Overview

overview

10

Static

static

1

MEMZ-virus

windows11-21h2-x64

10

Resubmissions

07/08/2024, 08:22

240807-j91e7avgrp3

06/08/2024, 23:44

240806-3rmk6avaml10

Analysis

  • max time kernel
    1050s
  • max time network
    1052s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    06/08/2024, 23:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MEMZ-virus
  • Size 247KB
  • Sample240806-3rmk6avaml
  • SHA256 759a62a1d7e2935c1e3898be2853ca90ef10dba4da89639a577f867342923488
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
cryptolockerwannacrycredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceprivilege_escalationransomwarespywarestealerworm

Malware Config

Extracted

Path

  • C:\Users\Admin\Downloads\!Please Read Me!.txt

  • wannacry

Ransom Note
  • Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets

  • 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

  • CryptoLocker

    Ransomware family with multiple variants.

    ransomwarecryptolocker
  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Downloads MZ/PE file
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 31 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 5 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Kills process with taskkill 4 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 57 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • NTFS ADS 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 57 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\MEMZ-virus
    1⤵
      PID:996
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4620
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies registry class
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3056
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffeb0ae3cb8,0x7ffeb0ae3cc8,0x7ffeb0ae3cd8
        2⤵
          PID:972
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
          2⤵
            PID:2328
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1664
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
            2⤵
              PID:2496
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
              2⤵
                PID:2424
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
                2⤵
                  PID:876
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
                  2⤵
                    PID:2220
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
                    2⤵
                      PID:2640
                    • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2624
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4628 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4948
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
                      2⤵
                        PID:1372
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2064 /prefetch:1
                        2⤵
                          PID:1112
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5292 /prefetch:8
                          2⤵
                            PID:1132
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5296 /prefetch:8
                            2⤵
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4304
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
                            2⤵
                              PID:3388
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
                              2⤵
                                PID:3516
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
                                2⤵
                                  PID:1600
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
                                  2⤵
                                    PID:1704
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
                                    2⤵
                                      PID:4364
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
                                      2⤵
                                        PID:2928
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
                                        2⤵
                                          PID:2616
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
                                          2⤵
                                            PID:1084
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
                                            2⤵
                                              PID:5084
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1
                                              2⤵
                                                PID:2620
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3480 /prefetch:2
                                                2⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:2124
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
                                                2⤵
                                                  PID:4304
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
                                                  2⤵
                                                    PID:1204
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:1
                                                    2⤵
                                                      PID:1836
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1
                                                      2⤵
                                                        PID:2972
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
                                                        2⤵
                                                          PID:4132
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5816 /prefetch:8
                                                          2⤵
                                                            PID:4492
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1740,1927024798853129695,15105657850414636863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6968 /prefetch:8
                                                            2⤵
                                                            • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                            • NTFS ADS
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:2508
                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                          1⤵
                                                            PID:3456
                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                            1⤵
                                                              PID:4716
                                                            • C:\Windows\System32\rundll32.exe
                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                              1⤵
                                                                PID:2060
                                                              • C:\Users\Admin\Downloads\WiseVector_StopX.exe
                                                                "C:\Users\Admin\Downloads\WiseVector_StopX.exe"
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Drops file in Program Files directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:1220
                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                  "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\WiseVector\WiseVectorExt_X64.dll"
                                                                  2⤵
                                                                  • Loads dropped DLL
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:960
                                                                  • C:\Windows\system32\regsvr32.exe
                                                                    /s "C:\Program Files (x86)\WiseVector\WiseVectorExt_X64.dll"
                                                                    3⤵
                                                                    • Loads dropped DLL
                                                                    • Modifies registry class
                                                                    PID:4052
                                                                • C:\Program Files (x86)\WiseVector\WiseVectorService.exe
                                                                  "C:\Program Files (x86)\WiseVector\WiseVectorService.exe" -i
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:1372
                                                                • C:\Program Files (x86)\WiseVector\WiseVector.exe
                                                                  "C:\Program Files (x86)\WiseVector\WiseVector.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Enumerates connected drives
                                                                  • Drops file in Program Files directory
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Checks SCSI registry key(s)
                                                                  • Checks processor information in registry
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  • Suspicious use of SendNotifyMessage
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:2108
                                                                • C:\Program Files (x86)\WiseVector\WiseVector.exe
                                                                  "C:\Program Files (x86)\WiseVector\WiseVector.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:1032
                                                              • C:\Program Files (x86)\WiseVector\WiseVectorService.exe
                                                                "C:\Program Files (x86)\WiseVector\WiseVectorService.exe"
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1640
                                                                • C:\Program Files (x86)\WiseVector\WiseVectorSvc.exe
                                                                  "C:\Program Files (x86)\WiseVector\WiseVectorSvc.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies data under HKEY_USERS
                                                                  • Modifies system certificate store
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:3704
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                1⤵
                                                                • Drops file in Windows directory
                                                                • Enumerates system info in registry
                                                                • Modifies data under HKEY_USERS
                                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                • Suspicious use of SendNotifyMessage
                                                                PID:4276
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb132cc40,0x7ffeb132cc4c,0x7ffeb132cc58
                                                                  2⤵
                                                                    PID:848
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1824,i,3173668076111382125,2739273760908261152,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1820 /prefetch:2
                                                                    2⤵
                                                                      PID:2952
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2120,i,3173668076111382125,2739273760908261152,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2136 /prefetch:3
                                                                      2⤵
                                                                        PID:2724
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2160,i,3173668076111382125,2739273760908261152,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2376 /prefetch:8
                                                                        2⤵
                                                                          PID:2452
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3068,i,3173668076111382125,2739273760908261152,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3200 /prefetch:1
                                                                          2⤵
                                                                            PID:1884
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,3173668076111382125,2739273760908261152,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3256 /prefetch:1
                                                                            2⤵
                                                                              PID:1792
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4388,i,3173668076111382125,2739273760908261152,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4436 /prefetch:1
                                                                              2⤵
                                                                                PID:4248
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4448,i,3173668076111382125,2739273760908261152,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4556 /prefetch:8
                                                                                2⤵
                                                                                  PID:660
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4796,i,3173668076111382125,2739273760908261152,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4836 /prefetch:8
                                                                                  2⤵
                                                                                    PID:2484
                                                                                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
                                                                                    2⤵
                                                                                    • Drops file in Windows directory
                                                                                    PID:276
                                                                                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff776494698,0x7ff7764946a4,0x7ff7764946b0
                                                                                      3⤵
                                                                                      • Drops file in Windows directory
                                                                                      PID:4376
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4680,i,3173668076111382125,2739273760908261152,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4304 /prefetch:1
                                                                                    2⤵
                                                                                      PID:2280
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3468,i,3173668076111382125,2739273760908261152,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5108 /prefetch:8
                                                                                      2⤵
                                                                                        PID:3964
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3436,i,3173668076111382125,2739273760908261152,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3464 /prefetch:8
                                                                                        2⤵
                                                                                          PID:5020
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3384,i,3173668076111382125,2739273760908261152,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3356 /prefetch:8
                                                                                          2⤵
                                                                                          • Drops file in System32 directory
                                                                                          PID:1128
                                                                                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                                        1⤵
                                                                                          PID:3256
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                          1⤵
                                                                                            PID:2920
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                            1⤵
                                                                                              PID:1768
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
                                                                                              1⤵
                                                                                              • Enumerates system info in registry
                                                                                              • Modifies registry class
                                                                                              • NTFS ADS
                                                                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                              • Suspicious use of SendNotifyMessage
                                                                                              PID:3132
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffeb0ae3cb8,0x7ffeb0ae3cc8,0x7ffeb0ae3cd8
                                                                                                2⤵
                                                                                                  PID:1868
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1884 /prefetch:2
                                                                                                  2⤵
                                                                                                    PID:4004
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
                                                                                                    2⤵
                                                                                                      PID:3044
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:2772
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:3308
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:1084
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:1564
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:3376
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:3020
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
                                                                                                                  2⤵
                                                                                                                    PID:3748
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4336 /prefetch:8
                                                                                                                    2⤵
                                                                                                                      PID:3980
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5196 /prefetch:8
                                                                                                                      2⤵
                                                                                                                      • Modifies registry class
                                                                                                                      PID:1972
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
                                                                                                                      2⤵
                                                                                                                        PID:4868
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:2192
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:2572
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:328
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:4928
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
                                                                                                                                2⤵
                                                                                                                                  PID:2956
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
                                                                                                                                  2⤵
                                                                                                                                    PID:5088
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
                                                                                                                                    2⤵
                                                                                                                                      PID:2984
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
