfe8490

SHA256
e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb

SHA512
a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a

Download Submit
C:\3e698a1cb52894c52e8f74df7a9d53\ParameterInfo.xml

Filesize
731KB

MD5
4925613d29bc7350130c7076e4c92c1c

SHA1
2821351d3be08f982431ba789f034b9f028ca922

SHA256
9157a0afe34576dfea4ba64db5737867742b4e9346a1f2c149b98b6805d45e31

SHA512
3e69650e4101a14ef69f94fa54b02d8d305039165a0bffc519b3cf96f2dcbcf46845e4669d29ccc5ceb887b2f95fc4756265b19d5c17aa176d3d6dc53ed83f77

Download Submit
C:\3e698a1cb52894c52e8f74df7a9d53\Setup.exe

Filesize
85KB

MD5
8b3ecf4d59a85dae0960d3175865a06d

SHA1
fc81227ec438adc3f23e03a229a263d26bcf9092

SHA256
2b088aefcc76d0baa0bff0843bf458db27bacc47a8e698c9948e53ffc471828b

SHA512
a58a056a3a5814a13153b4c594ed72796b4598f8e715771fc31e60c60a2e26250768b8f36b18675b91e7ecc777ef27c7554f7a0e92c2dfaba74531e669c38263

Download Submit
C:\3e698a1cb52894c52e8f74df7a9d53\SetupEngine.dll

Filesize
868KB

MD5
43bc7b5dfd2e45751d6d2ca7274063e4

SHA1
a8955033d0e94d33114a1205fe7038c6ae2f54f1

SHA256
a11af883273ddbd24bfed4a240c43f41ce3d8c7962ec970da2d4c7e13b563d04

SHA512
3f3068e660fea932e91e4d141d8202466b72447107ff43f90dea9557fc188696617025531220bc113dc19fdd7adf313a47ac5f2a4ce94c65f9aeb2d7deda7f36

Download Submit
C:\3e698a1cb52894c52e8f74df7a9d53\SplashScreen.bmp

Filesize
40KB

MD5
0966fcd5a4ab0ddf71f46c01eff3cdd5

SHA1
8f4554f079edad23bcd1096e6501a61cf1f8ec34

SHA256
31c13ecfc0eb27f34036fb65cc0e735cd444eec75376eea2642f926ac162dcb3

SHA512
a9e70a2fb5a9899acf086474d71d0e180e2234c40e68bcadb9bf4fe145774680cb55584b39fe53cc75de445c6bf5741fc9b15b18385cbbe20fc595fe0ff86fce

Download Submit
C:\3e698a1cb52894c52e8f74df7a9d53\UiInfo.xml

Filesize
37KB

MD5
d8f565bd1492ef4a7c4bc26a641cd1ea

SHA1
d4c9c49b47be132944288855dc61dbf8539ec876

SHA256
6a0e20df2075c9a58b870233509321372e283ccccc6afaa886e12ba377546e64

SHA512
ecf57cc6f3f8c4b677246a451ad71835438d587fadc12d95ef1605eb9287b120068938576da95c10edc6d1d033b5968333a5f8b25ce97ecd347a42716cd2a102

Download Submit
C:\3e698a1cb52894c52e8f74df7a9d53\sqmapi.dll

Filesize
191KB

MD5
d475bbd6fef8db2dde0da7ccfd2c9042

SHA1
80887bdb64335762a3b1d78f7365c4ee9cfaeab5

SHA256
8e9d77a216d8dd2be2b304e60edf85ce825309e67262fcff1891aede63909599

SHA512
f760e02d4d336ac384a0125291b9deac88c24f457271be686b6d817f01ea046d286c73deddbf0476dcc2ade3b3f5329563abd8f2f1e40aee817fee1e3766d008

Download Submit
C:\Recovery\WindowsRE\!WannaDecryptor!.exe.lnk

Filesize
590B

MD5
9b8a8404fa01b8cd48f509076f29f182

SHA1
7a592c7a5ef5914d596db65302f543f74542d428

SHA256
3603b032b7218e64d5ab6ff7e5fdb752643b3c25652e27ecba759868563a80ed

SHA512
aeb687b8f208bf2287f3b21284abe8c9f9b420bd542b745e75770426f89e5e17c5b4f46953901d8c95af52e010d50626d450a93f25d685d8ac560f3c7c2590a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\684dabc9-2e0d-42f7-99f3-6ff8d049d6d8.tmp

Filesize
12KB

MD5
ec73c3f4fd8ca48f524732fb551c203a

SHA1
5d1588773e3b5a2e02d8df7cd4f6379e47f1feb6

SHA256
f40837b847eb19fe0f8180b5a844afcb87a9357a74a489f60ce44420105c75ba

SHA512
d0f2063efb64fcbe5e732ffac4587f1942d5839932d3014d652c378ba3252e2bc3b39dac3860dd841b3b22a52e11b259e3674c17a512c606d4ff7d7e6d391c14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04b60a51907d399f3685e03094b603cb

SHA1
228d18888782f4e66ca207c1a073560e0a4cc6e7

SHA256
87a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3

SHA512
2a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9622e603d436ca747f3a4407a6ca952e

SHA1
297d9aed5337a8a7290ea436b61458c372b1d497

SHA256
ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261

SHA512
f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
200KB

MD5
1aa60f893a3cb60f0b1b4eb4cacf7219

SHA1
1d3381368bdeb83fdec169c252ef703026312df5

SHA256
ea7bd91021692beb463fab790f95fe70aa57fe75a8d7e89811479fafbbc72927

SHA512
1c617dc4ea458b127edd40132f3b9d36cfffce1ff64466b695b9dc84e9ae35614eca2564fa0f89bd66dafcc87e81fd460f318dc60a30f017e4614ce9154319bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
1d9097f6fd8365c7ed19f621246587eb