                                                                                                                                      2⤵
                                                                                                                                      • NTFS ADS
                                                                                                                                      PID:3512
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
                                                                                                                                      2⤵
                                                                                                                                        PID:2196
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5472 /prefetch:2
                                                                                                                                        2⤵
                                                                                                                                          PID:1208
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                            PID:1208
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
                                                                                                                                            2⤵
                                                                                                                                              PID:4760
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
                                                                                                                                              2⤵
                                                                                                                                                PID:2920
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6964 /prefetch:8
                                                                                                                                                2⤵
                                                                                                                                                  PID:3180
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:8
                                                                                                                                                  2⤵
                                                                                                                                                  • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                                                                                  • NTFS ADS
                                                                                                                                                  PID:2444
                                                                                                                                                • C:\Users\Admin\Downloads\CryptoLocker.exe
                                                                                                                                                  "C:\Users\Admin\Downloads\CryptoLocker.exe"
                                                                                                                                                  2⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • NTFS ADS
                                                                                                                                                  PID:3100
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\CryptoLocker.exe"
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:3296
                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000234
                                                                                                                                                      4⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:1988
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000234
                                                                                                                                                        5⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:2068
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000234
                                                                                                                                                          6⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:2372
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000234
                                                                                                                                                            7⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:2300
                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000234
                                                                                                                                                              8⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:956
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000234
                                                                                                                                                                9⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:32
                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000234
                                                                                                                                                                  10⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:5112
                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000234
                                                                                                                                                                    11⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:4112
                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000234
                                                                                                                                                                      12⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:3444
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000234
                                                                                                                                                                        13⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:3600
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000234
                                                                                                                                                                          14⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:4732
                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000234
                                                                                                                                                                            15⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:1092
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2000
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3112
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
                                                                                                                                                      2⤵
                                                                                                                                                        PID:3920
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3948 /prefetch:8
                                                                                                                                                        2⤵
                                                                                                                                                          PID:912
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
                                                                                                                                                          2⤵
                                                                                                                                                          • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                                                                                          • NTFS ADS
                                                                                                                                                          PID:3296
                                                                                                                                                        • C:\Users\Admin\Downloads\CryptoLocker.exe
                                                                                                                                                          "C:\Users\Admin\Downloads\CryptoLocker.exe"
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:3032
                                                                                                                                                        • C:\Users\Admin\Downloads\CryptoLocker.exe
                                                                                                                                                          "C:\Users\Admin\Downloads\CryptoLocker.exe"
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:1980
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
                                                                                                                                                          2⤵
                                                                                                                                                            PID:3412
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3560 /prefetch:8
                                                                                                                                                            2⤵
                                                                                                                                                            • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                                                                                            • NTFS ADS
                                                                                                                                                            PID:4136
                                                                                                                                                          • C:\Users\Admin\Downloads\CryptoLocker (1).exe
                                                                                                                                                            "C:\Users\Admin\Downloads\CryptoLocker (1).exe"
                                                                                                                                                            2⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:4164
                                                                                                                                                          • C:\Users\Admin\Downloads\CryptoLocker (1).exe
                                                                                                                                                            "C:\Users\Admin\Downloads\CryptoLocker (1).exe"
                                                                                                                                                            2⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:1404
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:1
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1840
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6956 /prefetch:8
                                                                                                                                                              2⤵
                                                                                                                                                                PID:5112
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,11218917979329011860,10501460539269100390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 /prefetch:8
                                                                                                                                                                2⤵
                                                                                                                                                                • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                                                                                                • NTFS ADS
                                                                                                                                                                PID:476
                                                                                                                                                              • C:\Users\Admin\Downloads\WannaCry.exe
                                                                                                                                                                "C:\Users\Admin\Downloads\WannaCry.exe"
                                                                                                                                                                2⤵
                                                                                                                                                                • Drops startup file
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:3016
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c 163111722988930.bat
                                                                                                                                                                  3⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:5048
                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                    cscript //nologo c.vbs
                                                                                                                                                                    4⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:3872
                                                                                                                                                                • C:\Users\Admin\Downloads\!WannaDecryptor!.exe
                                                                                                                                                                  !WannaDecryptor!.exe f
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                  PID:3124
                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                  taskkill /f /im MSExchange*
                                                                                                                                                                  3⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                  PID:5056
                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                  taskkill /f /im Microsoft.Exchange.*
                                                                                                                                                                  3⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                  PID:5008
                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                  taskkill /f /im sqlserver.exe
                                                                                                                                                                  3⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                  PID:428
                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                  taskkill /f /im sqlwriter.exe
                                                                                                                                                                  3⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                  PID:4840
                                                                                                                                                                • C:\Users\Admin\Downloads\!WannaDecryptor!.exe
                                                                                                                                                                  !WannaDecryptor!.exe c
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                  PID:5032
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  cmd.exe /c start /b !WannaDecryptor!.exe v
                                                                                                                                                                  3⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:2352
                                                                                                                                                                  • C:\Users\Admin\Downloads\!WannaDecryptor!.exe
                                                                                                                                                                    !WannaDecryptor!.exe v
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                    PID:1100
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                                                                                                                                                      5⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:4796
                                                                                                                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                        wmic shadowcopy delete
                                                                                                                                                                        6⤵
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:2240
                                                                                                                                                                • C:\Users\Admin\Downloads\!WannaDecryptor!.exe
                                                                                                                                                                  !WannaDecryptor!.exe
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Sets desktop wallpaper using registry
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                  PID:2700
                                                                                                                                                              • C:\Users\Admin\Downloads\WannaCry.exe
                                                                                                                                                                "C:\Users\Admin\Downloads\WannaCry.exe"
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:1428
                                                                                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                              1⤵
                                                                                                                                                                PID:1308
                                                                                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:2620
                                                                                                                                                                • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                  C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004F0
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:3176
                                                                                                                                                                  • C:\Program Files (x86)\WiseVector\WiseVector.exe
                                                                                                                                                                    "C:\Program Files (x86)\WiseVector\WiseVector.exe"
                                                                                                                                                                    1⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                    PID:2300
                                                                                                                                                                  • C:\Windows\system32\vssvc.exe
                                                                                                                                                                    C:\Windows\system32\vssvc.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:1164