SHA1
937676f80fd908adc63adb3deb7d0bf4b64ad30e

SHA256
a9dc0d556e1592de2aeef8eed47d099481cfb7f37ea3bf1736df764704f39ddf

SHA512
251bf8a2baf71cde89873b26ee77fe89586daf2a2a913bd8383b1b4eca391fdd28aea6396de3fdff029c6d188bf9bb5f169954e5445da2933664e70acd79f4e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
41KB

MD5
78b45f66500680832e342e6fb8f0c7a0

SHA1
457528aace12ab0b6487a490d7b8a6adb13dc8f0

SHA256
5cb9b5d3fb0be382aa00936369c7589c938a438c3942c9883072dee465458c00

SHA512
6c1aad5408b7c02a828596f5030fdd310b78b79dffdf3b3dd997aa26802b55026bc18d7fff44a0e3fadef8087b43964262a9894fd4fc06de1b229bbc6d3b2b1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1.2MB

MD5
931d16be2adb03f2d5df4d249405d6e6

SHA1
7b7076fb55367b6c0b34667b54540aa722e2f55f

SHA256
b6aa0f7290e59637a70586303507208aca637b63f77b5ce1795dfe9b6a248ff3

SHA512
41d44eafc7ade079fc52553bc792dace0c3ed6ee0c30430b876b159868010b8676c5302790d49bed75fa7daa158d4285e236a4be3d13f51ff244c68ca6a479ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
43KB

MD5
209af4da7e0c3b2a6471a968ba1fc992

SHA1
2240c2da3eba4f30b0c3ef2205ce7848ecff9e3f

SHA256
ecc145203f1c562cae7b733a807e9333c51d75726905a3af898154f3cefc9403

SHA512
09201e377e80a3d03616ff394d836c85712f39b65a3138924d62a1f3ede3eac192f1345761c012b0045393c501d48b5a774aeda7ab5d687e1d7971440dc1fc35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
74KB

MD5
b07f576446fc2d6b9923828d656cadff

SHA1
35b2a39b66c3de60e7ec273bdf5e71a7c1f4b103

SHA256
d261915939a3b9c6e9b877d3a71a3783ed5504d3492ef3f64e0cb508fee59496

SHA512
7358cbb9ddd472a97240bd43e9cc4f659ff0f24bf7c2b39c608f8d4832da001a95e21764160c8c66efd107c55ff1666a48ecc1ad4a0d72f995c0301325e1b1df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
37KB

MD5
f9a90d58144602c12373f3a51ae11c3e

SHA1
50930fadc719a0cf689f480f053fe55eaab64817

SHA256
477adbd55274ba5f7057f114fd4c4908fe46d7f486c7cd6dfe452a80ff0b7c82

SHA512
0f06561a943bdafdc0f6355ce4a5dd2a3daa348d621ac8c0d95632d5bf0458b4068803af0f3e9819496ed750299a63e6eea88c53bd2816c757a0e4c721d7e4f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
17KB

MD5
d7580dce32412dc9d53e8911beeac7e4

SHA1
fb93b2d7546f30ded645e40c4ad2ae962bced731

SHA256
136b2c40697b50198694dcf1ccae005f9a5dcd15b3d67bb48745df477a49df06

SHA512
2440ddd41e5d17fae4ff5e261d2d4694937f27d94292f1424c398585471f71cd20131f2babdf3332176ca2aa191bde920aeadb15705843fed3d4183fbfbe6e43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
37KB

MD5
f379276efec34127fed6f06101a024d3

SHA1
279e8e9dc86c622343e5bba17043d893c9224086

SHA256
1f92cc266344c34ab3ba73fd7107c0b7d53de896e47f3683c9e7ea4b1e74b8cf

SHA512
a87e994179341eedf39393fd4b7a57e8ac341f43bcd846c3bc16da9632921c08566be9ccb1b3afc0a1b9a9152c6a1339bff584401aaeb7f1cff7a36af66db5a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
25KB

MD5
6f0d8c2d86b40b21934ff819a3961667

SHA1
2e411280d2191d0f9732fe01ebc522aa87363b34

SHA256
8ef59cad09decea1d3b42a9ddd4a9b25a6c7d7bdac03d0621b4bef1448276c88

SHA512
b9406b8e4f3ca0fb1a45d3ce677d12a84c83c9c1039be109b0002c4a42435d68107cacaec2e07474b7e9d48e6e00df1734e33d1b18d6aac7a604ea6500e01024

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
20KB

MD5
0f3de113dc536643a187f641efae47f4

SHA1
729e48891d13fb7581697f5fee8175f60519615e

SHA256
9bef33945e76bc0012cdbd9941eab34f9472aca8e0ddbbaea52658423dc579f8

SHA512
8332bf7bd97ec1ebfc8e7fcf75132ca3f6dfd820863f2559ab22ac867aa882921f2b208ab76a6deb2e6fa2907bb0244851023af6c9960a77d3ad4101b314797f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
21KB

MD5
1d360b4556cb737bc22f87dc83cdec12

SHA1
2401ae1c316e52652ec9a309d5db2e0801ec4bd1

SHA256
5bc8f420585a110767d782fc3bc079c38cbbde4cae27e7c9ee0f4316e2c75805

SHA512
305d885a19fd8fbfbd7b9c13de9461dc07392ecf1a351388c60bdbf51862ed3d7ab995b578f884de4702388d332a5a8b6b8204cf4519ffbf303642b401dd3562