                                                                                                                                                                    Network

                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                          Reconnaissance

                                                                                                                                                                          Resource Development

                                                                                                                                                                          Initial Access

                                                                                                                                                                          Execution

                                                                                                                                                                          Windows Management Instrumentation

                                                                                                                                                                          1
                                                                                                                                                                          T1047

                                                                                                                                                                          Persistence

                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                          1
                                                                                                                                                                          T1547

                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                          1
                                                                                                                                                                          T1547.001

                                                                                                                                                                          Event Triggered Execution

                                                                                                                                                                          1
                                                                                                                                                                          T1546

                                                                                                                                                                          Component Object Model Hijacking

                                                                                                                                                                          1
                                                                                                                                                                          T1546.015

                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                          1
                                                                                                                                                                          T1547

                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                          1
                                                                                                                                                                          T1547.001

                                                                                                                                                                          Event Triggered Execution

                                                                                                                                                                          1
                                                                                                                                                                          T1546

                                                                                                                                                                          Component Object Model Hijacking

                                                                                                                                                                          1
                                                                                                                                                                          T1546.015

                                                                                                                                                                          Defense Evasion

                                                                                                                                                                          Indicator Removal

                                                                                                                                                                          1
                                                                                                                                                                          T1070

                                                                                                                                                                          File Deletion

                                                                                                                                                                          1
                                                                                                                                                                          T1070.004

                                                                                                                                                                          Modify Registry

                                                                                                                                                                          3
                                                                                                                                                                          T1112

                                                                                                                                                                          Subvert Trust Controls

                                                                                                                                                                          2
                                                                                                                                                                          T1553

                                                                                                                                                                          Install Root Certificate

                                                                                                                                                                          1
                                                                                                                                                                          T1553.004

                                                                                                                                                                          SIP and Trust Provider Hijacking

                                                                                                                                                                          1
                                                                                                                                                                          T1553.003

                                                                                                                                                                          Credential Access

                                                                                                                                                                          Credentials from Password Stores

                                                                                                                                                                          2
                                                                                                                                                                          T1555

                                                                                                                                                                          Credentials from Web Browsers

                                                                                                                                                                          1
                                                                                                                                                                          T1555.003

                                                                                                                                                                          Windows Credential Manager

                                                                                                                                                                          1
                                                                                                                                                                          T1555.004

                                                                                                                                                                          Unsecured Credentials

                                                                                                                                                                          1
                                                                                                                                                                          T1552

                                                                                                                                                                          Credentials In Files

                                                                                                                                                                          1
                                                                                                                                                                          T1552.001

                                                                                                                                                                          Discovery

                                                                                                                                                                          Browser Information Discovery

                                                                                                                                                                          1
                                                                                                                                                                          T1217

                                                                                                                                                                          Peripheral Device Discovery

                                                                                                                                                                          2
                                                                                                                                                                          T1120

                                                                                                                                                                          Query Registry

                                                                                                                                                                          5
                                                                                                                                                                          T1012

                                                                                                                                                                          System Information Discovery

                                                                                                                                                                          5
                                                                                                                                                                          T1082

                                                                                                                                                                          System Location Discovery

                                                                                                                                                                          1
                                                                                                                                                                          T1614

                                                                                                                                                                          System Language Discovery

                                                                                                                                                                          1
                                                                                                                                                                          T1614.001

                                                                                                                                                                          Lateral Movement

                                                                                                                                                                          Collection

                                                                                                                                                                          Data from Local System

                                                                                                                                                                          1
                                                                                                                                                                          T1005

                                                                                                                                                                          Command and Control

                                                                                                                                                                          Web Service

                                                                                                                                                                          1
                                                                                                                                                                          T1102

                                                                                                                                                                          Exfiltration

                                                                                                                                                                          Impact

                                                                                                                                                                          Defacement

                                                                                                                                                                          1
                                                                                                                                                                          T1491