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
19KB

MD5
681b3fc333cae54ab17c3dc34a8cf707

SHA1
071db9942e4b9906a67f1af7541bb039e6816cc0

SHA256
e6b305df0502b1cbc3d021ee9458ae110695004559ddb1604c86ddb5fc8dd8b3

SHA512
0d4609fc0bd421d8ca30847ce83e2b594169226b13e6aac75ab0b31e0268139ffe406eb277c5511f09cb7809d5d848393ada19d57a319c15ed295b7f033fcde9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
57KB

MD5
0c9e3a7c52fcf25e3d9c01f48335d318

SHA1
89e68457fbadaace6a842db139171a6ac111800a

SHA256
642e6f5a9e403ecfaa678ec716e9dcc9ffe6071e2515f5eba0e2fd601d0796eb

SHA512
9287ff7adbd7580f7d738f9fa9b6e0e74a51edf79c3a0590102713c7551a732ed4ccf9f02247c8e7ace4cb6569c9d4bdc77e5b1e7ebf0ca786e2ae965efaa684

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
53KB

MD5
8fcb818bc23425964d10ac53464bf075

SHA1
396f40d25a7d38eed9730d97177cd0362f5af5d7

SHA256
8b56333cda4211c50ada778d598348b8a846d557ed9117d8b265e004db31e9f7

SHA512
6ec7588257bd1261f9b2876c3aa57fba2b6bdc33a2a68830c8d8d539f449c552cf6923a5e8afb5e665d12cad253a10d68ad665d9eb74ff8250c6daf2f61e6da8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
132KB

MD5
01088b35a7144b96e1c65db9ecf5aeab

SHA1
3d5b4a4fafdc3867adca4a4a640d6296bba06f82

SHA256
66616d0b8be2030b1f40d1da2a80bdf930172335226111b7965a4480bb584f1f

SHA512
bf639e6539792c3ebab0ddb646b795a1cb14e4359fe97726db69ba2e082debdb920c15d5eb96a552613ead61ee4320de0331c02aaba3f14dd83956cc7affba89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
22KB

MD5
015dfbcf0c986f99bc0c1d6ab9fc162e

SHA1
6dff455e6dcdec9ee55ca25edb5f8edd1803f3f1

SHA256
291c3acf9855517f481cf0d64ba43f4e085381d857589ed5fc75905c82133951

SHA512
1d34e7bd775cc7b70371a579de085824a0eee0c6ae81dda89d51500c51eb0163987055a2dbcbd9ea191ee8b35ee0cfe4813bde076bfa5df0428ba7e043a6522a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
22KB

MD5
9196e81f8ed7f223d765423c1f9bc8a7

SHA1
88f9d5c2a6908cf36b8daae803578ca9e1fd2929

SHA256
a4e2bcf7ef3c6c614c2142d3c1fd44caac4eafa86a1779ac31cba164e2d89cbe

SHA512
e7d23866fcac017762d2e2f18597124e9147f458d30038f78ba9f3a2bcbe479fe4792573894370ce2d6f93a00401231d9f01955fde351ff982a82ba87a8241f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
55KB

MD5
68459cc1919abe6c9c67737293968efa

SHA1
7206327f9e7681896e3143ea93b8d3faf56dcaff

SHA256
77e6ef0aa0f6e0fdeb641ec357f0650bc1e6ba242b50f794898bce27089c8c86

SHA512
59f0253e0d197923b9706d3c543af61e927720062f27daec2b4677b63c675c1942e7bc30e65261c3d4153c1b129ebbe370d37f41c59c82017199ad57c3d7e90c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
55KB

MD5
5ad67628093b90d7b09f19fea57ebe1d

SHA1
c983290e8692fe0d4a5a6f7354c27ad4c61a0221

SHA256
4c79b51c58fa56da28c18b94f01cd86596fcceeabe3f7e624cfd355bb966b63c

SHA512
77831e58cad399009e784dca517836ed2a27237890f5ab63dda6409b528952313c33f76b689076162f239d3de2da1aa96d369c19a3a328da431ce712642574b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
42KB

MD5
5aaa8c37cd59979b920cd21c4a50a38d

SHA1
0ee61e3b2d58513b92cf4c6b5114c1beb55539e7

SHA256
db6c6f42e1d56092fb2c3d317968077cb29435139274faefbf4ab7681955bec6

SHA512
0fb4c45db9f29963fce195e79b4e9963e57a50ef0fcab74466d6034834e0099f1f344a8569973d4c1ece05d9b70b5938b42ead4fabaa08de7d24c911df28c235

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\02735674612cbc52_0

Filesize
1KB

MD5
152ac6743bb51483c239f3225851062a

SHA1
3e9e856b34b02114a400fd3da4ffe28b499a2e70

SHA256
4aa18dd2d6d620a6d1369b9daa42c6dee38c2d977cddc7180503282781e6dd22

SHA512
a29441dacbc6280618b970bb4e0580d95d981ac99a2a1dc1ad9d514bf7b0af1da0f70f16e4f54b0676fc1cc15c58c7b874fee3bfb2145d3b307ed98ebf4782c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1acbc71653e61c35_0

Filesize
2KB

MD5
f4db3643c6db1157e71495b97ca3b714

SHA1
7644e732c2f26d28f8ef868a5a43af9c5f634a15

SHA256
8e306e1d2303eb2c1de7a1635206c6754f15cae68ec613a50c5f6d9b3504801a

SHA512
2fbf9a2e1d054dec4bb3f7a8b5ded54d2a80fee28c254acf6e67b9a7138b871815a158007fe1abfb04cf0078b683af83907f5e6a95698c0598de308843ad6b7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f02c4494b1a18ff_0