                                                                                                                                                                          Inhibit System Recovery

                                                                                                                                                                          1
                                                                                                                                                                          T1490

                                                                                                                                                                          Replay Monitor

                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                          Downloads

                                                                                                                                                                          3OMOm22Dm.doc
                                                                                                                                                                          • Path C:\3OMOm22Dm\3OMOm22Dm.doc
                                                                                                                                                                          • Size 91KB
                                                                                                                                                                          • SHA256 d55994846075d1b25c74397900c63f7d51a9e83c3944bfab0c0530ca9727e316
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          3OMOm22Dm.jpg
                                                                                                                                                                          • Path C:\3OMOm22Dm\3OMOm22Dm.jpg
                                                                                                                                                                          • Size 59KB
                                                                                                                                                                          • SHA256 42e271b2b7fbdd8f19dd6521163cb694ea5605441eff8e2d6d7d0807adba32d5
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          3OMOm22Dm.sql
                                                                                                                                                                          • Path C:\3OMOm22Dm\3OMOm22Dm.sql
                                                                                                                                                                          • Size 84KB
                                                                                                                                                                          • SHA256 e497991c8ac6ff00d402001bd10f91e5e9721375eae098ea5f4d3028eb5e280e
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          3OMOm22Dm.xls
                                                                                                                                                                          • Path C:\3OMOm22Dm\3OMOm22Dm.xls
                                                                                                                                                                          • Size 106KB
                                                                                                                                                                          • SHA256 167abb27e9b7e1b3eefc6d30206b47b224ceed11854579dbd30f20f98c08397e
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          ZOMOm22Dm.mdb
                                                                                                                                                                          • Path C:\3OMOm22Dm\ZOMOm22Dm.mdb
                                                                                                                                                                          • Size 318KB
                                                                                                                                                                          • SHA256 94378b1befdf32e16ca217c721e973e56370927a6da21b31ea9df61bfdfa2945
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          ZOMOm22Dm.txt
                                                                                                                                                                          • Path C:\3OMOm22Dm\ZOMOm22Dm.txt
                                                                                                                                                                          • Size 956B
                                                                                                                                                                          • SHA256 978a1c917e10c396a26a9b75d99a097a9b116a49a4be4d65090cb44899ddfa9d
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Eg.dll
                                                                                                                                                                          • Path C:\Program Files (x86)\WiseVector\Eg.dll
                                                                                                                                                                          • Size 1.2MB
                                                                                                                                                                          • SHA256 3dac7f7afc7fb390879bfb463a30f81ecb9892560d8370046c3de1d6aff150b3
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          EgAddtionalHelper.dll
                                                                                                                                                                          • Path C:\Program Files (x86)\WiseVector\EgAddtionalHelper.dll
                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                          • SHA256 43a6e1c08964e709d934192d8485609922abe9772424ecac9c7ec451b3ea7cbd
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          EgHelperOne.dll
                                                                                                                                                                          • Path C:\Program Files (x86)\WiseVector\EgHelperOne.dll
                                                                                                                                                                          • Size 755KB
                                                                                                                                                                          • SHA256 4f97f0d1f90f63825c0e70f0fca5e4c9ecf4c0250c5354ee1b272a0a6204ab65
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          EgHelperThree.dll
                                                                                                                                                                          • Path C:\Program Files (x86)\WiseVector\EgHelperThree.dll
                                                                                                                                                                          • Size 205KB
                                                                                                                                                                          • SHA256 47afad03a77ec17621fd688ecc4d160347363adf9890f98db90a3057005568dc
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          EgHelperTwo.dll
                                                                                                                                                                          • Path C:\Program Files (x86)\WiseVector\EgHelperTwo.dll
                                                                                                                                                                          • Size 202KB
                                                                                                                                                                          • SHA256 3ceb8aeaa245fbf1c6afa10bf0362f1c0ddb178e9a592eb2ccb81919728a5061
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          WiseVector.exe
                                                                                                                                                                          • Path C:\Program Files (x86)\WiseVector\WiseVector.exe
                                                                                                                                                                          • Size 7.3MB
                                                                                                                                                                          • SHA256 f870de431bbc5b87044e87b9288a87c78b0d0e2ebdcf24077734e8bab8acf42e
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          WiseVectorExt_X64.dll
                                                                                                                                                                          • Path C:\Program Files (x86)\WiseVector\WiseVectorExt_X64.dll
                                                                                                                                                                          • Size 154KB
                                                                                                                                                                          • SHA256 dd2a3b68994ffb5b5e84d2cf9171ada5d0be41f49ae756f7f08c7285c1ff3e8d
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          WiseVectorService.exe
                                                                                                                                                                          • Path C:\Program Files (x86)\WiseVector\WiseVectorService.exe
                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                          • SHA256 79b22bca302ea4deee74d8bb748f1330a18ff14f9bab53375a293d19375fc3cc
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          WiseVectorSvc.exe
                                                                                                                                                                          • Path C:\Program Files (x86)\WiseVector\WiseVectorSvc.exe
                                                                                                                                                                          • Size 102KB
                                                                                                                                                                          • SHA256 4e4b6e7e1fc47e0a7a29cca24ecbc8f923e5966801e1645987954a9a4fe39b4f
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          english.dat
                                                                                                                                                                          • Path C:\Program Files (x86)\WiseVector\lang\english.dat
                                                                                                                                                                          • Size 181B
                                                                                                                                                                          • SHA256 e616a32ca4a81baa3158746c4bfcd6c631697afc77af537dd1bb461ab40e97b0
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          libcrypto-1_1.dll
                                                                                                                                                                          • Path C:\Program Files (x86)\WiseVector\libcrypto-1_1.dll
                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                          • SHA256 16be78b4ebaa90cd1ee7f18983fef4e7a81910d63e34afc66fa877d72f510501
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          vcomp120.dll
                                                                                                                                                                          • Path C:\Program Files (x86)\WiseVector\vcomp120.dll
                                                                                                                                                                          • Size 116KB
                                                                                                                                                                          • SHA256 fc12360ff09830bf08b7a2a238016eea2b9e9475cbea4c22043b264e76b3420c
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          wvsetting.ini
                                                                                                                                                                          • Path C:\Program Files (x86)\WiseVector\wvsetting.ini
                                                                                                                                                                          • Size 718B
                                                                                                                                                                          • SHA256 8c171786b70136d35bfbf1a82171b40f58d304d4e20e82b3811a9e8adb4e91e0
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          wvsetting.ini
                                                                                                                                                                          • Path C:\Program Files (x86)\WiseVector\wvsetting.ini
                                                                                                                                                                          • Size 718B
                                                                                                                                                                          • SHA256 2ccb17bb5949d19b2158ff439f9930f0ab4f43c0f05d69a7824ebaf440570412
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          wvsetting.ini
                                                                                                                                                                          • Path C:\Program Files (x86)\WiseVector\wvsetting.ini
                                                                                                                                                                          • Size 718B
                                                                                                                                                                          • SHA256 72e53e1b71f99decb0d9dc37a07a23f63f9d9aa134bb79cc8a183b0f82c64a5a
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                                                                                          • Size 64KB
                                                                                                                                                                          • SHA256 b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                                                          • Size 4B
                                                                                                                                                                          • SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                                                                                          • Size 1008B
                                                                                                                                                                          • SHA256 80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          f_000001
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
                                                                                                                                                                          • Size 210KB
                                                                                                                                                                          • SHA256 04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          f_000002
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002
                                                                                                                                                                          • Size 24KB
                                                                                                                                                                          • SHA256 e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          the-real-index
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                          • Size 216B
                                                                                                                                                                          • SHA256 6fe9f5a4f7609a763cb07766e55e21acc20b1ae7a524322fca600fc6025ba4b7
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          the-real-index
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                          • Size 216B
                                                                                                                                                                          • SHA256 80b73f7f2d97a84628d26bcfe3afa75960a1d88e9c566e51bb4e2829137fddc0
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          the-real-index
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                          • Size 216B
                                                                                                                                                                          • SHA256 9592c25ae7dd72203f1aedcf9b1741bdb9c6ca2229ddb2c7e0121b0d63f1e5fe
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          data_1
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1
                                                                                                                                                                          • Size 264KB
                                                                                                                                                                          • SHA256 975815a4811317faa805ab0cfe4ee31d97d479f05378b5eb94e4152515716559
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Network Persistent State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                          • Size 2KB
                                                                                                                                                                          • SHA256 f50079d51f8dcf69ccdbe262ad4a18226c9c13b9c9f0e40dff20facaf7d09369
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Network Persistent State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                          • Size 2KB
                                                                                                                                                                          • SHA256 d19ac9f9d801a76e85135ccfebe29a7fb1a935eb9c40f49024c2cbb828f0e89b
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          SCT Auditing Pending Reports
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                          • Size 2B
                                                                                                                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                          • Size 356B
                                                                                                                                                                          • SHA256 9d252af09afbbebc346f9804ea9c7616b09f2997b37f6aab270f8f87725752c6
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                          • Size 356B
                                                                                                                                                                          • SHA256 f8adc71c78b9b7abdb6e9061fa0da58a2127bd05fbf0704a93759d86f53d78c8
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                          • Size 356B
                                                                                                                                                                          • SHA256 55449f92bd7f418977457a91a8cbf931a7ba0f0a335751a6c5c762315e6015d7
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                          • Size 8KB
                                                                                                                                                                          • SHA256 91035f04296c7547a4f521a99838ab77a3035caed6cf4f72f1521c054c22ec3e
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                          • Size 9KB
                                                                                                                                                                          • SHA256 5b67505e9abc2375bf9c0311ae88aeab0922e53e9c54a8dccd3e280f81ecd08a
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                          • Size 8KB
                                                                                                                                                                          • SHA256 a1ad1c00bf0eb712218a9e861cb292e2252ef5b216f34098e4926b65576b6a48
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                          • Size 9KB
                                                                                                                                                                          • SHA256 2ce3cfa03fef720f6a653d419a040f19d9507633fd6bc1de3e1516d4ae662556
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                          • Size 9KB
                                                                                                                                                                          • SHA256 4e2dcb68385e56795b1f5804d78ddab66b6ea84c9c3e7be2f135c6ffd6f1d54c
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                          • Size 9KB
                                                                                                                                                                          • SHA256 f73afe1a026fe378e8ff59b097fd6248532a1649de561b7c6fa8459e16baf1c3
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                          • Size 9KB
                                                                                                                                                                          • SHA256 8ebe9841b9796914ee17bc5325c1f216c95a09cbb13f43585f3fc201ceef7c74
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                          • Size 9KB
                                                                                                                                                                          • SHA256 d240d3da14424e91b8c314f816a9051655b280fa4edf1232060a7128f4f26952
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                          • Size 9KB
                                                                                                                                                                          • SHA256 57233cd84245c3fbf998489fb5b7db335af41146600fddae976c8b3129b4e94a
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Secure Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                          • Size 13KB
                                                                                                                                                                          • SHA256 68ff170fe212ffe5a25c2f68a917fe44b899c83bf1a416e4e2a6d24ca812bcc7
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Local State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                          • Size 196KB
                                                                                                                                                                          • SHA256 6e1bb000906e1f60409427f5563ac065f530a2aa4432fec2512ec55ab841fff1
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Local State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                          • Size 101KB
                                                                                                                                                                          • SHA256 cc2a84400f8788b80a9ddd9f8675581053c6459e4752e38fce904c63c487a8bb
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Local State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                          • Size 215KB
                                                                                                                                                                          • SHA256 5920c9a54e118234f7fb6c3e3a42f9f0dc7ba26c94e416c82e199a51c69ad117
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Local State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                          • Size 196KB
                                                                                                                                                                          • SHA256 b004d23530cc3d0ce85e81cf6f4b2de0601c515130415cfa2c3129c4f63ad6c1
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Local State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                          • Size 196KB
                                                                                                                                                                          • SHA256 73bd5678c8d8305ca815d8987d8f76452da0998198d4617f27071b6ac77602ae
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Local State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                          • Size 238KB
                                                                                                                                                                          • SHA256 a1300e42f092ee79632fabf25ea72285aac186b062f0671f59a150a5329b2a29
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Local State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                          • Size 196KB
                                                                                                                                                                          • SHA256 5bd28410ed5c5ffef3c5afa1df291441dcec01a182c595f2578a686f9d1f6a99
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          settings.dat
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                          • Size 152B
                                                                                                                                                                          • SHA256 f286c908fea67163f02532503b5555a939f894c6f2e683d80679b7e5726a7c02
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          settings.dat
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                          • Size 152B
                                                                                                                                                                          • SHA256 0a4781bca132edf11500537cbf95ff840c2b6fd33cd94809ca9929f00044bea4
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          settings.dat
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                          • Size 152B
                                                                                                                                                                          • SHA256 c9a88e177d69d77a748e107ec9bccb7f2198b9cbe7cc55fb85b45ddc9a88226f
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          settings.dat
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                          • Size 152B
                                                                                                                                                                          • SHA256 700d8496273147f65d773f83ff9978f7cd9ced93211f91cbfe345b40d36cc41b
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          f_000002
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
                                                                                                                                                                          • Size 64KB
                                                                                                                                                                          • SHA256 34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          f_000003
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
                                                                                                                                                                          • Size 69KB
                                                                                                                                                                          • SHA256 e83f90413d723b682d15972abeaaa71b9cead9b0c25bf8aac88485d4be46fb85
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          f_000004
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
                                                                                                                                                                          • Size 41KB
                                                                                                                                                                          • SHA256 0d8b4860b16e4ee74beff0e2034bd195352dba61a455efdeb35d6ede7c4c7391
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          f_000005
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
                                                                                                                                                                          • Size 63KB
                                                                                                                                                                          • SHA256 c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          f_000006
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
                                                                                                                                                                          • Size 19KB
                                                                                                                                                                          • SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          f_000007
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
                                                                                                                                                                          • Size 88KB
                                                                                                                                                                          • SHA256 b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          f_000008
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
                                                                                                                                                                          • Size 1.2MB