Filesize
2KB

MD5
c65d98b42674fd06c44ea8f833305780

SHA1
c0e16dd06d148bb157751403c1b78de8465ab066

SHA256
e3fa07a5906aa61bc5fa8a93536a319b07d7b2838906f98cec98f57833acefb2

SHA512
498f415fdc6cb0a4c6ed241bfbc65beb5d3b9b028b1a777dad84e859374e70f065b5eba03697e1b3c2cc05b904338d4888e36e5876c4c18a7f08a6fc98902941

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bfd9b5c29c5c8524_0

Filesize
1KB

MD5
89d2d5362b277b4886a952e27525fe04

SHA1
39f21d26f0598cd003b4acab868e19fb10aa182f

SHA256
e0a7588de806760d4c27f6071fac076eef13be5eed568be243a952e579984e8c

SHA512
b8d78c2cb5e0f6b7ef690955d6a60af73a8782c9d560480da66cbcb081e2c94de521ba782a783cb675df721f2155889ae43e3f9cb37363dfc24d716c1cc61fc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
c5e7e1e3faaabd439e6f8a8c01a03f46

SHA1
5a885e0bf3789a2996086727689cddc4656c7b63

SHA256
56e08421d5577c9a199f5af18650d1629c1c17ff25c24ae3409c676acb1e4b2f

SHA512
de55bdf53ebdabb3cbc95623f6babbc3335a7bb9eae0f22f31394225fd3f3109f552d6bd446b6111e2f617a52d2065863eafc504df7592478803b12ae33eb2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
4a35d02cd85e1c4cc7ea0d5bcf253f7e

SHA1
8b34f4e0fdc176e03947f5d3fb3d6e9b1d614785

SHA256
ac7cf7ab293900edf45046aad5a8e962e6cbfa20b68a8cf162bf3499cbeb5b4b

SHA512
785ddc27fb1a2039facba168be1016cb6faa338e5edbd1e9a96277d8e552e5b3c95f75670a24d8107b4be0199116b90390da880be77fc41260d57ac416f5e9af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
415297b47ccbaa3870678abccc9db336

SHA1
349621fabf8122ae7753d08b98ee878e0b701808

SHA256
f22b8c907235220f56cae0a0efffefda80645b0fcad1c49c4cd6812d2d3a8005

SHA512
8004aeb8c2a3c278e232b723ece413bfba25b0e02610d063ddd25f98f6aa4c5c2f88cb7688f7f0b03b8587ccb408e446c561c8c542f45d9e9d207f141b3bea47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
9a967636f4d36a76bd2b2f99f202af5b

SHA1
9d213d459f4e182214219e7343663dbada2f742d

SHA256
ccedd22957d0f023134d4be97fe7665d7e541c1aee559a958034640bc3da0a92

SHA512
512192c78f0ba90dbba74a92f88e439cba606a1600a76a03eb235b7e96b841dfce2a63ede461e86df6074471bb69fe88753e140bc48d6d236f9b4e69d400b5be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0690b12b6bc18284b1a986a910fd9b79

SHA1
c118e5d333e9c2a099ffa3f4f0fd4523a1cca81c

SHA256
c8dc79d1aa0db7984c181cd6f22b84f732da70537ebaacbb69c502ac53827d46

SHA512
f1b1bed51c0f1f497374b83dd27a511785ea09d8c7bae6144e46b406417dba2406c289d0b688458e9a2250c6b6b7735599f0e8efdd3252820d06feeb80b52add

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8e6150f48dcd88ce5a2a676043360c79

SHA1
267ef045690f469f321ffbd01774493390880672

SHA256
0322340d0e85ec515e391592ec9a1dbdbef31ee9f42926f31e46564099809ec9

SHA512
3c8a0fa322182a1c9eddfb1794516b1748f21d2f2d49ddf9c77f06c2455780dfc84950ed265a961df38c0399080c24f6f6ba7859a82ce43775653007d3df7051

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9c894d86adc431ccb7dff67dfc9e3950

SHA1
7277b294be30c16b23ed1afeeedbe23b59c340f1

SHA256
a65b9090f044879ee63a3d97959dcb613de5a1308e48dec2996650fce1cafd74

SHA512
febcb731b124f64b7addec676ca6521dcd1073fc57a789d00a511a5ff470e1fe4e1370eb45533a254b6c117b84d5514b30f4898aa65e2a7030b9aed15841f3ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
856B

MD5
b69fe1d89b17a4f1df2c1e27ac871b14

SHA1
ce7e667616cca9bab1b0dca49c9ceb3f67ea2ea8

SHA256
6b76fc9e54f830a8084d38e60b767c8d8aa91560441e3688d0b86259bec93502

SHA512
25cbdf5bd466b488ddc744c7387d74c7e20dc464fee08a7b848f20d9c31121c6ca750baa5d4325200b08a50b6070be6d8762d514b98f36da0d1a5eb92a42c999

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fb209d5afa24138f3d5b90009621d6f3

SHA1
677a88840e6d727418e14a4a454f8e884330fa6b

SHA256
a79e99e2ab03081fa414619d768963711b1f533c458be178e24a45ca05e2492e

SHA512
d4d93347f5127549907a90ce67bca4531f88551f0b59d385d1716d3e796f26736992344e546b78c5633d71787e0e4a867f18d48162619c6e3b2a985ade1ae09a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
20b9d02caef28771d39642b294f9fd7e