                                                                                                                                                                          • SHA256 6f0e8c5ae26abbae3efc6ca213cacaaebd19bf2c7ed88495289a8f40428803dd
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          f_000046
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000046
                                                                                                                                                                          • Size 17KB
                                                                                                                                                                          • SHA256 fe92360bd913b8efc670f27e88e61484dd1ce68d7689cd3b4f6722b96ff6e0f5
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          temp-index
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                                                          • Size 5KB
                                                                                                                                                                          • SHA256 cb16c1d2f3c619924eef986d385f90f5cdab0453ba86808e4aa83acd45327c81
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          the-real-index
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                          • Size 4KB
                                                                                                                                                                          • SHA256 a1bd73579e0e74163e21d6fc65c1f7cc1e9a9ba7889a6837fe7345036ca76ecf
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          the-real-index
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                          • Size 4KB
                                                                                                                                                                          • SHA256 4c252cda31980aa61033ada3f8cc5dc8ccbeb4b9048811c54082be76be4d7094
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          the-real-index
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                          • Size 3KB
                                                                                                                                                                          • SHA256 5d990552c5e12bb29d804fceab61ed13eaa8d000b1ed082688aa50018d8b45cc
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          the-real-index
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                          • Size 4KB
                                                                                                                                                                          • SHA256 7ede1e0317f98823112ff5c9da2cfff44b8c7a831c0a6e317ae6a655d7562314
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          the-real-index
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                          • Size 5KB
                                                                                                                                                                          • SHA256 c6345ff70fa7fd3020ef0cf34463d206e996dbb3c769b1985aedf2782b4e5468
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Network Persistent State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                          • Size 713B
                                                                                                                                                                          • SHA256 088bba5cb0e8823c1c85390e3242c3bd7f572e15a7c1fcfc6a87d4f24b81b1fc
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Network Persistent State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                          • Size 4KB
                                                                                                                                                                          • SHA256 381e69badfdbf987982ad1fc8339b45bc0a9b441428dd5c27ea089281fc31eec
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Network Persistent State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                          • Size 4KB
                                                                                                                                                                          • SHA256 09d3a363e9445258c65e0794f71b2ed7d1a5d8436ff125798be343cea8e62823
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Network Persistent State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                          • Size 4KB
                                                                                                                                                                          • SHA256 8dd6732a51b0e17f54a0f1e747b362fbc94e5508bfecf82acdf1dff0b756e2e3
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Network Persistent State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                          • Size 5KB
                                                                                                                                                                          • SHA256 1043edba3b25d7ff59520bc18b260b785660c47e6be7eb496145785e178e4ab0
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                          • Size 5KB
                                                                                                                                                                          • SHA256 c13392568a6e5d22e81eabb11f9774ce13d8d1a091ae2ad378420be00a1df305
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                          • Size 6KB
                                                                                                                                                                          • SHA256 b9f1854a8b081d13edb34239cd313bacb19ca47add3047d4affaa1db44976c65
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                          • Size 8KB
                                                                                                                                                                          • SHA256 4c57034f224863a01f8b7976a057a2a4fc2a4ddd708d68e4dcd1d292cd115d36
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                          • Size 8KB
                                                                                                                                                                          • SHA256 4deb5f9da45d0a3303bfe444dbfa292eaaf1bad0edf7ab49f7ea63ae08dfecef
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                          • Size 9KB
                                                                                                                                                                          • SHA256 0b8bbbdf4fe57be591494566117a9ecf151e99dfbbf5f6d17853389c634b48dc
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                          • Size 5KB
                                                                                                                                                                          • SHA256 96cf68e93614500d2b034afcc049650b14be3bd5bc014c849e63b6a474a2a78a
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                          • Size 6KB
                                                                                                                                                                          • SHA256 993ae179d802500200dd02dee42ef25e2c55d5e07f3f11c873d2af4a43aa7141
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                          • Size 10KB
                                                                                                                                                                          • SHA256 1cd5d0adba9f8d135c0bcbb8cd7ec13c4107006fea6674eac1fa030c751d3f3a
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                          • Size 10KB
                                                                                                                                                                          • SHA256 6092e703224e883bf32b6bd2effcbfe6541768bac18619116fa9c02f7105877c
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                          • Size 10KB
                                                                                                                                                                          • SHA256 7e3774b50aa3b519833ba801361844d12f2d1e890646ab93f324dd9ad9767e3d
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                          • Size 10KB
                                                                                                                                                                          • SHA256 4ec49a4678724f987aeaf7d64789e82e592b9f10854210f296458c5bb37c24a0
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                          • Size 10KB
                                                                                                                                                                          • SHA256 3beb5426adfca0b4661fe68a8f5135f5b1706616fe98ab85b030ad13fd5ea808
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                          • Size 10KB
                                                                                                                                                                          • SHA256 4b3829352cc894ac9670448f0322784e6b9765218b88c168a1212fa80b57b8e1
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                          • Size 10KB
                                                                                                                                                                          • SHA256 6c4919d43f5b07b23cf2de49c3614dd56cc83a945dbdc8773d7a679e60c0cfae
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Preferences
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                          • Size 10KB
                                                                                                                                                                          • SHA256 fc0c5ad1af7f9edaac8ecc9f9d9cc032c322266cbc53efd17aa872897f036c8f
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                          • Size 3KB
                                                                                                                                                                          • SHA256 16f13a6c58f19c34cc595faa5b13660fe47eaac255ae1b911200dcaadf155837
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                          • Size 3KB
                                                                                                                                                                          • SHA256 c744e0ec648976e3b93a08e6a287364dbea6ceb8f70f8aa1d0f8c6381a8a82df
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                          • Size 1KB
                                                                                                                                                                          • SHA256 ba4430c410815a471af1a8ea2ad8fa9a82e9f0b7f4abfee9bdafbed98f98fbfe
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                          • Size 1KB
                                                                                                                                                                          • SHA256 8ca58ee087158a03a4c44c449b6e96b0493473343b3730f5e7e43dbd3ff2fbfd
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                          • Size 3KB
                                                                                                                                                                          • SHA256 3dcf6aafd048381654802a1ce48bbe5ceced819866ed64b4961289c414eaa84d
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                          • Size 3KB
                                                                                                                                                                          • SHA256 58e000db9959945d79949c8e02c68d9e8f7aa2fc10887a9b39149e009229e314
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                          • Size 3KB
                                                                                                                                                                          • SHA256 a78bd1f19219919bb6e39fb85235f6387bd13d9ef06c774f8531013ad35a282a
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                          • Size 3KB
                                                                                                                                                                          • SHA256 1c9da2fee0c109513153bcafda5dff52e0360af53dea9b6b4adbebafdf800b84
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                          • Size 3KB
                                                                                                                                                                          • SHA256 3634b4d511c71c92b5fd2eb48e18791155c4c3e62a8ebfb89325d443546b263e
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                          • Size 3KB
                                                                                                                                                                          • SHA256 e7bce8c103d8a90191d142f3badbf5932581a6b0699b062da0dd28bdc85f66a4
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                          • Size 3KB
                                                                                                                                                                          • SHA256 dc578a79c7545c37c1f919f6a1695419c8f5d14c24ac57f8c37c1b5518c62150
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                          • Size 3KB
                                                                                                                                                                          • SHA256 d57afabab476558ee89c3ffd3f40a59efd7e76567b4950c387215728fb5ef2eb
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                          • Size 3KB
                                                                                                                                                                          • SHA256 97a4b5145828e0843ce37bc2978ab962ed96326998eb247765f53b811fe2ca95
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                          • Size 3KB
                                                                                                                                                                          • SHA256 03aa26b51f9f69c165178e7ec9375d929501d00d22cedad5cca3fb168cd42aa2
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                          • Size 3KB
                                                                                                                                                                          • SHA256 976d4a264b625e267e3693bebfca9de3c3bdf6a6e81bf7a5083ed1a9084df6aa
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                          • Size 3KB
                                                                                                                                                                          • SHA256 d9849f64bf029da7bdfe1e1fff01df388a46fad4d8b6ec6321929566a578594d
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                          • Size 3KB
                                                                                                                                                                          • SHA256 857c4d75e93d1b659cf7573028491da18d3043c80ac54bd37d7cbd467996fa05
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                          • Size 3KB