SHA1
73b829cbaa51adba3cc19128286ffbaa33e806c5

SHA256
2da0c25c80ffd0a0c449a50b17a3c0df783513e6d36226222434fcfe153af68b

SHA512
e1a15c5be29a976dc359074ea089272d07896a1344d37fa2df44e37f09ea4766cdc5da6bd65f00deac612a762baacde190b10c7e6b4b9305c2f29b384fca8e5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e34ad4391273901b55fc1130bc625a1e

SHA1
e7d28efeaa89e0e52c459ba0b1d8d2a164cdfeda

SHA256
c5349f8a6357842403a50d59861d06e0717dec027612825e70a3ad20247dda98

SHA512
2ed5d41407f0f418236b58f6ebfc188655513c2d4e23663b2e7cb6ca806ef25315f66e7478e9dd2cba61a8930e64bb79a0bf9c6dc68ded6ea7268b04c9e42eba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
350f579482906930709c3006e460a578

SHA1
6853103c72a1a5387b08a47193b018e7868818d2

SHA256
c3b4caf08db1b63eab7c6d5a2117cf9b457b3af4d201dd1bfe8eea3389adbc26

SHA512
5ad8b6ea1bd90314878f6e39791867ba83204fe07fb78f6cc005f778bd3ffc4ff5db31e59c1b6548abb9215ab5caad2fe133d91fcaa063bbc3b81608c5ccfcb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
17914eac173bcc869064e44e99984ba5

SHA1
9626121bcaf17b61ac46106dd1e84c1085f8d75d

SHA256
61b1a30f26f5908fe4f593396b50e6ddc81ca2e1ca0437b27da783a0bf8cb044

SHA512
85e0bec8e0ea0fbab1780c0f26efa194f50a0fbb92699da63f2735273afef2798e67b6dbbe8362d264f400778e7769fb017aa72b473c1c8a23454b3a062f26be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3dffe8cc803dee57f7857fd1da291c06

SHA1
672f120c8c0776efd56bf88c1d07b5ec36cd5f3b

SHA256
2acd87bcf76219e8daa7df991083302c803198ba06bf812d5e660d0851bed001

SHA512
19f4aae0f4cac7ada80adbbed148f4b7851b55dfd14c5a962c76242156e47672a4c438d0b6705c3eb31f7ef06b7cff9d75eb31b1420173976c7eb5cbfc8cdf55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b1813ac1318697a7b7f0784fbe31cb50

SHA1
c7d31134a2b50551dd5fef7def374198e1f40cfe

SHA256
9de2825e0a087093b02d09e5d78de85c3a94730867b2d88df1a50879500d8a9e

SHA512
ecd9b211f5c8b0cadc1dcb164bca12f30ec4de3a3dfec7ca4f2c90c99901ed61da89c088a71888ce525597d7977c88d233a3d11879e97773aca6cf87725c708d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3c1faa698d4aa24e28267a1ce5992cd7

SHA1
8abbf9903e0841bb07e07459ad6a102997f9ed0f

SHA256
95300b59b84cfd77f14f558f5a5a3501a511a84908ceeadddfd9fa77e6637419

SHA512
44db02fa5ba023376efb33930d39fbcca6bad134a325819d76599bcf8b9f13231e9ed9911601c89ef11daf3ff04ae08a6b9296ef32b61d3afd0151ae386fc7b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ce612e286acec8153ce187ba45b33a2b

SHA1
22d616d3e7d842d4c1eed8cdd1eae69f4d44cd23

SHA256
8685620a75e58c427253a187425341d6d2e272ac93228cd9413180d3d26d854d

SHA512
ad2eadefae2336758dccbe675f89d1e2c8c326cc20b0e7e04395f41d7b04c5cd1cdbb9c3cec80ee1add46cf97f8918df1dd401cd876629929a2ebd29f0dd37fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0070faedf65c7bd2be8c2acca27087f1

SHA1
893c95e5577c899e97ab38468bd9035b01030b2c

SHA256
a45d3bda78a32db30f2bbc653394278acb57a9c246ff95f161cbf88f534d07a9

SHA512
c03bcb1f6b0a66a86345f9a85cb7222edfcfd28242af8582a46f31786da70521b1c3cee49c778d74a68c28fcb98a92d8f5355cbdde13ae544f20c50b02e64311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
17be64daacd174bc03461d7d8ec8508f

SHA1
cb3d83485748da0473cd2d1c0ee902aca41deb8f

SHA256
5ea28b6246d06dbaeeb3d0463b38cef76da3f3d93f18182fd2a6de70f474a82e

SHA512
314636523a77b707be73ed5653e7754993d907b0f25bd7749a9abe2473efb37194cb3133f2cee89d25cca4ece2e99cf234d72e30d99e57f6bb91bc0d629bf604

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a0cc38b6050a2675631d682c30c19f56

SHA1
dd2c510a6ad3310fb0a64fa1fce66ca23c26624b

SHA256
1f8d6a9a48ebfc39bd300c7be9d8bde02295f8bc9cf54bddc7d388e27d6bd684

SHA512
6037cc1eae0c84688ff513ca9b46139816cacde095d21767386e2cc4c99c5cfa68adcf1ad36f2ddb5cdbb9bcd2c78a92c5c036a3bb2d19246cfe9b1f8ae4408e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
00add08a2d26aa33d8d7d617bd072b95

SHA1
5e6e53bd1c9161bde131eb84fa2aa40d82a99390

SHA256
9469800c24419bc2359c2158cff67a221bd8db09b156e239db39a121f6218072

SHA512
6bc8c39995ebe304beb698f665ae292ebd2e1abdbab1ed054b31c17cf440859e7b7f6cbbd5d07cc162a6f6f59a534ec416f5df4163a73248356d0a38d60b5b1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
29a224fd7bb30453ea54176fbdb4b58a

SHA1
c8ddea4c3418ba7039825c9a41bfc1c9d2a572b8

SHA256
06fbcd55567a0ad33d0c595ecd7e58d3e4a2e7ae4249aefa08a5968c2fcdc316

SHA512
14be01f34ddec61ecd39a7a8d3170a6c62ddc3ac646b5daa8f255ffe160f56a43278c9be1c4b519270dda719a5ac8f553c10c722c6d3ee0e851d7eb93f1e79d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f67df2b3d3bf00ed6916090f3058eba7

SHA1
824063d1f01cc912b4f9d8d118df121528bf9cf6

SHA256
ff670d0a8957e2649a71322e41ac0b4afc2c6dacdbe6a12eb16ce1cabc4d7650

SHA512
58b2bb155a92275906131c5155e3bf479c609cd89d89eb017d5cc954f386bd1fd9b69dc473cb74b914bd287f5620fade90deee2acc7fdc13ceeb460c9834d67b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
895f78ad89769b1141ca94c4144d5b73

SHA1
efa3a21759fd13ff6c2ffe35c4b094ca67a21b73

SHA256
068d6f75f18b9a1c96eaf8bcd2b74550f310961c868cc856daa8b41aed370cd8

SHA512
a0d13a6b82960c23e9de7e05df36a787835a9a9e82121a4c289ae8460c425c7d5ceb41af1d1edf21bb77dee75b284db6ee48c37dcb0539432b712e86f2d479c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e5ad874b3fc07c17f21475dcb4d4d0b7

SHA1
8c3f1ff3281008c869c068e0facd04ca409044ec

SHA256
f956426a58e6d44bfb0b55398609da4285258d5b474e4d06ae536094a0270c90

SHA512
20f48e223bbaceca50f944775b8454ce3ea08e99498a42ce97fd358f7f0ea716ddd11e74e22092318b06f5563f809b26830eb70078c22f69d6a2b39df193aedc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
af833556229cca502efea4fe69905f1b

SHA1
df1a08df465aaccee447ea159b85159d8d1e3a83

SHA256
15cd3b7b1b6326672f28ec36e9a7305b06a08bab9375311a0356b3b65523ea03

SHA512
e4e96dd3ffd6a5c15c49fb8d0bc5a4b296e7daa65fd66d1fe5baec0598960cc7c9a3e3f0b539973c45a9bcc709507431e18c3959b127c118e0c96695d2e94b58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dba89073e1015d871da4c53d134f4055

SHA1
0b13c3356cf020d26a77ea44de82789f175b9843

SHA256
38c3b342938a7f2f6180ed8a574d696a711add3213186f22549e365030a849e0

SHA512
98dca4f3dbc33cd8ea24ca6df02888aef1ee608d47d0b0840503ad20b0677ef21f12b36c1c0f2cdcb5d00092e0ae91b88621d676c15f2c1a313f138d5ad0b514

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
529dafab749c3718576319268946b55d

SHA1
6e752746551f7ea9989e48d183fa07a03108d1a9

SHA256
8dfdee961fc54fc7e79207d28f451d8f30465f2e70b794cf3f8e3d442522f79e

SHA512
3550d013760895a74a3828dec839b11c168879fbaea202842e884133961163f108ac78970fb814e8742187888e0f4240033a50b2849cba6a7f3dde08283402ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0acba70d658a9c815e89a2ef93f4de72

SHA1
7175e8e41b9305e7207dc6af6c97b137c2ef1f18

SHA256
8ab443df9fd55a484ea07d4e736d7f833d2ca41f675e3a8baa286562378d204b

SHA512
32fe38f873baf508f836b40c3c9c5c8be6de6e0b8ba095e6eb86cf517077cc52c72276524759070123ccd0d6d57f844c1f5a3224e12a1b956ff75fddb20c782c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
80ffa60d5ccb7040d8bc2d2e9eae45c0

SHA1
4a1aaf24e484ae108489fd73a9851b3711c8cd11

SHA256
f43221846ef5a71960ae0cae080b746257f7954ea3baaf8d3e206ffdae762e86

SHA512
6983acd5d0ae9821f06860483aa21d13a09024dca9150233bfe043baaf19a1d343910822065a28400f8ba0cb8a59f15ec1af0a15b693a52100483878195f0178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5251f5d22d5d14e8555d4a9fb5a6e096

SHA1
e475b01cdf6f109d6424cc576d04765704880707

SHA256
673eeca1464ee8f4b8d914f62f920df6391b63f48d717f82e90af52102cd6689

SHA512
9af837f23e2845aea6211f1f027938ec0d583b3c13959dcaed209c7f292bfe8418b8ce31ccd479534e004818ef49c74f20ab15e22f39dfef6635da67a3d83147

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b694a2c640b64a4f97917f1457f9b534

SHA1
b1b874c443ee604fb122570024d3916a408ab3a6

SHA256
931affbd8f7e765d9600d4011437d2bbbb0389f8435bc6cd7f6aa927741e45c5

SHA512
862293293abd0ce331faee2e14de44e27d72d2d703c5860bc583a6ff63a72b08d7e469010386d61994edc6f51bf44c9c96114f6c84399d28ad523dc0718ba457

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f42449ea63ab3c8f03d249cd3e9ccf37

SHA1
d6b9132d1636624e92d539752272130cf58fa28c

SHA256
065dcd6b4968caecf6a8d1a536a5679d2330e0c3da4e94b900daafe9f4704498

SHA512
87b0adf9197158de5eabd52738a133d4aeae6ef0a665d48075262560a1304c46b2875fd5eab33b0d47749c73b0fe007bbef0509d127023b7783634e7d2259bb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
46a5b4e3318fb01d6240e3b5c9832baa