                                                                                                                                                                          • SHA256 7327c23f83baf9e7831d2b48197ffa8b351b0fc41ba4f7fd8edcca1aaed26ad6
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                          • Size 3KB
                                                                                                                                                                          • SHA256 01be802ea1ca93fd78f4649f93d8988f2a74979b71f824393e10a64c910889d0
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          TransportSecurity~RFe5881be.TMP
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5881be.TMP
                                                                                                                                                                          • Size 1KB
                                                                                                                                                                          • SHA256 4c1559a824222c2dae872827db0f53dc198ded36b11f39cd8e96b2802849a533
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          b2424b21-8530-4a6b-8762-cd20b173d3d1.tmp
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b2424b21-8530-4a6b-8762-cd20b173d3d1.tmp
                                                                                                                                                                          • Size 1B
                                                                                                                                                                          • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          CURRENT
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                          • Size 16B
                                                                                                                                                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          CURRENT
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                          • Size 16B
                                                                                                                                                                          • SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          CURRENT
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                          • Size 16B
                                                                                                                                                                          • SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Local State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                          • Size 11KB
                                                                                                                                                                          • SHA256 c260d40180883e689f73186a797ed14a9f297b5090f3483e1cf5d941b30c5c80
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Local State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                          • Size 11KB
                                                                                                                                                                          • SHA256 b82c3e37b66ef88436f7cc6cbaa687f1af4bc4c6a0e7d8c7a6b259be8918e761
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Local State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                          • Size 11KB
                                                                                                                                                                          • SHA256 6dc4f04410afbefc691f08392182faf08ad34544d7ef1011d99e02f0ba83901d
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Local State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                          • Size 11KB
                                                                                                                                                                          • SHA256 3dc66129644682764b48c6a72aa53a679ba5293098b4eae904a57d4beabc0256
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Local State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                          • Size 11KB
                                                                                                                                                                          • SHA256 98a68e47c18ed60a80e305b1291cece3184bfc3b9d0191057199d823b464efef
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Local State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                          • Size 11KB
                                                                                                                                                                          • SHA256 3debf9f57bbc7bf9a152fab621e8e9bb8b46867e84ed6b4e5a87387ad00992a2
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Local State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                          • Size 11KB
                                                                                                                                                                          • SHA256 24a890d8fa49befd5bfa90ca53de54cc7fe4e1b6cf9de100ce5bdf57f5f1a3b2
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Local State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                          • Size 11KB
                                                                                                                                                                          • SHA256 cb2de8345ed8ddcc1b1cf714f781cd842c7c7d44deeb7b18ce843abb51e9d7eb
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Local State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                          • Size 11KB
                                                                                                                                                                          • SHA256 a628b5ee10b80f1ed4e38ced62f25e4df57bee33fd1c9ffb0b91879579dff68d
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Local State
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                          • Size 11KB
                                                                                                                                                                          • SHA256 30f22c432b9ec5389626539bd2f40d23da38e16b6c0ddeebb3b571382f06b3c5
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          SearchHoverUnifiedTileModelCache.dat
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
                                                                                                                                                                          • Size 10KB
                                                                                                                                                                          • SHA256 afb0f4a0229174f8118ab512b569fdb9eb3ebb0389cb11c9f4a0a2aa88ec258b
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          BgWorker.dll
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nse8797.tmp\BgWorker.dll
                                                                                                                                                                          • Size 2KB
                                                                                                                                                                          • SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          System.dll
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nse8797.tmp\System.dll
                                                                                                                                                                          • Size 11KB
                                                                                                                                                                          • SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          nsNiuniuSkin.dll
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nse8797.tmp\nsNiuniuSkin.dll
                                                                                                                                                                          • Size 904KB
                                                                                                                                                                          • SHA256 f125ed6489f16f1681ea92e30f6670f72e0951cd7948df9a043e04ee512ccbeb
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          nsProcess.dll
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nse8797.tmp\nsProcess.dll
                                                                                                                                                                          • Size 4KB
                                                                                                                                                                          • SHA256 51da07da18a5486b11e0d51ebff77a3f2fcbb4d66b5665d212cc6bda480c4257
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          nsis7zU.dll
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nse8797.tmp\nsis7zU.dll
                                                                                                                                                                          • Size 313KB
                                                                                                                                                                          • SHA256 e4ab3064f2e094910ae80104ef9d371ccb74ebbeeed592582cf099acd83f5fe9
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          skin.zip
                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nse8797.tmp\skin.zip
                                                                                                                                                                          • Size 105KB
                                                                                                                                                                          • SHA256 428bb7bff14ec54436dc993276cb51da0be0d63b8773bfc627bcdec51af5dd2d
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          !WannaDecryptor!.exe.lnk
                                                                                                                                                                          • Path C:\Users\Admin\Documents\ZOMOm22Dm\!WannaDecryptor!.exe.lnk
                                                                                                                                                                          • Size 590B
                                                                                                                                                                          • SHA256 0944a57b1381930e5a4492792aa4dd86521d7cae0f757fe99ca9eed8b97d378f
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          !Please Read Me!.txt
                                                                                                                                                                          • Path C:\Users\Admin\Downloads\!Please Read Me!.txt
                                                                                                                                                                          • Size 797B
                                                                                                                                                                          • SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          CryptoLocker.exe:Zone.Identifier
                                                                                                                                                                          • Path C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier
                                                                                                                                                                          • Size 55B
                                                                                                                                                                          • SHA256 2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Unconfirmed 176596.crdownload
                                                                                                                                                                          • Path C:\Users\Admin\Downloads\Unconfirmed 176596.crdownload
                                                                                                                                                                          • Size 224KB
                                                                                                                                                                          • SHA256 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Unconfirmed 382973.crdownload:SmartScreen
                                                                                                                                                                          • Path C:\Users\Admin\Downloads\Unconfirmed 382973.crdownload:SmartScreen
                                                                                                                                                                          • Size 7B
                                                                                                                                                                          • SHA256 82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          Unconfirmed 914471.crdownload
                                                                                                                                                                          • Path C:\Users\Admin\Downloads\Unconfirmed 914471.crdownload
                                                                                                                                                                          • Size 338KB
                                                                                                                                                                          • SHA256 d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          WiseVector_StopX.exe
                                                                                                                                                                          • Path C:\Users\Admin\Downloads\WiseVector_StopX.exe
                                                                                                                                                                          • Size 50.0MB
                                                                                                                                                                          • SHA256 1a60b743b79c688c04f51195f64887f3399c59a94251e4e74fbb6c919fb9756d
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          WiseVector_StopX.exe:Zone.Identifier
                                                                                                                                                                          • Path C:\Users\Admin\Downloads\WiseVector_StopX.exe:Zone.Identifier
                                                                                                                                                                          • Size 26B
                                                                                                                                                                          • SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                          Submit Download

                                                                                                                                                                          u.wry
                                                                                                                                                                          • Path C:\Users\Admin\Downloads\u.wry
                                                                                                                                                                          • Size 236KB
                                                                                                                                                                          • SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                          Submit Download

                                                                                                                                                                          memory/1032-1312-0x0000000069620000-0x0000000069702000-memory.dmp
                                                                                                                                                                          Download

                                                                                                                                                                          memory/2108-1245-0x0000000069620000-0x0000000069702000-memory.dmp
                                                                                                                                                                          Download

                                                                                                                                                                          memory/2300-18055-0x0000000069620000-0x0000000069702000-memory.dmp
                                                                                                                                                                          Download

                                                                                                                                                                          memory/3016-18255-0x0000000010000000-0x0000000010012000-memory.dmp
                                                                                                                                                                          Download

                                                                                                                                                                          memory/3704-1446-0x00000000705A0000-0x0000000073AD4000-memory.dmp
                                                                                                                                                                          Download

                                                                                                                                                                          memory/3704-1241-0x00000000705A0000-0x0000000073AD4000-memory.dmp
                                                                                                                                                                          Download

                                                                                                                                                                          memory/3704-1239-0x0000000069ED0000-0x0000000069F31000-memory.dmp
                                                                                                                                                                          Download

                                                                                                                                                                          memory/3704-1236-0x0000000069FB0000-0x000000006AFB0000-memory.dmp
                                                                                                                                                                          Download

                                                                                                                                                                          memory/3704-1242-0x00000000705A0000-0x0000000073AD4000-memory.dmp
                                                                                                                                                                          Download

                                                                                                                                                                          memory/3704-1237-0x0000000069F40000-0x0000000069FA2000-memory.dmp
                                                                                                                                                                          Download