SHA1
bf6ed6824941a2244a905f8255eec63241abdfc3

SHA256
cf56ea59e31eee5d593dd3478cb9b962273a8eb49a2d2e9eacc81cf150915134

SHA512
65eabec755e127610da0b005e8a99002364e4afef7e68127f9a64439fff6da8354b8e7c15b060820752c95d8f2ec2f2e4e5ea92c176eefdc8b7be03dd7b3d08e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
14f737a1cbb383de959e87f6b144a147

SHA1
5e49a8bbebad832f3f47773225e10b1cb7d684e3

SHA256
788c52ef3e7e18eae6883ce8123a2b5da5a3ed71469511323cfb8b7c6a52e103

SHA512
5aa006cf5bd4f1cba75728f9f7159e111d19f2c97e12e829baef77599b04efc00a8354a13c99b34be3930540e5ff65064392d6b89e4276cc7ab7e44fb38ac312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a8e9602b2990ae44f36fc4e35406ceb1

SHA1
bb897c0349e05f981d5dab48e26f8a923111b346

SHA256
151dc811095f53b2e1ec1b4b9fd20c4a86496cf25533a7b07fceb20666dcfe2d

SHA512
5fcb06309c78a3881423d37b7929f8af16b64ecf59954ee278388529230aa2a24404802a846104d5532f1944ac1f0739696d2bb13cba42cdf3728724bdc26e92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4e76f664a12545ddd4963f451034a5c0

SHA1
d77a071ef078cab336a076cc3902d99eabc87667

SHA256
2f329f28df67e4c5964deef9bd215bc7b466846780fb785be564ba45a5471b61

SHA512
7dfcf5ab2297fa4bc715b54673415517a608b170930efdeb21908a1de5fd44d56b7d7394de8c24c41726416ea8aa8a4754b54730f34430fb8bda31f71e7786e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
15f3aacd943742972da85391058bb4cd

SHA1
e4ecbed03c5c2214307aa05f84c50d143a1e53f1

SHA256
3ab8ab260b16dca84d1e42d35861c9f27d2c5177135beb77e093c44b49941cf4

SHA512
3998db01003b3b848e3ae052f491b83c3107e374a690865d21157b668ef0e93096229ab382bc284ecf5e74f5a8f8663e0fbc7e56b493af52a247461aecebd812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e0c5e6638d9d031c63e949b40971e6b3

SHA1
9dfc7d21c5d0f23e734bb18487efb34d19521a73

SHA256
9ddf3d47301bc9a4dd37c6879510651f90b75bfecf6da49372b5350b07ba2713

SHA512
ef066134af022e81347b89865d31df341dac3147eef08ed8e1218583142d22d59ca009b399a389d1c62c8d87169a25f2121fe6bf9216deec0d713011f9e317d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ede5a227ca6ecd8958cef18cc57f4aae

SHA1
9a0b1393fb3f24c7ecadf947a79df11b558b6488

SHA256
f9aced342fd7822cc90ff5c7b5482042e18a49f5d313448124837a9cf3a53f86

SHA512
84c57fd1c0addb816fc763d12aaaa344e1e87097d985de93c3e1d75d712669c833445210bd4ae78fc0f727c149777f4a519026f6f0bef15175f5dda47c5727f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5855ad.TMP

Filesize
1KB

MD5
b37ecb570c78d7de2ed1e2ce73f592f2

SHA1
a8f7148981f2d50d9e036067b60d14001134dd70

SHA256
1ab5e0857f4763cfc90a5705f6cde80c1850840bf05a2fb69f8798dcd5b0c51d

SHA512
afdc0d54977d7e314a15feae5167fde6f5db139c86a50a194cb963e55b36401b8f058cdb347d0996784fc52c4d272efa004960301d84a54d57970911434d8875

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
37f1c79e284a69f7f5c9fe307dbc72fa

SHA1
0c2826847dbe5443f24071dd2d1fac5ef20ba041

SHA256
c93f8b870262fd1918a57dba419a70e1d7f5703a4a7c97042592d831002d4ba2

SHA512
a07ecfe0f0db94be003119f633b77aea6801778a8acc894e0a833cff90e2566f08e32ffb5c5e8b2c5a20da42a4e6cf71405b1cf1eedd9e119bfc63eba4ed474c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
8ffa8f1238ac1e39335e7490f5a352e3

SHA1
7a754430929b5abc8df09fb010b64fb1102f278a

SHA256
8ffee3c1425be16aeaa238cbb9bcb25fd81447a5c9d9a52801b7bbbde0114a4b

SHA512
a12a173f92213e5b9d9694cbcc0eea4271e95c835ad5535d12596b735d468ae02e9e54dcded63cd2be67672691fa58ed64d1895d563bbd39db3b249fe7c6195c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
3f82ca38aad88928c0d6a32c67509e25

SHA1
0a0238a8fe62194b56d40aa7cb4fdfb67c9d7c36

SHA256
268aadb6c4b2321a54889a8ba9ebd384c582cad1e09692f135b7da0c860f99fe

SHA512
d9f8981ef2f32f4080f32049db7ca7fd3c569ba4ca19d92cba0569b96e7fd8ca24c7747a2e91fe245620794a0495f733254879b85cf774d1fd83fa6bc4d1a119

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9924413098fa2a075e5563afb81edba0

SHA1
a23edcb995b5b779356e72477833d9c36a8e7ef0

SHA256
01b5a6ee2ead1f1d504db9cb3abf18bb169da8e5f19f521e1d9a16806d55d71e

SHA512
8c4529d4e6b1b1efc4fe7f92466a33c5fa6161229dc7e953d2956d7baae6f5fa402ed2fcd926c2ab271e3fd4a2708c6b93f9007fb740ecab6343ec5556b5d2fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9dcb84f1ba2b4b4d26ade481fe50b609

SHA1
49a573660ba488a16e9f085f1c6d0e4c5382f2ec

SHA256
aafe9ac0ed59e95e9e3c96e1e7b4bcc3174889707885cd22ac4b015319136f54

SHA512
bb53309475e420d38f5e141fe48f47022bebadf6d8c75ba0f67bd2ff93db2840fc11df8184be20a58906c3670ba61766cae37bf6a0fb511dcfcdc9fad4e9710b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6d6834de734cc7ab850c480cbc3c404c

SHA1
0434ab927e528de09433063c106e1803b9710620

SHA256
ce6a72b18fcf7d68252df30b5a2ff773c2f2eabcc75e9eaf06d8af6a6ff581da

SHA512
6b4ffb1a321e7081dbdbe7153543fa648c0ce8bfed5cfb7310ba31834388daa855ac42681f6d4f58d6518fbe5eeabbf0349ceecd6dda7b27e7194c0c23155ef6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4b269f6f3e1c4e511922c75d5a949bd7

SHA1
982e735ca6c6d96d00885c3725f9160df88497f6

SHA256
eaab849cbf8d8f7d5e0ca2ea67540832876a726ca7f5c8e7920a3b589e0abb22

SHA512
bf125abdca49db85448755c93b944810fb05fb646160c85a0cb98540ebb8b6ed3c6c93a06c7cf184955ff020cc6ae7792442fa7aba49dbe0fa993fb1d2de636f

Download Submit
C:\Users\Admin\AppData\Local\Temp\HFIE002.tmp.html

Filesize
16KB

MD5
e31829875c5524f3d603b33e0aede4c8

SHA1
de629eda76e891bf3c1107d3c9346043deadff45

SHA256
189835b7e165c4f4b0384ace249e7e9b04af7ce22331a2bfe23437f4d3b3fbe5

SHA512
4c0a727996498b49ae5dae94ee030802c31f461dd981fd43b54af66b8bc9a48132d98e1e58653dd1c4d715ec0f131530a095f7310437700d24ff31e165c9f978

Download Submit
C:\Users\Admin\Downloads\!Please Read Me!.txt

Filesize
797B

MD5
afa18cf4aa2660392111763fb93a8c3d

SHA1
c219a3654a5f41ce535a09f2a188a464c3f5baf5

SHA256
227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

SHA512
4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 194474.crdownload

Filesize
10.6MB

MD5
e9e5596b42f209cc058b55edc2737a80

SHA1
f30232697b3f54e58af08421da697262c99ec48b

SHA256
9ac9f207060c28972ede6284137698ce0769e3695c7ad98ab320605d23362305

SHA512
e542319beb6f81b493ad80985b5f9c759752887dc3940b77520a3569cd5827de2fcae4c2357b7f9794b382192d4c0b125746df5cf08f206d07b2b473b238d0c7

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 194474.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 350404.crdownload

Filesize
3.4MB

MD5
84c82835a5d21bbcf75a61706d8ab549

SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 488181.crdownload

Filesize
27KB

MD5
cffe1f958643d6120ca4b41ffc8c88cb

SHA1
6f65c3011fc96dc987411be51992ce40d411c890

SHA256
e6aebf723ca843c4c97532256851fd7bc6daf9d9acbcf5fff2b2135616f1e434

SHA512
2694ea6582521849d13a1dff07b9c30d5fe29ec21031bea0f683be582f7e949c7f0065445e7943c930c7906bc13267961b85b067c39f7ed12a9f87f3de922cc6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 55526.crdownload

Filesize
224KB

MD5
5c7fb0927db37372da25f270708103a2

SHA1
120ed9279d85cbfa56e5b7779ffa7162074f7a29

SHA256
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

SHA512
a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 766248.crdownload

Filesize
982KB

MD5
9e8253f0a993e53b4809dbd74b335227

SHA1
f6ba6f03c65c3996a258f58324a917463b2d6ff4

SHA256
e434828818f81e6e1f5955e84caec08662bd154a80b24a71a2eda530d8b2f66a

SHA512
404d67d59fcd767e65d86395b38d1a531465cee5bb3c5cf3d1205975ff76d27d477fe8cc3842b8134f17b61292d8e2ffba71134fe50a36afd60b189b027f5af0

Download Submit
C:\Users\Admin\Downloads\u.wry

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
\??\pipe\LOCAL\crashpad_1908_RDNKMCTCOHYSCCXO

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1456-2216-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/5452-3746-0x0000020DF7D00000-0x0000020DF879C000-memory.dmp

Filesize
10.6MB

Download
memory/5452-3756-0x0000020DFAE20000-0x0000020DFBE36000-memory.dmp

Filesize
16.1MB

Download
memory/5452-3757-0x0000020DF8B40000-0x0000020DF8B46000-memory.dmp

Filesize
24KB

Download
memory/5600-859-0x0000000000AA0000-0x0000000000AAC000-memory.dmp

Filesize
48KB

Download
memory/5600-860-0x0000000005AE0000-0x0000000006084000-memory.dmp

Filesize
5.6MB

Download
memory/5600-861-0x0000000005480000-0x0000000005512000-memory.dmp

Filesize
584KB

Download
memory/5600-862-0x0000000005550000-0x000000000555A000-memory.dmp

Filesize
40KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads