Analysis
-
max time kernel
769s -
max time network
769s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08-08-2024 14:43
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://bing.com/
Resource
win10v2004-20240802-en
General
-
Target
https://bing.com/
Malware Config
Extracted
C:\Users\Admin\Downloads\!Please Read Me!.txt
wannacry
15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (524) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 30 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
msedge.exemsedge.exemsedge.exemsedge.exeFree YouTube Downloader.exemsedge.exeFreeYoutubeDownloader.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exeCoronaVirus.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exeFree YouTube Downloader.exemsedge.exemsedge.exemsedge.exeFreeYoutubeDownloader.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation Free YouTube Downloader.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation FreeYoutubeDownloader.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation CoronaVirus.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation Free YouTube Downloader.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation FreeYoutubeDownloader.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation msedge.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 7 IoCs
Processes:
CoronaVirus.exeWannaCry.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini CoronaVirus.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDCA96.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDCA9D.tmp WannaCry.exe -
Executes dropped EXE 64 IoCs
Processes:
SafeMEMZ.exeWinNuke.98.exeWinNuke.98.exeAlerta.exeCoronaVirus.exeCoronaVirus.exeCoronaVirus.exeCoronaVirus.exeCoronaVirus.exeCoronaVirus.exeCoronaVirus.exeCoronaVirus.exeCoronaVirus.exeCoronaVirus.exeCoronaVirus.exemsedge.exemsedge.exemsedge.exeWannaCry.exe!WannaDecryptor!.exeWannaCry.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exemsedge.exemsedge.exemsedge.exeColorBug.exeColorBug.exeColorBug.exeColorBug.exeColorBug.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exeFreeYoutubeDownloader.exeFree YouTube Downloader.exeFreeYoutubeDownloader.exeFreeYoutubeDownloader.exeFree YouTube Downloader.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exebutterflyondesktop.exebutterflyondesktop.tmpbutterflyondesktop.exebutterflyondesktop.tmpButterflyOnDesktop.exemsedge.exemsedge.exemsedge.exepid process 1708 SafeMEMZ.exe 6140 WinNuke.98.exe 5400 WinNuke.98.exe 5864 Alerta.exe 5472 CoronaVirus.exe 5564 CoronaVirus.exe 1300 CoronaVirus.exe 5612 CoronaVirus.exe 5680 CoronaVirus.exe 4976 CoronaVirus.exe 5664 CoronaVirus.exe 5912 CoronaVirus.exe 2088 CoronaVirus.exe 5780 CoronaVirus.exe 3008 CoronaVirus.exe 13288 msedge.exe 13804 msedge.exe 13848 msedge.exe 15432 WannaCry.exe 15192 !WannaDecryptor!.exe 22984 WannaCry.exe 23436 !WannaDecryptor!.exe 13880 !WannaDecryptor!.exe 13964 !WannaDecryptor!.exe 16608 !WannaDecryptor!.exe 18228 msedge.exe 18068 msedge.exe 19352 msedge.exe 11340 ColorBug.exe 19160 ColorBug.exe 19972 ColorBug.exe 20036 ColorBug.exe 20856 ColorBug.exe 21604 msedge.exe 21572 msedge.exe 21716 msedge.exe 21184 msedge.exe 21440 msedge.exe 22840 FreeYoutubeDownloader.exe 22504 Free YouTube Downloader.exe 19416 FreeYoutubeDownloader.exe 23260 FreeYoutubeDownloader.exe 22996 Free YouTube Downloader.exe 540 msedge.exe 23112 msedge.exe 22776 msedge.exe 22304 msedge.exe 18608 msedge.exe 21136 msedge.exe 21520 msedge.exe 12488 msedge.exe 20188 msedge.exe 20092 msedge.exe 19596 msedge.exe 15088 msedge.exe 19292 msedge.exe 19080 butterflyondesktop.exe 18804 butterflyondesktop.tmp 11032 butterflyondesktop.exe 6712 butterflyondesktop.tmp 17092 ButterflyOnDesktop.exe 17556 msedge.exe 17600 msedge.exe 16592 msedge.exe -
Loads dropped DLL 37 IoCs
Processes:
msedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exepid process 13288 msedge.exe 13804 msedge.exe 13848 msedge.exe 18228 msedge.exe 18068 msedge.exe 19352 msedge.exe 21604 msedge.exe 21572 msedge.exe 21716 msedge.exe 21184 msedge.exe 21440 msedge.exe 540 msedge.exe 23112 msedge.exe 22776 msedge.exe 22304 msedge.exe 18608 msedge.exe 21136 msedge.exe 21520 msedge.exe 12488 msedge.exe 20188 msedge.exe 20092 msedge.exe 19596 msedge.exe 15088 msedge.exe 19292 msedge.exe 16592 msedge.exe 15876 msedge.exe 5836 msedge.exe 3988 msedge.exe 27108 msedge.exe 27104 msedge.exe 23668 msedge.exe 23816 msedge.exe 24028 msedge.exe 6448 msedge.exe 25668 msedge.exe 26672 msedge.exe 27640 msedge.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
butterflyondesktop.tmpCoronaVirus.exeWannaCry.exeColorBug.exeFreeYoutubeDownloader.exeFreeYoutubeDownloader.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ButterflyOnDesktop butterflyondesktop.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe" CoronaVirus.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" CoronaVirus.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" CoronaVirus.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r" WannaCry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\~~CB = "cb.exe" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe" FreeYoutubeDownloader.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe" FreeYoutubeDownloader.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 64 IoCs
Processes:
CoronaVirus.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Pictures\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini CoronaVirus.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Music\desktop.ini CoronaVirus.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Documents\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Music\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Searches\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Videos\desktop.ini CoronaVirus.exe File opened for modification C:\Program Files\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Libraries\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Downloads\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Links\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini CoronaVirus.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Drops file in System32 directory 2 IoCs
Processes:
CoronaVirus.exedescription ioc process File created C:\Windows\System32\CoronaVirus.exe CoronaVirus.exe File created C:\Windows\System32\Info.hta CoronaVirus.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
!WannaDecryptor!.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp" !WannaDecryptor!.exe -
Drops file in Program Files directory 64 IoCs
Processes:
CoronaVirus.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_int_2x.gif.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\am.pak.DATA.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.195.15\msedgeupdateres_lv.dll.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.tree.dat.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageStoreLogo.scale-125_contrast-black.png CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosMedTile.scale-200.png CoronaVirus.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\ui-strings.js.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Windows Media Player\mpvis.DLL CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailSmallTile.scale-400.png CoronaVirus.exe File created C:\Program Files\Java\jre-1.8\bin\management.dll.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedMedTile.scale-100.png CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\DialSticker.mp4 CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupMedTile.scale-100.png CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Text.Encoding.Extensions.dll CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\msolap.dll.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\es-es\ui-strings.js.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\SLINTL.DLL.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml CoronaVirus.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.winmd CoronaVirus.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll CoronaVirus.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Updater.api.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-125_contrast-black.png CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_gridview.svg CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\msipc.dll.mui.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_same_reviewers.gif.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Context.Tests.ps1 CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\PointerIndicatorGeometryShader.cso CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\tesselate.x3d.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\HostConfigHighContrast.json CoronaVirus.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\zh-hk_get.svg.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\AddressBook.png CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul.xrm-ms.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONGRAPHICS.DLL CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-30_altform-unplated.png CoronaVirus.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\plugin.jar.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll CoronaVirus.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-20.png CoronaVirus.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libwav_plugin.dll.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.195.15\msedgeupdateres_sr-Cyrl-RS.dll.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\AppxManifest.xml CoronaVirus.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libwav_plugin.dll CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_CatEye.png CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxLargeTile.scale-100.png CoronaVirus.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Controls.Ribbon.resources.dll.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ppd.xrm-ms.id-9C604B86.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\resources.pri CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-manifest.ini CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-30.png CoronaVirus.exe -
Drops file in Windows directory 9 IoCs
Processes:
FreeYoutubeDownloader.exeFreeYoutubeDownloader.exeFreeYoutubeDownloader.exedescription ioc process File opened for modification C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe FreeYoutubeDownloader.exe File opened for modification C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe FreeYoutubeDownloader.exe File opened for modification C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe FreeYoutubeDownloader.exe File opened for modification C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe FreeYoutubeDownloader.exe File opened for modification C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe FreeYoutubeDownloader.exe File opened for modification C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini FreeYoutubeDownloader.exe File opened for modification C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe FreeYoutubeDownloader.exe File created C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini FreeYoutubeDownloader.exe File opened for modification C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe FreeYoutubeDownloader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
taskkill.exetaskkill.exe!WannaDecryptor!.exeButterflyOnDesktop.exeWinNuke.98.exeCoronaVirus.exeCoronaVirus.execmd.exetaskkill.exeWannaCry.exeFreeYoutubeDownloader.exeBox.exeSafeMEMZ.exeCoronaVirus.exeCoronaVirus.execscript.exetaskkill.exebutterflyondesktop.exePCToaster.exeCoronaVirus.exe!WannaDecryptor!.exeFreeYoutubeDownloader.exebutterflyondesktop.tmpbutterflyondesktop.tmpWMIC.exeColorBug.exeBox.exeCoronaVirus.exe!WannaDecryptor!.exebutterflyondesktop.exeFreeYoutubeDownloader.exeAlerta.exeCoronaVirus.exeCoronaVirus.exeCoronaVirus.exeCoronaVirus.exe!WannaDecryptor!.exe!WannaDecryptor!.exeCoronaVirus.exeWannaCry.execmd.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language !WannaDecryptor!.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ButterflyOnDesktop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WinNuke.98.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CoronaVirus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CoronaVirus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WannaCry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FreeYoutubeDownloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Box.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SafeMEMZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CoronaVirus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CoronaVirus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language butterflyondesktop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCToaster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CoronaVirus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language !WannaDecryptor!.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FreeYoutubeDownloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language butterflyondesktop.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language butterflyondesktop.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ColorBug.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Box.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CoronaVirus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language !WannaDecryptor!.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language butterflyondesktop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FreeYoutubeDownloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Alerta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CoronaVirus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CoronaVirus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CoronaVirus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CoronaVirus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language !WannaDecryptor!.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language !WannaDecryptor!.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CoronaVirus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WannaCry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
WINWORD.EXEmsedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 28160 vssadmin.exe 12212 vssadmin.exe -
Kills process with taskkill 4 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 15060 taskkill.exe 15052 taskkill.exe 15040 taskkill.exe 15044 taskkill.exe -
Modifies Control Panel 64 IoCs
Processes:
ColorBug.exeColorBug.exeColorBug.exeColorBug.exeColorBug.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\Menu = "54 1 126" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\AppWorkspace = "144 178 34" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\Window = "250 177 77" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\ActiveBorder = "212 198 105" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\TitleText = "110 238 182" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\InactiveBorder = "20 159 54" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\WindowFrame = "191 56 80" ColorBug.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\MenuText = "179 235 96" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\WindowText = "214 6 197" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\ActiveTitle = "89 79 44" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\Scrollbar = "14 196 62" ColorBug.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\HilightText = "255 147 254" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\InactiveTitleText = "91 145 17" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\Scrollbar = "108 108 217" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\InactiveTitle = "89 104 120" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\WindowFrame = "204 250 17" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\HilightText = "144 216 246" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\Menu = "203 32 173" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\GrayText = "140 207 0" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\ButtonFace = "232 209 207" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\WindowText = "159 155 62" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\Window = "152 234 208" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\InactiveTitle = "85 0 165" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\AppWorkspace = "91 35 55" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\ActiveBorder = "107 2 193" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\ActiveBorder = "141 147 202" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\MenuText = "227 66 100" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\InactiveBorder = "160 55 65" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\ButtonShadow = "132 168 6" ColorBug.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\Background = "192 131 247" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\ButtonFace = "74 47 122" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\Menu = "20 255 64" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\Window = "67 104 227" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\AppWorkspace = "64 247 147" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\ButtonShadow = "167 147 39" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\InactiveTitle = "76 91 93" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\InactiveBorder = "157 242 138" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\WindowFrame = "175 19 162" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\GrayText = "139 138 246" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\ButtonFace = "188 255 163" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\InactiveBorder = "192 165 245" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\ButtonText = "233 28 249" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\AppWorkspace = "216 160 142" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\WindowText = "234 14 27" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\ButtonShadow = "16 160 10" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\WindowText = "54 118 98" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\ButtonText = "111 92 69" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\ButtonText = "80 197 136" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\Background = "229 206 25" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\InactiveTitle = "2 160 178" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\Menu = "136 241 1" ColorBug.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\Hilight = "144 197 19" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\InactiveTitleText = "167 59 200" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\InactiveTitleText = "10 194 250" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\WindowFrame = "60 178 8" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\ButtonShadow = "174 6 144" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\Scrollbar = "44 141 216" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\WindowText = "21 252 4" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\InactiveBorder = "21 236 83" ColorBug.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Colors\ButtonShadow = "18 148 131" ColorBug.exe -
Modifies registry class 4 IoCs
Processes:
msedge.exemsedge.exeOpenWith.exeOpenWith.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-656926755-4116854191-210765258-1000\{CA19BB08-518C-4175-8A9D-D30975337792} msedge.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings msedge.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings OpenWith.exe -
NTFS ADS 10 IoCs
Processes:
msedge.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 856203.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 236077.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 830697.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 339235.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 25173.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 763783.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 208781.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 747980.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 618658.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 493828.crdownload:SmartScreen msedge.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 1956 WINWORD.EXE 1956 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exeCoronaVirus.exepid process 3984 msedge.exe 3984 msedge.exe 4552 msedge.exe 4552 msedge.exe 3368 identity_helper.exe 3368 identity_helper.exe 3288 msedge.exe 3288 msedge.exe 4960 msedge.exe 4960 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 3152 msedge.exe 3152 msedge.exe 664 msedge.exe 664 msedge.exe 3720 msedge.exe 3720 msedge.exe 6020 msedge.exe 6020 msedge.exe 1400 msedge.exe 1400 msedge.exe 3044 msedge.exe 3044 msedge.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe 5472 CoronaVirus.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
msedge.exe!WannaDecryptor!.exepid process 4552 msedge.exe 13964 !WannaDecryptor!.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
Processes:
msedge.exepid process 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe -
Suspicious use of AdjustPrivilegeToken 51 IoCs
Processes:
AUDIODG.EXEvssvc.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exeWMIC.exedescription pid process Token: 33 2916 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2916 AUDIODG.EXE Token: SeBackupPrivilege 8544 vssvc.exe Token: SeRestorePrivilege 8544 vssvc.exe Token: SeAuditPrivilege 8544 vssvc.exe Token: SeDebugPrivilege 15052 taskkill.exe Token: SeDebugPrivilege 15044 taskkill.exe Token: SeDebugPrivilege 15040 taskkill.exe Token: SeDebugPrivilege 15060 taskkill.exe Token: SeIncreaseQuotaPrivilege 24112 WMIC.exe Token: SeSecurityPrivilege 24112 WMIC.exe Token: SeTakeOwnershipPrivilege 24112 WMIC.exe Token: SeLoadDriverPrivilege 24112 WMIC.exe Token: SeSystemProfilePrivilege 24112 WMIC.exe Token: SeSystemtimePrivilege 24112 WMIC.exe Token: SeProfSingleProcessPrivilege 24112 WMIC.exe Token: SeIncBasePriorityPrivilege 24112 WMIC.exe Token: SeCreatePagefilePrivilege 24112 WMIC.exe Token: SeBackupPrivilege 24112 WMIC.exe Token: SeRestorePrivilege 24112 WMIC.exe Token: SeShutdownPrivilege 24112 WMIC.exe Token: SeDebugPrivilege 24112 WMIC.exe Token: SeSystemEnvironmentPrivilege 24112 WMIC.exe Token: SeRemoteShutdownPrivilege 24112 WMIC.exe Token: SeUndockPrivilege 24112 WMIC.exe Token: SeManageVolumePrivilege 24112 WMIC.exe Token: 33 24112 WMIC.exe Token: 34 24112 WMIC.exe Token: 35 24112 WMIC.exe Token: 36 24112 WMIC.exe Token: SeIncreaseQuotaPrivilege 24112 WMIC.exe Token: SeSecurityPrivilege 24112 WMIC.exe Token: SeTakeOwnershipPrivilege 24112 WMIC.exe Token: SeLoadDriverPrivilege 24112 WMIC.exe Token: SeSystemProfilePrivilege 24112 WMIC.exe Token: SeSystemtimePrivilege 24112 WMIC.exe Token: SeProfSingleProcessPrivilege 24112 WMIC.exe Token: SeIncBasePriorityPrivilege 24112 WMIC.exe Token: SeCreatePagefilePrivilege 24112 WMIC.exe Token: SeBackupPrivilege 24112 WMIC.exe Token: SeRestorePrivilege 24112 WMIC.exe Token: SeShutdownPrivilege 24112 WMIC.exe Token: SeDebugPrivilege 24112 WMIC.exe Token: SeSystemEnvironmentPrivilege 24112 WMIC.exe Token: SeRemoteShutdownPrivilege 24112 WMIC.exe Token: SeUndockPrivilege 24112 WMIC.exe Token: SeManageVolumePrivilege 24112 WMIC.exe Token: 33 24112 WMIC.exe Token: 34 24112 WMIC.exe Token: 35 24112 WMIC.exe Token: 36 24112 WMIC.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exepid process 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
msedge.exepid process 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe -
Suspicious use of SetWindowsHookEx 30 IoCs
Processes:
msedge.exeWINWORD.EXE!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exeOpenWith.exeOpenWith.exeFreeYoutubeDownloader.exeFreeYoutubeDownloader.exeFreeYoutubeDownloader.exepid process 4552 msedge.exe 4552 msedge.exe 1956 WINWORD.EXE 1956 WINWORD.EXE 1956 WINWORD.EXE 1956 WINWORD.EXE 1956 WINWORD.EXE 1956 WINWORD.EXE 1956 WINWORD.EXE 1956 WINWORD.EXE 1956 WINWORD.EXE 1956 WINWORD.EXE 1956 WINWORD.EXE 1956 WINWORD.EXE 1956 WINWORD.EXE 1956 WINWORD.EXE 15192 !WannaDecryptor!.exe 15192 !WannaDecryptor!.exe 23436 !WannaDecryptor!.exe 23436 !WannaDecryptor!.exe 13880 !WannaDecryptor!.exe 13880 !WannaDecryptor!.exe 13964 !WannaDecryptor!.exe 13964 !WannaDecryptor!.exe 16608 !WannaDecryptor!.exe 17324 OpenWith.exe 20800 OpenWith.exe 22840 FreeYoutubeDownloader.exe 19416 FreeYoutubeDownloader.exe 23260 FreeYoutubeDownloader.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4552 wrote to memory of 4952 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 4952 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 224 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 3984 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 3984 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 2356 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 2356 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 2356 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 2356 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 2356 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 2356 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 2356 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 2356 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 2356 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 2356 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 2356 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 2356 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 2356 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 2356 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 2356 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 2356 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 2356 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 2356 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 2356 4552 msedge.exe msedge.exe PID 4552 wrote to memory of 2356 4552 msedge.exe msedge.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bing.com/1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff7d446f8,0x7ffff7d44708,0x7ffff7d447182⤵PID:4952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:22⤵PID:224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵PID:2356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:1192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:2188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:12⤵PID:1548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:2864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 /prefetch:82⤵PID:4832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:12⤵PID:916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:12⤵PID:1928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:12⤵PID:1352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:12⤵PID:4624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:12⤵PID:972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:12⤵PID:1532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:12⤵PID:532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6064 /prefetch:82⤵PID:1144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5892 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:12⤵PID:4820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:12⤵PID:1208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2168 /prefetch:12⤵PID:4008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:12⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:12⤵PID:220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2704 /prefetch:12⤵PID:4916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1872 /prefetch:12⤵PID:3680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:12⤵PID:3152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5260 /prefetch:82⤵PID:3008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:12⤵PID:4292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6668 /prefetch:82⤵PID:3380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:12⤵PID:4020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7212 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4960
-
-
C:\Users\Admin\Downloads\SafeMEMZ.exe"C:\Users\Admin\Downloads\SafeMEMZ.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3344 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:12⤵PID:2084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:12⤵PID:1360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:12⤵PID:232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1876 /prefetch:12⤵PID:2080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7388 /prefetch:12⤵PID:4052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:12⤵PID:4120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:12⤵PID:2280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2704 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:12⤵PID:4208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7888 /prefetch:12⤵PID:3168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:12⤵PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6192 /prefetch:82⤵PID:1000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=7740 /prefetch:82⤵PID:2280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7816 /prefetch:12⤵PID:64
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7364 /prefetch:82⤵PID:1812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:12⤵PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8288 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7716 /prefetch:12⤵PID:4228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3720
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\Melissa.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:12⤵PID:5868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1748 /prefetch:82⤵PID:5964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:6020
-
-
C:\Users\Admin\Downloads\WinNuke.98.exe"C:\Users\Admin\Downloads\WinNuke.98.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7864 /prefetch:12⤵PID:5588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1780 /prefetch:82⤵PID:5596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8136 /prefetch:12⤵PID:5616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7520 /prefetch:82⤵PID:3420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2196 /prefetch:12⤵PID:512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1740 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1400
-
-
C:\Users\Admin\Downloads\Alerta.exe"C:\Users\Admin\Downloads\Alerta.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8804 /prefetch:12⤵PID:6072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7980 /prefetch:12⤵PID:5188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7640 /prefetch:82⤵PID:5312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7580 /prefetch:12⤵PID:4808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8564 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3044
-
-
C:\Users\Admin\Downloads\CoronaVirus.exe"C:\Users\Admin\Downloads\CoronaVirus.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5472 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:3720
-
C:\Windows\system32\mode.commode con cp select=12514⤵PID:25200
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:28160
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:13604
-
C:\Windows\system32\mode.commode con cp select=12514⤵PID:12128
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:12212
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵PID:12140
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵PID:12168
-
-
-
C:\Users\Admin\Downloads\CoronaVirus.exe"C:\Users\Admin\Downloads\CoronaVirus.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5564
-
-
C:\Users\Admin\Downloads\CoronaVirus.exe"C:\Users\Admin\Downloads\CoronaVirus.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1300
-
-
C:\Users\Admin\Downloads\CoronaVirus.exe"C:\Users\Admin\Downloads\CoronaVirus.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5612
-
-
C:\Users\Admin\Downloads\CoronaVirus.exe"C:\Users\Admin\Downloads\CoronaVirus.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5680
-
-
C:\Users\Admin\Downloads\CoronaVirus.exe"C:\Users\Admin\Downloads\CoronaVirus.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4976
-
-
C:\Users\Admin\Downloads\CoronaVirus.exe"C:\Users\Admin\Downloads\CoronaVirus.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5664
-
-
C:\Users\Admin\Downloads\CoronaVirus.exe"C:\Users\Admin\Downloads\CoronaVirus.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5912
-
-
C:\Users\Admin\Downloads\CoronaVirus.exe"C:\Users\Admin\Downloads\CoronaVirus.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2088
-
-
C:\Users\Admin\Downloads\CoronaVirus.exe"C:\Users\Admin\Downloads\CoronaVirus.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8820 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:13288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8020 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:13804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:13848
-
-
C:\Users\Admin\Downloads\WannaCry.exe"C:\Users\Admin\Downloads\WannaCry.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:15432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 287691723128627.bat3⤵
- System Location Discovery: System Language Discovery
PID:15376 -
C:\Windows\SysWOW64\cscript.execscript //nologo c.vbs4⤵
- System Location Discovery: System Language Discovery
PID:15320
-
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe f3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:15192
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im MSExchange*3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:15060
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Microsoft.Exchange.*3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:15052
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlserver.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:15040
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlwriter.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:15044
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe c3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:23436
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b !WannaDecryptor!.exe v3⤵
- System Location Discovery: System Language Discovery
PID:2088 -
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe v4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:13880 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet5⤵
- System Location Discovery: System Language Discovery
PID:16140 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:24112
-
-
-
-
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe!WannaDecryptor!.exe3⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:13964
-
-
-
C:\Users\Admin\Downloads\WannaCry.exe"C:\Users\Admin\Downloads\WannaCry.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:22984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8276 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:18228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8248 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:18068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8136 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:19352
-
-
C:\Users\Admin\Downloads\ColorBug.exe"C:\Users\Admin\Downloads\ColorBug.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Control Panel
PID:11340
-
-
C:\Users\Admin\Downloads\ColorBug.exe"C:\Users\Admin\Downloads\ColorBug.exe"2⤵
- Executes dropped EXE
- Modifies Control Panel
PID:19160
-
-
C:\Users\Admin\Downloads\ColorBug.exe"C:\Users\Admin\Downloads\ColorBug.exe"2⤵
- Executes dropped EXE
- Modifies Control Panel
PID:19972
-
-
C:\Users\Admin\Downloads\ColorBug.exe"C:\Users\Admin\Downloads\ColorBug.exe"2⤵
- Executes dropped EXE
- Modifies Control Panel
PID:20036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7764 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:21572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8444 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:21604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7704 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:21716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6824 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:21184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8308 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:21440
-
-
C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe"C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:22840 -
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
PID:22504 -
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"4⤵
- System Location Discovery: System Language Discovery
PID:26328
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7244 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:23112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8956 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:22776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7244 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:22304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8512 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:18608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8688 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:21136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:21520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3048 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:12488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:20188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8284 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:20092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8036 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:19596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8048 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:15088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9264 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:19292
-
-
C:\Users\Admin\Downloads\butterflyondesktop.exe"C:\Users\Admin\Downloads\butterflyondesktop.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:19080 -
C:\Users\Admin\AppData\Local\Temp\is-HQOI7.tmp\butterflyondesktop.tmp"C:\Users\Admin\AppData\Local\Temp\is-HQOI7.tmp\butterflyondesktop.tmp" /SL5="$1601E8,2719719,54272,C:\Users\Admin\Downloads\butterflyondesktop.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:18804
-
-
-
C:\Users\Admin\Downloads\butterflyondesktop.exe"C:\Users\Admin\Downloads\butterflyondesktop.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:11032 -
C:\Users\Admin\AppData\Local\Temp\is-280F6.tmp\butterflyondesktop.tmp"C:\Users\Admin\AppData\Local\Temp\is-280F6.tmp\butterflyondesktop.tmp" /SL5="$403A6,2719719,54272,C:\Users\Admin\Downloads\butterflyondesktop.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:6712 -
C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe"C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:17092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://freedesktopsoft.com/butterflyondesktoplike.html4⤵
- Executes dropped EXE
PID:17556 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff7d446f8,0x7ffff7d44708,0x7ffff7d447185⤵
- Executes dropped EXE
PID:17600
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8856 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:16592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7260 /prefetch:12⤵
- Checks computer location settings
- Loads dropped DLL
PID:15876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:12⤵
- Checks computer location settings
- Loads dropped DLL
PID:5836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9312 /prefetch:12⤵
- Checks computer location settings
- Loads dropped DLL
PID:3988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9412 /prefetch:12⤵
- Checks computer location settings
- Loads dropped DLL
PID:27104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9492 /prefetch:12⤵
- Checks computer location settings
- Loads dropped DLL
PID:27108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9632 /prefetch:12⤵
- Checks computer location settings
- Loads dropped DLL
PID:23668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9684 /prefetch:82⤵
- Loads dropped DLL
PID:23816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9752 /prefetch:82⤵
- Loads dropped DLL
PID:24028
-
-
C:\Users\Admin\Downloads\PCToaster.exe"C:\Users\Admin\Downloads\PCToaster.exe"2⤵
- System Location Discovery: System Language Discovery
PID:7128 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://java.com/download3⤵PID:7188
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffff7d446f8,0x7ffff7d44708,0x7ffff7d447184⤵PID:7124
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8016 /prefetch:12⤵
- Checks computer location settings
- Loads dropped DLL
PID:6448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9736 /prefetch:12⤵
- Checks computer location settings
- Loads dropped DLL
PID:25668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9872 /prefetch:12⤵
- Checks computer location settings
- Loads dropped DLL
PID:26672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2188,4659190354970237863,16473385956660046178,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=9732 /prefetch:82⤵
- Loads dropped DLL
PID:27640
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:388
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3676
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x518 0x5201⤵
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3980
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2004
-
C:\Users\Admin\Downloads\WinNuke.98.exe"C:\Users\Admin\Downloads\WinNuke.98.exe"1⤵
- Executes dropped EXE
PID:5400
-
C:\Users\Admin\Downloads\CoronaVirus.exe"C:\Users\Admin\Downloads\CoronaVirus.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3008
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:8544
-
C:\Users\Admin\Downloads\!WannaDecryptor!.exe"C:\Users\Admin\Downloads\!WannaDecryptor!.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:16608
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\!Please Read Me!.txt1⤵PID:16684
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\1f73e80a911c42448baada04de479514 /t 12164 /p 121681⤵PID:16868
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\9ffcb76ccd66465690f4a33d8a810117 /t 12144 /p 121401⤵PID:18252
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:17324
-
C:\Users\Admin\Downloads\ColorBug.exe"C:\Users\Admin\Downloads\ColorBug.exe"1⤵
- Executes dropped EXE
- Modifies Control Panel
PID:20856
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:20800
-
C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe"C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe"1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:19416
-
C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe"C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:23260 -
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:22996 -
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"3⤵
- System Location Discovery: System Language Discovery
PID:26044
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:21960
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
590B
MD5580c72f84635cbb402623f220c5ea578
SHA1dca6aa14b8e4aaefc02da4ac3da8b396a7d03c23
SHA256356467a8130c1ba3d2aca322b141730804c13486d0650c025e7af7ed809e91b8
SHA5124b4fbbc3fa510725cdf74ce7a99757b749e203dd56b1036e486431bd08ca45e5791747601386889e0d8dfaa9bffafb0cf4f35ba60be1c5a636d986436d8d46e9
-
Filesize
3.0MB
MD581aab57e0ef37ddff02d0106ced6b91e
SHA16e3895b350ef1545902bd23e7162dfce4c64e029
SHA256a70f9e100dddb177f68ee7339b327a20cd9289fae09dcdce3dbcbc3e86756287
SHA512a651d0a526d31036a302f7ef1ee2273bb7c29b5206c9b17339baa149dd13958ca63db827d09b4e12202e44d79aac2e864522aca1228118ba3dcd259fe1fcf717
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-9C604B86.[[email protected]].ncov
Filesize2.7MB
MD59c94adf3f24426c433a8c98ef8a74473
SHA1a4873e46c131464691f0f04103da147dcd514a36
SHA2561c7f04708dbf57697c0370f87cc82f82baed4137c333c4e13f8534095a1489fa
SHA512353495c2adc449e0a6d4bfecf14d65b1db0fe69934fdb61b19249d8bb10ea4b51198457d5522d9a8beb33dc31cd1569cd8af36d5267b1c1d22c2ebb69d4842ce
-
Filesize
152B
MD59e3fc58a8fb86c93d19e1500b873ef6f
SHA1c6aae5f4e26f5570db5e14bba8d5061867a33b56
SHA256828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
SHA512e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
-
Filesize
152B
MD527304926d60324abe74d7a4b571c35ea
SHA178b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
SHA2567039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
SHA512f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\021a0682-4abc-4333-a7d4-4a835789b9c5.tmp
Filesize1KB
MD55104347cd3f2ea222e063bd633196871
SHA1b500ab9debf96b7e46f6f3847d978818d4d5de08
SHA256f4d2999ebbd13329004d8b0338f43e26bc2898df6e5435ce9d9f7f4d9702b592
SHA512faa33d04859f63a2c8b1fe2a99395b551c567762f9c12baa58beca7929975d7a0d28f7b48f820071cd08506e2bcac766ca49b15fbe6b0ea5904872a4b0ba0693
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\43f5c5c0-4089-4614-b0dd-b9d63c626d57.tmp
Filesize2KB
MD53eb17bfa9dec888e71c1fc941b532595
SHA190a8f2f9f7d5ddb33b58d10f8fa159d0a59c5dd5
SHA256038d328a6aee8c6f5f0207e547aceccb8e4fb76eaa25dfddd989181cc849f52d
SHA5124aad43e8fb57f4759aea0431712a8539e6412139c9ec5d938cc5713d22dc10712a3f059ae093e5c58d6bf88492465685824843a1048de73a7f3740071fea7b2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\89e21500-6543-4411-bab3-981f461d4996.tmp
Filesize7KB
MD5c08ddb4cd60b162b7283ddfb1dc374c4
SHA122b3d0c2549ebf12c9cdb04b238beb59823d155a
SHA256ef742ee705616f8a371b288191e685b0529cffdc9d72c9f82909d88a1e878a7f
SHA51245bcb808a92aceae80c5743d2670401f4d5cb2d2563ba4566a8410584b26a3c45a273c1665a09d79be94eb225945606d70c8285272efb4b53495ebcdb56162f1
-
Filesize
67KB
MD51d9097f6fd8365c7ed19f621246587eb
SHA1937676f80fd908adc63adb3deb7d0bf4b64ad30e
SHA256a9dc0d556e1592de2aeef8eed47d099481cfb7f37ea3bf1736df764704f39ddf
SHA512251bf8a2baf71cde89873b26ee77fe89586daf2a2a913bd8383b1b4eca391fdd28aea6396de3fdff029c6d188bf9bb5f169954e5445da2933664e70acd79f4e3
-
Filesize
64KB
MD5d6b36c7d4b06f140f860ddc91a4c659c
SHA1ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA25634013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
SHA5122a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
-
Filesize
41KB
MD500d4cc262b70dd3d386111ff78fb0812
SHA1628d4dcee1e82d04ab3969c29e256cef10101407
SHA256956916ddd6bb5ebde0f5df3605a524d1624ea335cdc6bd5bf26681d3a5ac5239
SHA51212f3cf77c4ee58eb00b08ced394d35e35237da4bc9ca62b1408c6dca4350068aa94d3a0e98132aa0e6cbcbdb7dee9c2b9c5399ba7c4780442200ad37a4c2b1a6
-
Filesize
19KB
MD52e86a72f4e82614cd4842950d2e0a716
SHA1d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA256c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
SHA5127a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
-
Filesize
88KB
MD5b38fbbd0b5c8e8b4452b33d6f85df7dc
SHA1386ba241790252df01a6a028b3238de2f995a559
SHA256b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
SHA512546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16
-
Filesize
63KB
MD5710d7637cc7e21b62fd3efe6aba1fd27
SHA18645d6b137064c7b38e10c736724e17787db6cf3
SHA256c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b
SHA51219aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44
-
Filesize
1.2MB
MD5027a77a637cb439865b2008d68867e99
SHA1ba448ff5be0d69dbe0889237693371f4f0a2425e
SHA2566f0e8c5ae26abbae3efc6ca213cacaaebd19bf2c7ed88495289a8f40428803dd
SHA51266f8fbdd68de925148228fe1368d78aa8efa5695a2b4f70ab21a0a4eb2e6e9f0f54ed57708bd9200c2bbe431b9d09e5ca08c3f29a4347aeb65b090790652b5c4
-
Filesize
43KB
MD5209af4da7e0c3b2a6471a968ba1fc992
SHA12240c2da3eba4f30b0c3ef2205ce7848ecff9e3f
SHA256ecc145203f1c562cae7b733a807e9333c51d75726905a3af898154f3cefc9403
SHA51209201e377e80a3d03616ff394d836c85712f39b65a3138924d62a1f3ede3eac192f1345761c012b0045393c501d48b5a774aeda7ab5d687e1d7971440dc1fc35
-
Filesize
74KB
MD5b07f576446fc2d6b9923828d656cadff
SHA135b2a39b66c3de60e7ec273bdf5e71a7c1f4b103
SHA256d261915939a3b9c6e9b877d3a71a3783ed5504d3492ef3f64e0cb508fee59496
SHA5127358cbb9ddd472a97240bd43e9cc4f659ff0f24bf7c2b39c608f8d4832da001a95e21764160c8c66efd107c55ff1666a48ecc1ad4a0d72f995c0301325e1b1df
-
Filesize
27KB
MD509ac9c9a95dde9d928585489b55a7a53
SHA1a0930234469184cebbc08e399bc4d7ad9003b2a0
SHA256a2b2e70072c91efc39fce757a94ccb51cb7de56c2e2accc7501947ef0509a612
SHA5120b6d68f9b28439a56bd0fdbd391f8107023117e985a7087dee483e7dcb998897db2e7ec4cdbd551f6546ec648c2c1b8a4345562f9640bcad14fbedaf2730551a
-
Filesize
40KB
MD53051c1e179d84292d3f84a1a0a112c80
SHA1c11a63236373abfe574f2935a0e7024688b71ccb
SHA256992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3
SHA512df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff
-
Filesize
53KB
MD568f0a51fa86985999964ee43de12cdd5
SHA1bbfc7666be00c560b7394fa0b82b864237a99d8c
SHA256f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f
SHA5123049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7
-
Filesize
37KB
MD5da4c2d9295fbab7844d4f29079dbb8d5
SHA12e214261c9f3394badf103af57a2b9bd6f89a68c
SHA256b2f523dc352a436652fdfa66e899f589653015929b1add2da64eeb9650a7febd
SHA51283a66de2c3593c960f5e7567f8c315f983245334f63bda67c7490570753bce7e865a1f752d15a5b6f795fb4cc4aa2a122ce6bcfb86bf3e116f00df7a558a92c7
-
Filesize
37KB
MD5a2ade5db01e80467e87b512193e46838
SHA140b35ee60d5d0388a097f53a1d39261e4e94616d
SHA256154a7cfc19fb8827601d1f8eda3788b74e2018c96779884b13da73f6b1853a15
SHA5121c728558e68ed5c0a7d19d8f264ad3e3c83b173b3e3cd5f53f5f3b216ed243a16944dbe6b2159cfe40ee4a3813ca95a834f162073a296b72bbdedc15546be8f8
-
Filesize
21KB
MD5a6d2a865e9f16ea305950181afef4fcf
SHA1082145d33593f3a47d29c552276c88cf51beae8e
SHA2562e5d94863281987de0afa1cfd58c86fde38fd3677c695268585161bc2d0448a2
SHA5126aa871d6b2b0d1af0bda0297d164e2d685bc53f09983e5a4e1205f4eb972a2017323c99c3cc627c3fb01381b66816e570f61d013d3775cddad285ac1b604cdc9
-
Filesize
18KB
MD52e23d6e099f830cf0b14356b3c3443ce
SHA1027db4ff48118566db039d6b5f574a8ac73002bc
SHA2567238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885
SHA512165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717
-
Filesize
20KB
MD5c4b8e9bc1769a58f5265bbe40f7785ef
SHA107ff14df16d4b882361e1a0be6c2f10711ddce50
SHA2562786986a3139e9722e667f81b4902609a4cf458e1c16206cd11feceee0254192
SHA512a39157460b523ee2b9e1eacccf7aed99ff002767a8f87287c1c4662b6711b97f7d4955df64a86a882417fe71e598719e3934e14f787c1e6b3348c8a4c813e3ad
-
Filesize
57KB
MD5919d13ecf08e3da7e9f337e7b60d6dec
SHA13d9bd4aa100f69cf46ad175259edd6ce9864830c
SHA2569d4575044d2efd5e90503beda65571b5158a3f32d999191ac1f82d1a5ee62ad0
SHA51298d8236ed1c44826b4489b9fb7b76c62502a032547374446c53dcf2eee2f5fe3548c6587fce66df9d075294bc2ab6be97c3cb21457bc899451ebd3b476715985
-
Filesize
17KB
MD5109a8cceba33695698297e575e56bfad
SHA12b8c6dce1ccd21a6eea2dd9aef2a8a6bde389053
SHA256dd82d9ac034f0a06524fc1d5ef884c29a7e4d586a1e7db66e339dc54fac3636d
SHA5126d51ed30c45560838df921212370a0044640a8e3c0433922106225cb6fec8cc115ac6191c753da13def21c4e0db4deb5782fb7a75ada822ced1db7c7d13beaf3
-
Filesize
19KB
MD5f5b631335f170065edf1b148e10b34d4
SHA1ca34f82af577fec763ed38f0436d20f1cf766f62
SHA25699be964ed51ca453ccfaa264a1ea9490da11e32b53765919172b6d3749a9f846
SHA512c66791cbdc7c0d12e7295eb26eb583b26e03692c8986ab7d5dac0e6a561b8b68a8a9e33814121efc700ff6b472aa4f685162b0c75439b144f12286c9e28c7cc7
-
Filesize
53KB
MD5cfff8fc00d16fc868cf319409948c243
SHA1b7e2e2a6656c77a19d9819a7d782a981d9e16d44
SHA25651266cbe2741a46507d1bb758669d6de3c2246f650829774f7433bc734688a5a
SHA5129d127abfdf3850998fd0d2fb6bd106b5a40506398eb9c5474933ff5309cdc18c07052592281dbe1f15ea9d6cb245d08ff09873b374777d71bbbc6e0594bde39b
-
Filesize
137KB
MD5a336ad7a2818eb9c1d9b7d0f4cc7d456
SHA1d5280cb38af2010e0860b7884a23de0484d18f62
SHA25683bdfb7d266fd8436312f6145c1707ddf0fb060825527acfe364c5db859887a3
SHA512fa69455b3bfc162ab86a12332fe13322dfd8749be456779c93a6ab93e1d628e246a31a0a55cdba0c45adb3085acd62ba0a094b2115529d70cb9f693f3b1da327
-
Filesize
23KB
MD5bd96190c3723c6828cc6601ee39d46d4
SHA18ec0068e12d9f113b01d6077cf634f19079cbf53
SHA256ed8fd1c5a4f0e11544b694ca505105c2a8fb4b643b41bae87b2b4f1ba14f8d1f
SHA5127c649fdad52f9fe2bf76af6249b3d7de40ccdde73618c5b929fb16fe32e51873f7a73734e64b54e918a31d42d6430128c8801787e4ff5ee89fd9265ba9875dbd
-
Filesize
73KB
MD50b8b626b0da15a1d11db3eb79631c670
SHA13bdbe67ee6f9d7411c752944d04434f54d8a763d
SHA256c053796888f18f64bad69169a8fe3ca84e94bbf5912670c810c15d706291c832
SHA512487045207ba381cd635e5358cefaa1c82f172372a08a1387552cc8b93937684684d3139b6ac49e035bd967a0506408cbe43fa62f108819c84441a94197503d41
-
Filesize
17KB
MD5b0700131b816dc0466a6f14c334adb66
SHA1ca151a6d02466bd0f44bc727d6c7eddf280c1efc
SHA25685b7715c96d4cdb688e44aa73bb311f303f9fce01c72c67ece10b587a833bced
SHA5125eadb2d06b69a145c4c84fd1f0d60ff49f665e6af11fcf0fc06e0370e71b80ceb26a334f6fa6fe81d156f13f5ef77d02544f8e616c87d138d30968cf736555b1
-
Filesize
18KB
MD55d8164e7b335f9143e43d6cda40130be
SHA11d0cc1ef975ed2827b28c04a76a75fa4d8176b52
SHA256815ecc97c425548054da106dbd880c8fa83cf5afca2ecbb56d3608cbd3722456
SHA512fef778039ce7dd38f9612b1e7d543d5ba940b7e6b908c2453b4cb7b8c0354ef678ec5dca40bbbf8629474fd523a58ab08119cf13c904624ab3c3e0db4892530b
-
Filesize
16KB
MD501d5892e6e243b52998310c2925b9f3a
SHA158180151b6a6ee4af73583a214b68efb9e8844d4
SHA2567e90efb4620a78e8869796d256bcddbde90b853c8c15c5cc116cb11d3d17bc4d
SHA512de6ca9d539326c1d63a79e90a87d6a69676fc77a2955050b4c5299fab12b87af63c3d7f0789d10f4be214e5c58d6271106a82944d276d5ca361b6d01f7a9f319
-
Filesize
52KB
MD503bc2ccc732a13911106340d3a7c90f9
SHA185c4d7a3b934701b84315c75b803dbbc3f47cccb
SHA2568c015e8651a3a0700d7407143b37bc17dd41c9677d5952c5a28663bea0d2b9aa
SHA5125a0b018110d6fae7188571cf32d9193e4b11e830ba2ac3ea982eef3549070746648fef10172988c8c7ffa85911a4a94eb72794249d2be76a8b762a5e64c2e8cd
-
Filesize
47KB
MD5fd1f79856510e1cddd8141f1d82aff4f
SHA1659aa5c13b63adfb1480856cf8da6acd4fa624f4
SHA256d2c922c16632143318a2792e0ea9345ea5c072ad583a84d8ef164cf952fec4f4
SHA5127781c5280010519da7e71a849a9cb5e37f7b29a1e800bbf9cc47536eaa937abeecd1a2d61867c2744b7de83f0cfdc88b72255ee083501df0455fd018b0f86376
-
Filesize
143KB
MD54a4d42f277fb95b7c31a97cbf44c96e2
SHA124ec0450844b5054839f859e2571d9dcb4ee9a49
SHA25660002a6eec7c21bbd5b91a44ee0cc23fc19dd1d94c6fb8887cb213bdf6007a1b
SHA51253850d78465caf2b029e3020553ed3744c8354857e4de3d7739e3c18e4573f58ba42197661d9b4610e19d0f79d89f3af60d74a53485e0ff7aef913a5e74401e1
-
Filesize
85KB
MD513e448be85a072285d113b6ee50155c6
SHA1107c0dcfafd7051fee6d65e92c7935911dc79146
SHA25632d163a1540eec8363ae42e12a57974298f90da5aba0e644c0a63c9969194f70
SHA5126de52c3965dfa8182d9649e9a5b0e57e08d28a7e82a677fee4d458744b26df39928af43c7f1f6bd9dccd035f23bde3b4a703c08d83ec79613e55857024a56ac0
-
Filesize
62KB
MD58ea39c3450549d000a376d48cc52a77a
SHA12290bf4915d1519caef492deff0bd1aa92b29796
SHA2562ff0de742adeef53436c4d6b34e32e402224ba5f23937904f9b8ba58328ba48f
SHA5121aac8e973b8442c0b3a2c725cfc6eb671f28473660dd0c26625f46d79d4486522c381e608f55922901e1be05462afde77ba4a944ecb15bc976ca1048d0be6d1a
-
Filesize
20KB
MD58c34c7b82f4668c975defa63ea3c9911
SHA101aee6e4857efb1898934c58dfbaab60a9bafb75
SHA2566fddf44c880fa4ab45d21e764fb4371c8820b7b1c49502ece0fb5e1eab95ab3e
SHA5127b8db2103dedf6b36759771c5b0451d6e2feb8ba889a07f1dbb869c229739e4343636ab5fe0bae8ff7ae5798d533caf3e408e34b71be72d0bfdd076da5a6104f
-
Filesize
20KB
MD5631c4ff7d6e4024e5bdf8eb9fc2a2bcb
SHA1c59d67b2bb027b438d05bd7c3ad9214393ef51c6
SHA25627ccc7fad443790d6f9dc6fbb217fc2bc6e12f6a88e010e76d58cc33e1e99c82
SHA51212517b3522fcc96cfafc031903de605609f91232a965d92473be5c1e7fc9ad4b1a46fa38c554e0613f0b1cfb02fd0a14122eaf77a0bbf3a06bd5868d31d0160e
-
Filesize
30KB
MD5db08152145f21fadc89c29e63038a4b1
SHA1ad4dbda5cb724414ae8e3f2f0c476394317ca249
SHA2567694cefb5af91fa4ca7f915e59ef6c12c93b16f164b959a0740788312adfb118
SHA5126dce5904c77b2a5c0621ce2c0aacf7102ebce77ebef8b2c1fc59c41be3ac2bf64536718b8a1c07326f9d80666e44a70b382f289df7ec604853cfc69f73ef8cc6
-
Filesize
2KB
MD577236c8c0bb5e1ba356369b7c4c703d1
SHA1c9bd2951ea625cd87f4eca58b8e321afdd2c629d
SHA256cb00aebd5ffab3bcd30703eb8c6ff7152be98b103cdbc4cd26a2124c5063352e
SHA51211cedcc9f6ad873a293e4ce9ec45715820d513d33366b04e19d3ad9775e58926e1978a4d18550e10760053887206e1108a4916627a6773a43417af7ea86fecfd
-
Filesize
1KB
MD57dc93ca8cf35eac713324c6e0fd0e0d7
SHA1671e7ed38f77682a24a84c2dbbbb46d59668c7ff
SHA256b222004383fc0fcc54ca7ca3d9087268580c6f19de08d0033358cdc570c3908a
SHA51235773c64c75d7f632d262716232087793708ee2fcdfc23199de37f5a4576195c5ff99f8d1b23c0717ddf84b1518e0c373cdc0701aa37ef8f9e7b5381d9bc85c7
-
Filesize
1KB
MD52f1dff8803b4bbba942c7051f798c62f
SHA1116445c3df4f0a44f76b4a605018f3fe134a5584
SHA256b974207865d2d1c4c99caf0cdb940430738f3e9546af9f613c365c373c805283
SHA5127e8d91819934e70a935c367d318490a2875ba4ffdefb465447d0424467778d7a611cc7b805f2f622fcdbab170097704479ddddb496f1b3d2f6d5d1802f9ab83d
-
Filesize
4KB
MD526c26937f6cce8a54d14875718f40cf1
SHA12dd3c4c1f215563c7bdb326d0ecb2357f7852a7a
SHA2563e31481a246463d78402da18eed12f61f90f45a14e6b3cef357717dece684191
SHA512762e65581efe5d64819fb67af117c300d53e5eabdd72af5fcdcbc66c2a2cb350cfd7e6d3e7a55d0c137ab7afc680c727705376fd7c5059f2c4d66ca2401b89a2
-
Filesize
2KB
MD5235ef62c263acb60fbcd3a59c34df4a3
SHA18eff7d63154104c7871bc1795ad4ce56a34e1ba6
SHA256a4414533c8727db2dbe9806f528dd178384538125c38517ad2d5f832ec18cfc1
SHA51241078d2909fa9b7c922ea2afdce6452473137e14b156ab25ace5853823dd348f58e7b10db7720aeae46c73ee48e89252d344ed1dc41d0039727042897674b32b
-
Filesize
1KB
MD5728c9900f6010b00a9701c476e185133
SHA1004a14bcaa86a539bb5d327a70a7c8bd31578f69
SHA25619ea88fed62dd715cec19c1216fd9df7be882bf991f76832f9566d7817ca6ab9
SHA512b45a9b3375d734baa231e40e3aaa575c0710f7836a547d9b73711319247a62686ca9341251e180379553c1cd6779966fb92d880d6039ce2c6ce17dbe16712b5d
-
Filesize
1KB
MD521b010cf230269a46cc79a9bbe8bfcc9
SHA19f3e71dbaddf2e6c648f39e37e208284f54d8ead
SHA2560a8647fe7bc1d1b9e6210b900f84f06c70d54be4b9fbc23930c3468fd2ad1637
SHA5125b15c2a70802a382fcfe5b8db81e5ae7110a833b201fec87dd183a9e5ec9d7b1f8bab0058e06617d6f71e203b89bdf198483f430bdcccdc1306d2047e398fcf2
-
Filesize
1KB
MD55cc00f3ddf0e1d88e509afcc16a70486
SHA19368598affca82fc97875d071a432b04be9883ed
SHA256115787a5bdd729163b94df4c0a87187fb419085ddb7ca0e641d3a551c839efe2
SHA5129f2c9115b5d2d91f152c9e2d3a6a97b831f5e7f3b11ada12cc7eb1f66a43da38c3a556eb71e0d7f2dfa67296823d2bde0ad98123ea76ee621818c97aff7ae474
-
Filesize
2KB
MD50898dcb28e2a78f09e35a4f62d47ce26
SHA1c9d46297cc53689b8ea08e982fd426349a91488c
SHA256e37cc76e5184f80a2e9b9593bd59bbe02b83ee042a8e65ac7e4d2ab10093011d
SHA512abc5792e1512c5e6ea04e5fce148d7c7e9fd6460eec1928e836407ff9286c5f979d9404a0cdeaff6c7e137a9bdc46195325e878b126238e37c369a6a77e8a296
-
Filesize
1KB
MD508f493bf9bfdf0b9702c85db82e1d77a
SHA14c8e11fc470be5170fcc44e49e66688b2666c09b
SHA256601a679e3236f5fdce3f1c8ee2ccc909808012d22f64d5afc56477f5780a209b
SHA512b875831a61ea1a7aaadc34f74185249e3e429219f3c1f90ba7b04dc46c1a449807237a7ac2496086ddcdee3150cfa39d57dc3c687326e1f19d0e66ad729762ca
-
Filesize
269B
MD58bf2ccbc9eb7c6e69bf783eb9ba1c062
SHA1ae0e7457df6f3870c9ce81c7da7cad2f93e4979c
SHA256afa01ae3ca45a7afa10c5019d3235a69d0c8fcfd84de77273e36093676570554
SHA512bc3f7c4fab74e99c0253e16bea1834b3d573df244df6765ad9b6355fd8fa33ebbf95ab84547fe060466ec8195d58e47120cbbb8676350c36dfd0176fd9a9fc11
-
Filesize
5KB
MD5d11681754318864c255683ced80333bd
SHA1d5a53dc73d8a2c1f52de330748cda98902c87eec
SHA256f1d393203e212220a42f36fdc85e995ec23a7575c6eb11793961621372eaf889
SHA5126b240b3561dd49d7d9a148ac17e62ea34a3ba9d81a542e5066d7efbaa02f2d275c2e3d7de3e74e8282e98f3ce2df4aa7cc4172198f8ce97ab2bdc400a9701bd2
-
Filesize
1KB
MD50606e20a3a796d954d4ec43b17609a45
SHA102ea05d28cbdfb3858c42ab421984a5a8eeaa02f
SHA25630a59be274cd4f97dc50b5d5276fd7a71e8db61010cd71f7e23ea0e15f631e03
SHA512b27cc242e83f263a04e721edfe68cb5d2ab1d41074ec435579c40dd97eaf4af4fd446a2bb5971e987e7439047b2ed30c77d7d55ceaefe06e91f2fef42b752cd3
-
Filesize
1KB
MD5a3e6610729d734f306c20547b1b47c6b
SHA1baae898c380e326341721aa35dd7b9c16b195b4f
SHA25632c36c32b9a373f5ad6cfdd8d6e2c42f561f3648de7084db9a9dd696882abe7b
SHA512655a6cc17cf7b45c40fa6fd4337ac9d6aaf226411891b15b63a12ac871b71882fb0b8d008a41b0d242237c2eced7c107afe47196d0912d2f7cfc6f837b5a7e40
-
Filesize
360B
MD59081314bcd613aa4fce3e744fa7dc24d
SHA1d9ac74a6914383e29415e496a03953899f5a9ec0
SHA256bbcc252ad933fc493ea0c8bd34fd910515d6bf9e716e2df7d56529afa48a7ef8
SHA5124688b0e32badd54be9d48c2a7fed40556b3a07d99f7b2f11683a4a19d487d36d935cd7d202d866c78b44d88bde4e27cb0c75f89cab89c3eafda40ea0b9c78862
-
Filesize
2KB
MD5ef992e27b2aa7b7636c8d8b03cb4921e
SHA10e2e9dcf097bd2705c8fcad06e3ce67cc962ef4b
SHA2566c968ccfd7c09339650f33ff17e1b8a5a9240f4da747010f5b37fb187ef90fe7
SHA512768ff568ff1c89c4307e4d393e806d6a6f6c8309b8320c776e57fb6de9d80560d508e64c0e2f09ba4dd31c35afd874fb576064919ed3f779d2e061b37395fe92
-
Filesize
2KB
MD5c624afc4eced0e923698dfd512cc16f4
SHA1552c615bb1ba9bd1e831059517b7c7663efed707
SHA256716d25ebda289f9e5cd6c8e60c36b7f7841c1331deb49205182bd233c3358935
SHA512854c4564b77a4e593980d9f2135d3ae4805007de0fadb7b0eb0fe9eb1481d66ca4124fb10c5541bdecce044915303f41ed089534b7c557cceb54c47186933021
-
Filesize
1KB
MD5a50aa07405259533c2a1d378458fe179
SHA170965b3f18b3e09aa0fdf420d4a8b2814e6b48b8
SHA256c520b44d58b1606df2cae3318c69ce2e8efc7bd21b1fe55eb85224ef65863942
SHA5122bf7023d6da55739a7c4346cdbfe8f5ac096e7b26fe57c41426e25ef5066894e69ccd9d1510d42a10dcf57b0d9ed2cbab2cbb9a9cf7f1bb3c78ad6b31ce934a0
-
Filesize
8KB
MD553c2652e8db987dc331249a699370b9b
SHA1111ea0067bb2481113017481e0d651bba19ae5c7
SHA25688af12396dd0a92f4df87e62c01afea343ce139db518df4ec4876996b9e584fd
SHA512e4211bc946c89bbc41b7409b9bc98d6554fd162e98c577d7bcaee2975224ad765990effb6d567259bc364d62a1ae37b75775dbed0a4480fc5a073cc83e1ed4ce
-
Filesize
3KB
MD569e14190523a3ff684939b17047e43f6
SHA12a932d44a86ff307d51d120c882ddfa681a1a04d
SHA256da01371c7cb16c8d18a8a562b39741164691fd31feb347ee5c52fd377eb49acf
SHA512a3d3fac69e812d495d22b179ff4a6121c8d870ea15ec72a954d299fccb14b7fd599640b5e138bcf7ac2654cf0a4e0f8de9d8b9988e8045f0d3ae2082fa7baa4d
-
Filesize
1KB
MD5a61749ef0ed5c35f012235b407d99973
SHA190fa9248f8b3387606d22c03a8be232fc2e68cb6
SHA25617f137f93cc9a50ee6ad635f530b5e745bb4b992792b8347d503eded43097e08
SHA5125c3103c13a06ab9ac10cbc729c27139d954868cf6fba1d6525d0a22daf696df0c2f1cae3a0cd12c1263504aa405dca9215a17802789f0344cea01cc8e6f2ec39
-
Filesize
1KB
MD5875baa0534a99b0816c2b96a7e26b6ee
SHA10d79cf3c4edf31a58333d80fd6234933bbf45dfd
SHA256eb1a5b4f382dfd74d1b64891f87049c7b0bb453f0705da320f668780f051a390
SHA512a04aeb85515b7e6de47255bd3901fada33747d096cdef1ffd7f8af9c275611b4ffefb2c92a73b91207ba879acc2915db3db03e8739f466824a4b5c98cc34c539
-
Filesize
43KB
MD5a16a7880c9c59c20f3e31ce936493d49
SHA162f5afb01d0aae833c818d9bb19886d2b4d8a1cb
SHA256c2d502a0a0f1f4e54da89ea24e25d194353ec712352fe21bd1fdcf5722c0a7bd
SHA51253537aea847ec13e008658497d44992eec352e0ba9e4b0fab614e20f64a194944f3a0f446d7ef62338a39c8ad56c8789c5cba7e20f3b6e9523c3599f95e4ab58
-
Filesize
366B
MD59553fb1753e806b4ec5b1b0bcaf5e569
SHA125f7e2f396108fe8dc697305f06d4e49931d999e
SHA25642aa8c07f2fe9cea29569dde2b5c2c8b5bf9a280dcb551b7ace147ebb4efec98
SHA512b8bda3fc42637831cbbf16aaffdb181229f57b410cee190b379a9cf9804bd9afbfffaa804d66961968ccd7d9a7e5ef6b38f43868e788e8afe886f0508e84febf
-
Filesize
1KB
MD53c99b8f9ae8e1a2ac57c06ae935965d6
SHA1ad45ca7c10f558be7b55137ec20b1e08149a82c9
SHA256d6a73bc264d2cf7b34321edfc942640ed0766b5e67dd9668955fac54badd4c7b
SHA512c3bb6255818cef05ff6980ed2dde0a40a4cbc70e32ed6ad162788b3652694fc523a49bae7e3be57b1955548e03173c53bfcd12268a87c5918bbe74fcef2b51ef
-
Filesize
1KB
MD504f7dc2d1c3ba63884c9c66420eae559
SHA1e2f84d1b634523693992939e8883165dec241951
SHA2564031fd2fda5b2395afbe87eaff5b99afaef291049a1ae021c8fdb86b84f36bd2
SHA5127703ff0ef2f40e2dd345cd6da215af41041ec5af8124c4ca5d2e029c02c0b98ff02fbbf4111ca3dd9923935043b8d254dd6f8710149998c947d4e435b713af84
-
Filesize
3KB
MD512d6cc4e72617e9a83d81acb7825a32a
SHA14b88924d67bb51ca11729eb6b138568304c8cade
SHA256a53d4f66015d8ded7f7c71ab280e9a87fde6cebef8e3699fdfa8b1ca2546b7f9
SHA512945674e8a320a7ade020c9b21d7bfbfb05973a8ae43b819d39c79ae367e02a4d9255b2b384081372a093c279fafa31a351406c782e4333f7720d9796d62b57ac
-
Filesize
1KB
MD5b6fa0d9e6fc2ac2aed542d398dc44777
SHA13600c73d10f135797ba98d52d05458e2bb9cc19a
SHA2566072771ce586018db6a10c5b2323682fa836cd7505b69a448c85b3ed4edad3f3
SHA51219677ffa3225208b96ce13410474de95c375d7c8ef2720cd6271a26cf279bdb12253ec885ea0bfd5ae742d3053cee161192419258c5087246429767fe96cf109
-
Filesize
1022B
MD59aa6e241646a399786d5ca2d6a6d97f8
SHA16ae27e100044d92116e0209e6c773496086f4d3d
SHA256411ca5d84246c7fcfabb373e384939683f072c0f76f08098687a447b968c825f
SHA51239aa3b982147bc2b26c46ea0ab3d185a7c3b9af9db64fda5f635ca31d90fb1ce8f580397818efae6d6a45ce19a03e03c9c99188e08941f349179acd6ef6df66b
-
Filesize
4KB
MD5f3b1e4ae752d4b0e659f2b6651e9dc01
SHA104f694828469443d530369a831aa727fdb0e907d
SHA256e7abbec64e425436ee28eae41e38e98c041591b294ee4505f40213a1fd09bd4d
SHA512cdc2a9e4b96304c3ca9aee80ff6ad9070bc60ab16f433d8ba6629c046a1cb2e243ae41cb41b7840c2af4cefd15c8005af32a610a5fb58f4ebb745e0aded6392f
-
Filesize
3KB
MD5b694bd70d2d02e30288969e98fbaeb33
SHA1ec22550971633b9d51229bb0f869a296ee0e0138
SHA25616c161367aca15e63f23931bb798d364e5044ef706fc57384dea67b733249662
SHA5124bf284afc6ec178bcbcbbc78da60b72d410cdde94d7ba89535179205fe09c40b2b43798cf0e358f2ce3abe975046b1ea7161ad26fc61a7a61a61794beb2f9c98
-
Filesize
22KB
MD5cc22acf27c02ee77bd628ab8e90392c8
SHA15ae31701a3557fc3bce1a8239bbefe191fcbec46
SHA2568a5ee9273301855c1072151f6106c70ea0b5000b1cb616fb4292efdbecfd3fb8
SHA512c405c9d230b6979715b76e05b0df5b87abeb1723c9e1c78b3cf16ad16cb672c7798f643ffe4c00be43db6a2aa047cf2e22da9c373bed3717fd8c8c2e896d3967
-
Filesize
1KB
MD583798e67d441a23e984af37ae53de167
SHA168ffac4bb323409086bfe0b64292d3838b75e0b0
SHA256e77c784ff1ac4297b471ad093d7bcc54aef67edfa1e2239ac99202dbb4443814
SHA5122d73dcbf0b24f58770b666328fa6e648f5551772021ad0ff58497463077aa28a87c5dc3b96ac3e9cd16a2f3602db07d157fc68174fa54434e50f8a3699c5b71b
-
Filesize
1KB
MD59d9efc87d8f27923dd60b99de7763326
SHA1a134e613a4d62b85c09b9359a9442884653344c7
SHA25698f3e99d9932fa53a18a27f918969e9529bf6968e0764b9c473d4acacc2e5533
SHA51245bb335e3a68e6fe37f18184eaf65daff2e957d17667f3dfbebd31ab781c682ad84f75cb52e257c44efb7f5f7d960fe354c2b40b192b5cf4b4be1d00fb37129d
-
Filesize
8KB
MD522d010142fa2e70ec2b6db748c95007b
SHA100904c4c5a4c4491dc52a7c22f88490fe8f1a884
SHA25645235c5a1180a8450f4cb897f7aa0cd929f4b4241d440178d7bfcae05316be6e
SHA512eb3a9ed7e1e9bc730091b9d2b30b7bbc5948757492509df3e20ffe90963282b6c9fd2815e21e1f7fbbdb9f140967687d2a2b445f5184ec64363d2caf4359c5b8
-
Filesize
24KB
MD5ce81022234cedfab489f5924c672a306
SHA1135a5e1cba6405069295d510abedd5bb7aa053a6
SHA2567b1623192c68ae91605bc84888b61b197e644cd49cd7b3b4e2581d0e7ad27f2d
SHA512e3b6a788037e264b66509ec1272206c8d828a6d3bb992fbda72a96991a4aa66a29d5198ab98d0034eb6e4db3d02e419bdbd59b37f67c4751861b750e9b0bd51b
-
Filesize
1KB
MD5f1d2b84b1cd420204f9ed9ca6960722c
SHA193ea7a25293821758ea72cc35796623ea36d5789
SHA2568f193c4e1f9572fb99aadd72828c283333cd25a053cea1ae77644d20195ac97b
SHA512e2ac8a8ba7e48f1eb8b5cdb17d721e75431df65da9f6631346cb25d6010b492f0dfbc8d7fec59d2649fd13331bf22ca7dc4922c42d5e3c32ca1329f0365990ef
-
Filesize
1KB
MD5141a119178419f73d50269a3422e9627
SHA1ac528d38269865ac2a7adaa88c6868ab45916010
SHA25634d737f3ae7605e70b8f6f4fd87e527a31f3d28726697686741807b923e49ca5
SHA512bbabf59b2fb1a2e6106359e68b64180ba40bbe17d7dbdd91c44ce2767c59845e2cddd3bdc44b0cc98688ea2aa227e3d2ce63c766f5c0428c3e78aebf31f7d538
-
Filesize
1KB
MD57dec7f7ea6d14563a954de7bc575f3e1
SHA187a2aecde575b33a51b09204b4b96e37fc0fa423
SHA25602eb937acaa352b6437f4d067290f6a1d55ab67d46e3d34a0a0af109ca75449c
SHA512ea8f8b0cb2a9dd47aac1aa8c0cdf3137426229080e2d3b57cc1abaad9681994a6ce827cf59006223589a2968fcffcb65d21bd73179feb262e2cfe33dc3b30631
-
Filesize
72KB
MD53be2fe61b2dc7a0021a735e3da5fbcea
SHA13388a3a7f40866ce2981bba3fb9048a5f733bf55
SHA256f8f209cfd5815708cf5e66fa1f02fa2efee7ba81025e4c339e88e3737f168ec5
SHA5123e7e1e98cc12a7c12930e81e5e5dd28ff3824180c65d8c70e7885c18e616b7341a229cc4c3c11fdb30b62e592957c18fd053f8bfee1223b40426a8947e600ce8
-
Filesize
8KB
MD509bd5d25a6823751482fa0aa3b3bcdb8
SHA1d6ed2bbf7f75a8c9503ea9178dd11de42dcc0d3e
SHA2562d278b3f8413bf124e8526a5c83df11a6cf7b8375edc43187829069bf918b98a
SHA5122df1f6193d6cc67f7f25bf9a490d1b2635c7db94553439f254fde41a2daa73a1c7ad0c3a81f4365d12fbe0fa43e3f75aad1ae80265c65a0c5ec7a6cfddf7ab50
-
Filesize
3KB
MD57d04280ce17214d7c0880e0482da2acf
SHA137f90be63b426ae5bab8497f4dc474ea821f3a5b
SHA256e96e6db2e8d46c8c1372acaec5b5bd2982058e9b2d072195b2f7b6b3cac39dd9
SHA5128f5bb861ea792ca74eda81932f7842cd882b200f766f4f6a1d486d84bbc180586b9670a2b570d847dd624087164e3d3e28aea731aeace9eb87995247abfaff2f
-
Filesize
2KB
MD51969e8d364f48a927a9c855ca3ff04a9
SHA1092c39eb0e235f688db0d9e76195ceb9ba37044f
SHA2560c2228f60a8292e9c1912d01b1af75eb14d81f7be6aac58dbc163d3fa5274a44
SHA512da63f92d9ab12d4f8818c2ed027f6d7448359f40cd438d4f162c30d32b21c64af4aea6f58b4e646d82dc12fedd953ee0075389d75225dcb0ea59db5ad381fe01
-
Filesize
11KB
MD564f3cb6e1128a3d699a0101b131ffd9d
SHA144e3577b5d24e755e705526c29eac4bfe8073164
SHA256f554f48e5b4af04cae3b7c98edd260da9a562ec30188e193f1ba66496301af6b
SHA512f7298ed570be43b22bce862535db1b768841e50d01609deffd1b24562b17c75999ae88b24b7ff38baccf2082d84a307ad0c73bbaba8bb848c2279f56086b985c
-
Filesize
146KB
MD57051317297b78e7a5d6b1b56600edc41
SHA12e666fb8750007b052b36bee0d8c3bfc5d9501cb
SHA256ddc4876f8715b83899bc39cdb7a3006a4cc2279ff4d3a2df446de891c98f63de
SHA51282e7b9c66a1159661b5a295d67593b2e91ab00aaf83a7ba732da44cd8f1f6c074ece0f60fbf0454898436b81af32c7ee7682cdc8d6ee73df221ca031e2040d4d
-
Filesize
1KB
MD57eedd884a767c2478769108f21888924
SHA132c81c43f644b68a49ae9d00fd140de098b79e3e
SHA256d2942e390d68ecf0e1d95c559748a7ec1a1ae9f16f11fd1fa95a6103bd0a4b2c
SHA5120eb95973a2160c486415ae85a2a25f04f3a0aa88d5da41414073c721618dc149db10827b8f68d4640966c1a4389479b7f05b45923de7bde8da98efb0ad7fabb1
-
Filesize
2KB
MD58abea361aa5f7d1db01ac5a0b1cc1de7
SHA178a468eb6ea74cf98be1afa719250a85d831349a
SHA256cb9f6051af0c626353c58196a634b48ea3d146b166ec3fc1cf9b155beb6d1a39
SHA5122a6835628c2bead2d910e66dc9652df8245c6cdfe88ca7bd30251a02023d653f72601e29aa76281e4224fecc4a1bc732551e3e76eb292e7bca120776a7fc12c9
-
Filesize
1KB
MD57013c35d05ddbabc662dae38aec1a4d3
SHA1e6664ef1cb04944b9960c7192e147054d4c2f63b
SHA256587f647c36946cfd86a09226e79088352108fd96fc8bfb0e499174f3c6e4296f
SHA512a63c75270dce0f8472b652c87c03cc922dcecafa1cd711aebb73000ceb6a0f177f75a533736361e5bd9a198c6d0cfbe62ed841ab4d662251ce330e724e63e003
-
Filesize
1KB
MD57951e65f6cd8f06936b0fa84c3e91a48
SHA106ea743dd6e778d90584439d935917a016b5cb2f
SHA256f144f1b4c941126d081510ee3297431ce99e3ee7b2188b30f6514e0d7bc2b70e
SHA5121008d89be51eb92e6ed184c8096d50a0ea914aa9514d044d089f6622d298599419f93d3cf7aafb7bc569a0800730295befa4c457faa9a0ab3276e777720ef440
-
Filesize
1KB
MD55b460b07c0bb719b604c8409d237c2d5
SHA13c4d83547f18f306c5fba096e26a1d320b4bfc89
SHA256c057b99160832b50525809880ae52b7fa2880343cb053e46208d5ff17c027645
SHA512cc8f5062972513cf957bba30bb1cd416eee10265f3aa5511e3f4225b7749418b78f9cff4917187d5abe5628f82f7cce19bf234fcc19ed4174f664105286d79d6
-
Filesize
5KB
MD5445641d849a6be25e1bea6554851273b
SHA19498f9183e45c1e7debc05e0b36bb380cb406c9c
SHA25613875498ec7bb6a6eee2c944a511142f4207973cbc728ad211aa684313e23e94
SHA5125076a60de97162dd21008ceea4da5af5c98b59dc2e2e0db9324aff65b224c8c938cd3fd60dc1d1631b26aa3ab98618215b773dce11dd3312e8dbba27fb8b559f
-
Filesize
1KB
MD51c21799b6bd58bcbd57f02d6bd604a4c
SHA18f4b56c2ae0ca28a7da96b36b772c98fbdef4b51
SHA25642cee7db1ac07e67f0b4185569aee3bb88987724a66494b299aa9b5bebef3aab
SHA5127d28ef99d1330076760d4776aa19c8612a18cbef3e8c668741010e2845c869a9666eac67aa2994b8e65c5fa4bb12377d7d865e4995765488fe48003389f831d0
-
Filesize
1KB
MD5da2d2cec061c2041e3a4078fe99ea4c6
SHA165365a2d0f41e4564914fa884e09c76a056730c9
SHA256100e4a8ec5a5cc07fe325dafcb1bf3763617a3d11190930010738eec93695a51
SHA5124d276f76ef67776a8ac6efcb72fb551a3bef0b02c18ff4a4fa3bc958d7718f9984cbaab74e7ef28db3f90e78ee1d86959210b040d5749fec5e68069b24f4fa15
-
Filesize
2KB
MD54693838b3f6680798642b896fba5e90b
SHA1fbb55afb940858e5fd4c840c2a98c3a0a475c903
SHA25617fdd010db46663ab0c2db6f5861e803052809404101abef7e606ca358fc9053
SHA5120090afedc84acfd026c9afd59c19e72d2395d9e25b52644376e8b30866e2b7ffebbf1f69064d3010b653614792d151ea342c82044c1ce1930c2d3f7e2c0d81d2
-
Filesize
1KB
MD59f1269173d8788453dac5e0986950cee
SHA1c519c5c74ffa184b61495edc8bac0b38b026ca29
SHA256afc3c16e16eb0ec3925484dd0c41a7384f3286f958fbc21730f9d7dcdad50745
SHA5128ba760583ab230bb73520e55e3328fb3975f41e9fa6cfd80b97d66826606c2ee9117e17cf0475c7c30d0f62742e2a07f122801b780b93103878432cdb035cf6d
-
Filesize
1KB
MD532d22e31522a82d723ee48282b8c831f
SHA18e9fe1cf3cf9c9369110a7a83d2ed62a85db20e7
SHA256fa8092bc8634e8bb8ba3aa374d0146993fe7c3ac5b73ab693ebf35d65cf225fb
SHA51298aeb678180cae20b35a785c6a119431bfbae1bbc9e147a77b58c1b7e9ea983e5021d4efe7722ac506439c4d4a87c603134530bed0b93fd916c98d7766701663
-
Filesize
34KB
MD5583565381a2e36c8496285600dda0805
SHA1b4009630960c2475be7a8dc780b9a6a6e5e531da
SHA25694160844d3fef5457612fe65107a105c00371e30074c4a0344af709dc58a4d09
SHA512e5a334e7d7de20f55f7188a0380f1120de8cf8ae32ef730eab22a38ad2cb88d3dbda4ad6ffea60c69e7dbe440932282121fcb59dace8f8ec708e9d8ee441cd09
-
Filesize
1KB
MD59e069e944ea06e19582c3d7530fc299e
SHA1d17fada8ef17c19d81d28b49f4dcfb165c673649
SHA256859dc598b39c9d1bc29f33ba843a0c7b192c2a1642d8a4c9b68208c070dacdab
SHA51234ea525943606749616a36908ffc6a37af7580993721a8dfd9b132686c71ff576b696c5b0e04f2dc830e6d4f5111a4249b44e5e4799844fae571eab0afcf5fca
-
Filesize
720KB
MD52a3479fbbcfd54368f03c1cd896ca428
SHA1bed55603ce8a5ff5657c6c3603c15d2004af3ec7
SHA256c245a6fc390a490ef7fb5e16698b9fea0261c1c4631546eec0967b25c964a981
SHA512e9a4fbae29ca191be6b4560d49938dc351804b6e4836df75d3c3e9d818d9cfb9a5c36b0ffbde001aefd02dc207fbe0a856bec33313a65e7838add586260efa79
-
Filesize
11KB
MD5aff24766fedc954a78ab5459507cb66f
SHA1dcfca50445c91af38dbfab94a68569d05969a7f6
SHA2560ccf6ef673eb380fa472d61a771f6c2d443c2b6d8af4d39bb250968070152acc
SHA5128d806706e5e05bef385063bc3d1c75175f278a93f5aac55eed8c4a3cbfb91860e67cf81ed0b32349f1a470af7315c7fdc6ccc2fcf4bb29f75d2cbcb8cb9d702c
-
Filesize
5KB
MD5d1436cbbcac918dd7517deabd3a4b945
SHA14c9a1949249c75ea436dc8ab5ad30c6ecab6d5a2
SHA256b16054a978d9a96313bfc3d4631c56ae12a0e3f600371c4a24a55bd9357756bc
SHA512ae0dd98af6ebdc003a5770fef4ce4ce895801b5d7a297c9b67c18f18c49aa92bb562d8b8841424bfb97c1819f4b9332d1859e6d715b387d50a64c3bee08620e3
-
Filesize
1KB
MD56b8a4595f7261a69e1291586c35bec54
SHA18733a4e60ea03f53ddb2843a2ccd54f30d47483f
SHA256cb267456566c2abda2b6b7136979e3f53af851bfe0a2e78463684d190cbd9c40
SHA51270ca053a9779dc217f8702962876ee19075f3f82a808793128c54da62ff0ea9a2a54b88eadf4a06853fb0e5f92b7b279b85c66126778c809647d6a58ba28210a
-
Filesize
2KB
MD57e3ed8cf7b6240b7832052aa728bc440
SHA1ad9859048b400015df750eb18f0f7bbb6c7e0dd2
SHA256b299c504941e085f716515dd1a46fa48151d37ebec9cc7bcd01c699e7f0d8632
SHA5128f9a2358205bc3b268c568a87230a717d6970d05825c255a5e1de62c563256ec7471d39eb580007f4fd0e09e2051b7d392670bbfd64dc05a5c76f70de0756254
-
Filesize
8KB
MD5b5bc34686b49c2c909246bbcc7b321be
SHA1f2cb8f5ee7322d959f7c156ecf67db3e9142ca90
SHA25615f2d557eeb413820d83a056517f86d1ef06e167b92eb321438e89a3e50df2cf
SHA5120ed53852126c61536df341186e9a8d02b372ce7c795321cc291934f1e7600fcd714b6256f5ae571cf2b9db1df797de43b0a693ab3f50005980e4334e0fb13959
-
Filesize
1KB
MD5e435ff14369c6af8f9839597e8b9c0d1
SHA1c096bffc4b129389498c1a49f871474892a0e16b
SHA25642ad6330860db2e910efd6d054ebb74dc4ceb32512819e7774c6b9fa94545bd9
SHA5127be07d2382ce4145198f215ea22b3141ef036ac14ac968ce23a57797bd89f8e015565df5161698c148d5885a7aba76333d462df47fbc5e463e5bf4e030c848f2
-
Filesize
3KB
MD59ec5e08fcd822695af656f3a85046498
SHA12b71277dfda06b5ba5e4d9f49d1ee45af273d4f8
SHA25644528ec7ede4c767593723f6bced18ad9ecf2efa6880adc1727791a02676cd9e
SHA51205083e05f6b56e0aee195e7d3d8b30172e373c688b9ea55791018a1b04bf746e111b5d8c2ad8144a47d3d69f834df1eb2dea4c62a80aaebb8e9641721b890c91
-
Filesize
4KB
MD545b48bc57d4d66ac315c62f30b052ac8
SHA1ccb0b359dec2199ad237689dc51f8aef6d9d3f82
SHA2565e0b7a2fe64729ed8390d6664e910dd57626a805735f78436f3b1fe51331be9a
SHA512c8d9a34656b973c89b036bbe7d4d7d5c243708c5e6a3c5e201f68d77a735842125c44782f3e340bb26e5bde86346de4d5bb866f679288c6513210409a192edac
-
Filesize
2KB
MD5b0f734dc32eb7581cf953670c53ec1f5
SHA170a03dc426e1fc5c3bfa92ef86413d6e2a183c1e
SHA256d39474828ef401ccccc24fe236772096b309c400bc542aae372dc8e37f185f99
SHA5120ab7225fc87875ecc73d3d3dd8951a46659f9ee6846c68cd4392861bb0f61c32c89d809edfcd42b656641c8cd0314404a1e64170dd6ceb44c8f362644c930e4d
-
Filesize
2KB
MD5d83a0e5c80ead4602499685c60634e27
SHA127f78a8955ca3fb472af115e355ae6bc06c6985a
SHA2567ca14a4aa03bcdd4b15a09c9c19f63eeb00553ddcb51545ef444d30636c76f98
SHA5121db7a96d38912036c874bf9f9fac1609bfc46d4b5cd23240948e2e85e8b2e7e3beb5b2990799ffeae535655c8b336dc7ef15324630c8793ef62475e2f1b172dd
-
Filesize
1KB
MD52d17990e0ac70d71a3a3a36d9e827de0
SHA1d674daed870b8857b5b8515205f26611e91de89c
SHA256301836bb37e1250f62703f0440992463c2e93470f3708b9944f7d837a361502e
SHA512088f75ab59e0c529806f5650da8df353c3acc8546002a0cdaa0e12b6fdbfea3df7d57e0cfc6b9a7c5b12c1e77d4b58a1df300e16a92ec31eb99443ca7a311f21
-
Filesize
1KB
MD5ad43f1bbde11dc87f61ffb839005f8a3
SHA1238e1ab93bf5d49b76c013e3c37737de545b67a9
SHA2564dc465af581066183af657d8079670fca42f4d3023a8a6cd4820c8a0291a80f3
SHA51285cc7b15353454cfac1686eb8713719f296c2d7d7cb79b1de1390aaad51e659a50bcc6093fbb3fab0a5c4ad476e838bc5b28f63b93912bffe8c89d37d93f69a2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize5KB
MD54491628551c6f6716c8c80dab2d4b36d
SHA1829d07b65106013598e0c1b5a87505cabdbfa7ab
SHA256c5420635ac9fbeb68000ea0fe8ab787fd957e07db56d280ad2d71c76dc44c339
SHA5128a737f46abe62173f7bd7e893ccd64aefc16c10a416d534e61786ebf6ac5798a3ff5c1b88b9ef16a8a52221ba05b096a501ac221566857b4cf83178ad80f0fd3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize5KB
MD59887cfc6c66fbdbdb3f0cc29c073bddf
SHA13b843720bbb60389778afc0ebd8dc2e17e9479f3
SHA256271b182fa4e3c882d01c8ba0aa919ee62d381d73beff56a26f3edfee58c8b547
SHA5128ffe7aca67c491e55cb09676ec2d6fe7c0fd24a453c4ebc44e332f2fd026ee61698b9d7ed60561f8849ba84a9b92577e324135660059d9ea7f15788058fe5595
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize8KB
MD5041282a67608b8d698f5f99ec42954f9
SHA1c1d2d6bdf14d46dd3d79eb4f6215ddd24b520a20
SHA256b12747a583c344f8f0e556a7b02e5eee1c2d3df8dc9a02fb425c52d9e29b9c00
SHA512c41d1f5c7db579026a0ff0f7d8b2daf6f12c40c39f8a7e3dbdd0e29a5189edeb89325a17ead527838053b6a7303bd57f7f779306b679cea2fb0ee4f3e063cb6e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize5KB
MD50b9eda743b5f6f3c0da08d95cf3ffb3f
SHA1f37959fbfa240dbf4fdb4cd28bbcec5e10de2107
SHA256682ac489960dc82d95a8a44e2f37722ab5834eeae7333de8a4b9044192b183dc
SHA512c3ff217004c96b87856804b54d18c8b20cd0b3dd109f21c0cfa505ee83752dabeab0a49bd2b9bf6d9f5b63d95d65ec866468b3bc148a810bdf7df6b9065b505b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize7KB
MD5a5f0b0723d9bd4937f71178c06b9f2ad
SHA133dec3d5b0216a18b005b823e94b6dbbfc29084c
SHA2562dcec564ea77343b425ec5e5ae180cc17a27acdf9894c9b2a270f2d383d0ca9f
SHA5123687636d7d74b79c9adb0a3dee73ad533bbfbd748e36f2c1e7d269eaa30b640374316ad3a4e60dd600d039511f17c112046282dc165e989b863fddaa2f92e83e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize5KB
MD512c61231fc273dad649f2940832826b2
SHA1f640761284c7c8c679eac9a04ced5ad38413d403
SHA256b3ba25621643ad3f6360b9f1b8eaab08e9ffc83083a3c5ec32d4945a3c229c14
SHA512b64d9b0ec23e4b53465f498831fcbe81fec75fbfb27b3403a8a3e1ea88ae46c28fa5712f7b0f6d160bceda1e5ee28dc94f9708aded6902f832ae04f45d5d07b3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe622cb8.TMP
Filesize7KB
MD5967be8b5021ecf0cf8e3fa0bd28bcf53
SHA1bf164b76b82d140e11307a0aa96066a03a8dcc8f
SHA2566eb36bbe17179dd029c4ab4b1cea5ce5c5525e6d50eaaa0a1d2e8129430d3c88
SHA512431c4a6ec22676029875d400fc9f73622e32a9d48277a5295be6e81d3f25fad96c1b0e37908d88f15f91f17268c7183d241c9df05ee2dc13374bfed0c5ef5b59
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index
Filesize72B
MD53d24d02956430f7432b9f127e9dcedae
SHA168646f5a277adb8cd86fbc7ca0169118fbb4087a
SHA2564ca121b9c7d94fc0b85d2e299fd89d213aa15f07a2ff7cada688d092a72232d6
SHA512b17d17881e34f05140b1b54968ae742b6bb4cd18c5c74573219dcf3728ffcf61ccf7bda99a89e8f159b030d9fcc95b1dada79d52d18728224b03950809fe4d6b
-
Filesize
5KB
MD506ea6bc99dc7884683260df3f727f8f2
SHA1e39e2170b68602856180693acd05ba5ffd1fc32e
SHA256d79bd9607c957bacb19c994b853e988d9363754eccc8e092befb2728cfdd9f48
SHA51247e216cf0430dedeff7bbb6137ac1474661a43353ff94dcacd68ad3790770308e285435fb7f45a3d6e6dc330921cd54741c8c0c721d94ac250307660c0a3523a
-
Filesize
4KB
MD5f4e3e555b26456c13f1ea2f571554ee5
SHA1d9f7f66f66afc49fdb003e8d0696ccb9eb9781cd
SHA25678c64b00553d47ad8d6d59d6efaf274afad2ce0c1de8e7cb18fc30e4bae010fe
SHA5122f4becd7e04df7a1a6a4a577bad48855885dafdf15bcea1585eb2080ce4863ce8bf383366b6ebb0537228a83d247c2835a274b50fdfdfbbe4d73a93b4b46d15a
-
Filesize
4KB
MD5da895d7cb1980bd4639b19b3fd97f043
SHA1b739977d48b6ad5d4b6dc9b3c29d541159bee36b
SHA2563dc289320ececb8a548663785531a6f8ff7e816b29533010025edf927000177d
SHA5129ad5475cefb37dcd225d54be115694a2ade6ad9ae7aedc0c40f151a07ed5452b1823192cb46be93d6c975940ada59622b86e20c0b6884c808f35a5fda1a31ae8
-
Filesize
6KB
MD5b9ac477b40c60c8c6d190d8e929247de
SHA127ef82476c9ebeedde558ef848ece348b0704064
SHA256d1056f752ff0c78033c14c1d8a93600ca46a7be6f9a3481749eed1659b9854df
SHA51221944325dcb89d4ee36ab9b846c1087842b1d5db0a85a84b2f37be5860134a6f5a21427dfbb792a03a50a7336f458b1d4deab695a5d12a66c62546c930d6f28d
-
Filesize
1KB
MD5715a6cf0a1a2244c9ff3a258adeeb530
SHA16b0e36e7388abcd65040585fcf19f718b86cef37
SHA2564dd56aed63ca51f614a32b5277b45d3702d3e3cb517bb858e6018007989115a0
SHA512df13ea18d7f423a6a0150eb97b6843f01b0843b248eb50b91ee1d85eb018359fdca57aea731fd2c15a4972684eaeb1a504b7443ff20708e5f7c254f5a9233ea0
-
Filesize
4KB
MD5206a54ae1c8f687f8e7ff569d8cfd7d5
SHA1f7f9053be43ed3ecd23574062bed18fddbf4bd37
SHA2569c14291e50e5c5b513d5a6d26004b8194e5ed68522a843ac9bedf113b40cca88
SHA512449289b492ef6e46c853993211f2b3a0d89177d92516ee10f95486f6ea095fc46586c5a1ad992d4ed3cd2f93f7545de0da10f8b056bb5ed434766c7daa596ffb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe5f9246.TMP
Filesize4KB
MD530f90a225567442a2d8daefaa78c509e
SHA1038c7745c4e858bf06c37f478072141864bd79ab
SHA25603dd76c3d27ac685ef154e3e9443d56089d2dfb3b5b09f505c0a6daf943ee78f
SHA5123c02a56e1c8364787ca443c5f1e65c976206236ace57f0ff14a21d41ad93deb949bb1ada30d3ba17dcea5e15672ff332a71ede020d50c6322a76b500b1ce9462
-
Filesize
8KB
MD5a21b8b9b51469738269f064f0cd2e36e
SHA15844f9f6179899ce55d302ea4aa7b40c074c0f6f
SHA256bd9f174d498e5e2ce077f843cf30ff3db37161f1237c618d592847457708e2cf
SHA51213537ab39e1fd010a8b64893d3c75a4c632baf115bb6c0d7f323a28c18e8399b05aa94e5bcf66ab9d0c2031cf9785dfb7cb9c72bd594701b2f1a8c6dd9b48e04
-
Filesize
8KB
MD5aecfd9c05185d66ebe05c5e3cb8cbfc5
SHA1c7efc4170e85b6f9d8eebae120b6ac5b399e0042
SHA25696f44ffd98a1fba54306b597e62770aea4a0d77d4a4bceb796b8d0a3a9136ea8
SHA512dd50db7b8a93d2ae02835d984700c00fb865d83d7ed8529eea6516c02aafecf71ac7c43ba6b937711828dbbee4feb50d607def677fcd1fcd3fae908c03e45659
-
Filesize
6KB
MD5051253c4ab17bdda2ecfb1d7080b0609
SHA16d53f18c1fae7a3f363b6cfae90662f1f6fc2060
SHA2562695ee74349b2516b2c76b912b4254615265488f9470bbb7845112de90a79957
SHA5125549c88882af576c4e14566de25f4c4664809464935a208855c3cd7aba7b6c291228fa506c4a2e7662cd3e040de70811155e2a03f78eb7cefb9cd08db15187cd
-
Filesize
7KB
MD5af311f67a2bf842d05f29d765a4d2c1d
SHA1ea466f8378e017b23ac6fa635c9c0075c4560b22
SHA256fcb6b3bdcd82616db701c9bdcabc345a55fe59197ea642f87cda382975d201b6
SHA512500717671a659716212e50764dfc1ea4206408f1446c856291dd2785c4ce0de6ff728f690696ea331fbaf915b3b83e8d341c7fb05c1fc9ee1d6ef00d0bc54f8c
-
Filesize
8KB
MD5ab2f7211a410e8959c12994e88f5d6bc
SHA1f5ea83ac381e3d9c156417f5ed648f0bbc840aef
SHA2561e5c63d93bdb28962bb43708d48c90e6b9b8a5d705294d18fe3c453c53bf9e77
SHA512c48a2401fd9476c19b4efdb67208563a27a1bd08da0a041206f084fa64934a8ef97b420947459c5c7ee3da2c537710b885ca5a72f4a517a02e9e83418f3bcb07
-
Filesize
11KB
MD56be2f70aa0c70646b3783b03e3d4640a
SHA198ec0d8884ac6e590d740f6b8caa8455ed363235
SHA256e5e1a0b3fc054bcbe66a255769fa505dadba7d267c8ad3683bfa09021b4ab051
SHA512383de8514ae9d1cb789649ce052ff7cf1e909fa82941c8dea906469ee28b0dc652b2349ed8b9d269f96d1107c79646cb8867bc2020623077c04d9344e4995496
-
Filesize
8KB
MD5839e5c4d9eb121c89cfc8bc9c1c54ecf
SHA1db7149c12e63fec42a904ef7363c53a30059ce17
SHA25613e4a9a59db693cde4f83e2354435f3ad7a0e56881f35801e34e6953f340660d
SHA5120a15c56d3817e446f74a302871606da86d007a6d26e0f87ead5514d67616a0e1cb21104ae4a2202020425c968a2a6bb1b222b612aa7797b82a83194b2acaf80d
-
Filesize
10KB
MD54f489cf8a5ccebb21fbb243d53e05860
SHA1af260621810927bdb41fb8304477207255e05dc3
SHA256a79f90e4aa8127ba608bba61d94b6543d4a42d9c472de2d88429ce52e8890404
SHA51296955026c81fdfd0104d4096d2c793455b44567b6f7c844e669bef4dd5d7cf7340abd6c3c5d088d63697051d1ef198c894eb26d16f46834a1ed95ddb3eb921e8
-
Filesize
7KB
MD58c0838154dae503fd21df318cb80de51
SHA10f247ef1a5a99a3e42b79de5b223d72c58942b6e
SHA2566bcc71aa1bf09a194df368bb0c79764ed88de3e41b85fd2ef0fcfd0286bf9d08
SHA512087ac33bfa44ff907674f2ccda33eb8071c3fffadad67c19c938239ba74b7df437cd8c5148bac19935d44fb589c42ba6dff086bf939cf6de7f024f053859b676
-
Filesize
7KB
MD50b35d8923891e8b268f5a399fab658e7
SHA1fc2429e8de1129df66552fd35159fc983cc635f8
SHA2560f53435286760e7e3f60377f2323aafdb554f353151a3ac35b24c4ffd268a3ab
SHA5125488eb0f5721ab7451b0b6e44e191511390a84e85491543428a3b7190360b7e8088f73ba916531935b0f59e21074d8e6c560825b63812f785c92f430be0db081
-
Filesize
8KB
MD579b5fb8287e24bf06a6fcdc8cd3cf868
SHA13fec76b1ff2063d5b679023a88606f9c788bcd57
SHA2568f5fabec55159cf183330f713312ad5ee614075cdfbea0e5c873bfe5bccdaa53
SHA5121079240905e47e8018da430fa5928815d6e5665dce3314d2731a4b41b4a901022feb232599252ab657e833df3894951d36c74e7e2980add5bbda9df779eba9eb
-
Filesize
8KB
MD5db6e99de8e5454469874021fbb8bfaa9
SHA1867e0d6a2fc753a081e655e9f39fd0fd81df0159
SHA2561e2e89eebd79184eeb55800c898bb8db4c7c4721edf5c7ba30b4ec5e34acf2f8
SHA5124ea940347b8b90d2e9f10ba3cba60f2c0d22ea2af79f9b2603453ea6939c691e0da3db931842070ed5c1ae45691f8b63fa894c13f5d40fc6de7fda8e8442e3a1
-
Filesize
7KB
MD5e90ec3f3d8cef427d5b57bcd9847484e
SHA1be71fdf71addd36fe515fd2ffae785bb9d19c35a
SHA256eda2dbe4b3b612dcae6bc32f68f01fc0e842884d159b67f38fb83ba06fc39b85
SHA512deecf1594ab15c9a18a3bccbefa327b46f093b8055a89d0aa56a671899f35b2504389f39df81c4efd59ffec17854cd282a7e8e99ece1ca796bff75a247cba63b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\536a11ef-8ef0-4cc4-89f9-9a2f820282e5\index-dir\the-real-index
Filesize2KB
MD5a97da5a11d6a2e959eb6ff00476488f1
SHA1dee014b44e93aefe14b581295e3ed08f445f01e4
SHA256851be95b4d6e6091c11977789820c707b8df624bc471b54ae84e69f9f2c08cc9
SHA512f7629cd5cb061f28b176513fee8bafe6297af6862ded14d041dad50cd56ee1f410be758a02606a0360008485d9e58b55b27d2589b0b4f4d59b31e1dabec2d10c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\536a11ef-8ef0-4cc4-89f9-9a2f820282e5\index-dir\the-real-index
Filesize2KB
MD56f94126acdb6ab8fc2402b70e2229876
SHA11d04f25c71745b5da4dcce199dbc7d2a7808c476
SHA256f697693eb5b6fbb9177951dd793397986b971a9a07850e3fedd25e024b01e959
SHA512cbc4b3141e0ce9eba9a8ec39f682d91f02a97497e86bcc51d67feecbf9b4a37ca144fab405876d9134f0c4adf98bf57f2404f29f401fdd8e6d4331bcb1e9ef78
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\536a11ef-8ef0-4cc4-89f9-9a2f820282e5\index-dir\the-real-index~RFe59ff07.TMP
Filesize48B
MD5c6015a847ba46fe53b7e5a2cef16bf1a
SHA1fb98609bed1ca83d79cc0f1b161fef1bd17b89ff
SHA256cbbed0b50a28f642c31ba15e7768744f1c87464fdd01dfd21e29d465f5f41a0c
SHA51261303914306b08f3d5156c03a12026e43587430f7a0c87c7f983f9901288208c3fcf27e75fbdea79158d2d1c11749513f14494599f51c487d877d58d3da56970
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize84B
MD5beadffb312851d4ccb9c857064703bdc
SHA13a8833a15d7b59e037b69518a64344b9c59ad015
SHA25652fc7c599d2b43248c11ceb40ba683c1c9a28840320dd1772e0b743d6cb1c8e3
SHA512085cbe8e7d378afeb0c77ca75c65d5f52f25fa38d994f023eb1e830187b37abe8360ff26472364c88b5de099cd1afd74d67e9074813934c0c772c3748f9a02fc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize146B
MD5772ee26617c432f935654f46826853d1
SHA168aa5a940c32668e5d44d1a820a310e5a6105bec
SHA256f1527467e5cde40a703c74c12d1a3c5bfb26f23c3a843f52b4510f16ecd4c755
SHA5120eae9fa711610f66ea52676ded45ebee4bf2e1d3e81dbe6706cc38c162d9a1f00c064399093f156fd063a5f4ccd7a416a014a7ac3be7d6f4aca7997069a10b9a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize82B
MD53fa9629215481b5bcbfaec98d818386d
SHA14e745c4faf7edb6de7cb267b595365434c205b41
SHA256f1445dc3316aa7580947389c35274af44fe6655f1a0d82d4a16f825b2c4d7685
SHA5120ac088eb39684400125c92b3cf54860143be01802d2b8d78e13724df9e9eb323e9926fccefbce944ecb1ecfc67233d365e31838560412938e3b629b6772fa126
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize84B
MD59c6fad210837e0e371d6360e78df6bc6
SHA1c932643d9b4d8d93c2d0361318b39af7c52591c3
SHA25679d0ef948e264427bd342d97fe7a110c159a40cfc33b23d0bd6438de1f1875cb
SHA512a1d2b0bde0a84d1243cc6060cdf153aa7cbab0754b95ba92135ae62a61c7027048ffe9682f1a8f5cf47f47264190ab29d58373a38f03c34fe59db0e2913201c8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe59a138.TMP
Filesize89B
MD5da3e0e8def6d3b154a2eaf9a2c2a063f
SHA156d2e003065c859af8d3db31031e92edea76a9cf
SHA2562fa249fee4e1467eb62c6a7d14e24c6704683c5bd94976eecb856ec8dd626b9d
SHA5129f22d923199872c8d5eb26f7e38dfecd7f0d5838936f120c809188d7af4d7949f820954b2c8af6379778eb96a0970bcde1369676dbf0d4376b855ff3573302c4
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD517c3a2de49b072839b2fe8450cf7caf6
SHA19864a3abad2df5ee784bc49d342bbe6ebf5cee77
SHA256ddc54611b211aaf2cfb461db841462a6f8dd95156c7c5d49b632bca4ce265a68
SHA512a329f42cadc9d9cb1a7f6c9e7c96ef2d1c97f04c111a717c844523e51392dd92233fb7c3a6e502db0417b2b1e7610c0d43007cb6af3154b1cd077cefaad74acf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59f032.TMP
Filesize48B
MD544cee348d2289353f640d89500a44e58
SHA101f6769f0aa1bbc871ae679946c3bdbb4e4df375
SHA256376eb75c9fe4169cc93eb621f398fa58cf5348335a4823339147be82d8453e87
SHA512370d9181362b34386dbec4cdda78f93a270290a5f7cb5969ef705133c6646a59ab39e1b5ea5b7a9a7ef503efaf63a51cf6851beefdf27fc0eb285a9edee35df7
-
Filesize
59KB
MD5ad5d72bd07d90ba67682b6ba4bb35e2b
SHA181c36c5459b929343c075d0e25573874994273ca
SHA256b9aabc58d59ce7197fa810688f7d26fcc1f0b194a23ca9348bd9e688c29de17e
SHA512d961628e586ab5dcd58fad4a49e028a5a6a41cad8c00c5782116ca3a1b9d5bfeb1e6dc736dc161c2d2cc6b6e5736f5bca94c4b5fada906cdcc49f74423430614
-
Filesize
2KB
MD5be686d0f196ed28d79bb79127d669070
SHA15ad0c1bd58f3dae2b628470e5c9f6b646dbe6a13
SHA2565132389ede1d056e89f33936bd8a781f6e98716a50edcc61ae647db2db3579a8
SHA512f98381623704de2ab7e2e42b380d5562863100fd4f6d1c7a4bc9825a1718b72c486103d354052504cd9ed6f8bccd72b2ea20dffa74c9850b0260a1775f7d201c
-
Filesize
2KB
MD5db395a2e9d1b7424796c2119b6da988d
SHA167304f82a5bd24722dca84077c694c10a2f6c08c
SHA256d184477cf7e461fe8285d950520a1e40225d05258880a6f6426464ee20b17b8a
SHA512e18912f7478243d7d53367bf3779814ccfb6d94d0777873bdbd0b712e9a38dc6137ce10bd5d3323c289b4f6cfc54cd45579625a5e6a7be5cdf340a74334a3537
-
Filesize
2KB
MD5c51e77afc7bbd88eff7ec6af882c34b4
SHA17dbb39dc662ce90aad1cd09e36050fbad27610e3
SHA2569e09dc51d3d92ca80a52f56dd0b17aabbe992f3b9ec50d107adf48207d861a43
SHA5129471e8916235614976c177ad94b03a9408ce21fbbfcaacd049140f72dc5567b38188378c73873cc4c691f9bb321aea3ecba76ca8b56a4633bd4ec4d39a0d6e19
-
Filesize
2KB
MD52be0b1c260670371c992eef662c1f46b
SHA1450bea4679e541a62d1b4a5815e35701e5a3efff
SHA256a1f4114d2158b2dfac2671bdf0f039bdeb6d7b9e050fdd32596429e2e46c10a9
SHA51292c884257caf8ed275552eee689843ffc92866ce3cf4c0babc0f15a7b912c31411cc34312b8b6e037ee0788b4c7f08f574633dc0c6f0bdc022a0e9b043d82cd3
-
Filesize
2KB
MD51e148bb20b788ce35a260ad94fd29bef
SHA15f2ba7d11801c91b1aeb162ec1f224cc974fd115
SHA2563d4d15952ea1647a4e40cbc5342d31cc0100e987fd3039b0b1992c34047f3575
SHA5123d6d3d4ab88806f0bfc7ba6dc77250fccdd8cd9d8e83a0d3d63b22d890b7e8816eb1093b26f01ceb3647c86f0efcbec1ed64997551ac326ca0725f11c88e345f
-
Filesize
2KB
MD5e3ac2d856ff4cbf4d1684a5eae6a826a
SHA1b19210610975f875e382e79027e5467ba085a868
SHA2566cdff4181b56791ec1ab2f37aeb110486b999d5e851e175ca22faf5611de65af
SHA512a09f0a5b63a4ce76360e349e501dda418d0699dff5ed507424bd0dd8561cce10ff0e55986c1cb0aca3f56b9e0162691f5bcc4c4197d2e3e84ad0e93514ffa26e
-
Filesize
2KB
MD5a95662a2ac0a0b9d78a9f453fc02c8c8
SHA18a1b91034eb124b8be440d5fd98e067bc5b2c33b
SHA2565f9260684da68b00db10cb1c9b41c8d52dfb54185c230c404c0d06033caea282
SHA512a2cd7849769fad9d15a3593eac5e607366977337ee06c855eb3ffdae431409a0c0ef31f23679ab3c8eeadd4b53bf619fede87fa6200a1044c749aae49d6322db
-
Filesize
2KB
MD56ad6e0d1f602595dad944e645eca4091
SHA18291fa9382e47371c2f1f7ccde7dda2fd94d8792
SHA256e272918bb0edcd92d5d267aa2f7c2ed8c2f434689f05c9b79e08d12429900ab3
SHA512b7e2a1db81a899788d7dd0a12c1167ad0f86eb20c94d9f96b9a1d5415afe0039d01196abd1f258fc87c2d86c187ae4b00c3497ac5d6a14dfd4a81737103cceb9
-
Filesize
2KB
MD56bf32584260c22ccffdee94197a6a3b4
SHA16be395908d8a52033265a9458a933c101aa55d80
SHA256f4acc937bfafc60eccf13c74550761243951c6c2d0deff357300c8cc24732f19
SHA5121183ad5858005f23c479d189f58db208dfb8deaad9aef3f131f3f9b1d6fe87033f76e459a965f79a483ee5e1e41e0034f37e27a88b582a259a33a4477920182f
-
Filesize
1KB
MD5465e2c5590e66e2514383ef9706c7be2
SHA13a335ae0186b3f030c5d0f69faf8517d6c5ddca2
SHA2565beff867f744009a251b817710afab9250b749ef846e76b46371147cde3d8d1f
SHA512e86e0aab0ef5369498d5ffedb793513f986e579395c9843d013d8b6912f589cd8731f22360031f55f6a0881e970a117ef1631dd53863df73f9e9ad11c34688e9
-
Filesize
2KB
MD5bd056255f6f0ce2b2235051b285032d7
SHA189ac5c286d1ad711e9bf9c6402a709e4851daf90
SHA25603eaf8a8601f1a2aab7021a1efd5c355d3e812247bf3ea967dd67fff67bbb7b6
SHA51296068f96eed71ed740e27906f622dfc700c4571d3972136ba45c219d26ceb38c2234f9ff57f0c7cb2ee4e1b38eb7623aa8c74cbcee6fa47a9163e2f450bd7b48
-
Filesize
2KB
MD5a2459e596dac9bb9e99fde559daf6627
SHA1ae6072838283f430e2bfa297efafdd4b5d5449ed
SHA256ece57dafd5f63d431a9c4ae2e86e3d8d7f8c91f1995fcd1044a3318376e7c9b2
SHA512f16a91e18c1a627d707b33490e95703df0c17a55ddc2f5ccf6c9ec7a2c60df3ed04df3324cba63444bbc7bb6cc88626ec24ceeb5d0b6485add7787d304b63a35
-
Filesize
1KB
MD55235415dc84747cb0e49484c829ce4d4
SHA101c609453242d1fa39766a5342fdf26c86c437fc
SHA256e00717b9baa752e16080ab4abdbf07b50b8786548c51775594302d75cee9afb2
SHA512b684a2f67d47f21bad3e5c2c4ab07ecce8ebe3d1c805bde34b51077ab29003187739a0d4039fbbc81185749194cf37e6de14575ff6a761031c3839209c8eb536
-
Filesize
2KB
MD5bf4a30b23dfb5b259ad0f2e6484a4d68
SHA176abfce3c9b33f11133611b1c8c159800ffe65de
SHA256ee7cd9d70771ce387e611d679ca41f54265f26ad76569c2cc22f8e86ebe0055c
SHA51256a84e5d7c8bfd40027357dc4769d041499cc1f3d3f4cfea1bd8a094193c3bb6dfd2b34f3de5b3280bbf2bf091ce7ca7a788ccb788ad6788417d5d1c37d4265d
-
Filesize
2KB
MD5ff07e958e60e6375cf9314d8f3fc8ebd
SHA1f6264d6710233f1728c65415ccc04052b812b22b
SHA256d11616ff8d489fdbadddddc36bfc3997aafdd8c658c41a5437f5c58c4f71c50b
SHA512229b5790f888a682286845d18e560a4420540bcfb44a7c6c8c930793025a6f43a0b2b7b9b48909f8e289e51104b7f79a0344f43abc715b3a527478902298c834
-
Filesize
2KB
MD555804b4f84cb0798e071bd3aa04d98bb
SHA16801b4c590d8a76a5448171af5534107b94ee573
SHA2566d62c9bdb719acc65eb29621e811648c72fb81855e153e62b0100a228468785e
SHA512a9a761f72eb44c5c099e03c3d499be3cb5dac09edb719c3bc4a9675957ac3f0e8646655eca1f0f7b4680824a32d3ef4625fc51f02ec0adac511cf40d3cbc7f63
-
Filesize
2KB
MD5a54e829dbd2557780ccda5fc83d2b7ca
SHA1631488b255bbbfe99f122e4eb887e6155c7364c4
SHA2569134613241bede63bdfb8dc0c4b6af9ea1775a882ccae9635935c4826bad3354
SHA51253dd5ecc667daf02504e1846f84830513718ac6aabf9ceafc2c1c3ada37e145b372b983d74fb7c4025333e0c4b8269775bba331b256c6837404524a6b4840b03
-
Filesize
1KB
MD59432d1fa4dbabb807ddc38f19ee696d5
SHA19e72d3f037157d0676c43aa6366c7af67b82d89a
SHA2564e8aeace14e57a1ef9cabd70f8440b4b72e07701d290a4b092822432f2ba7a9e
SHA5123f5ac305b9b22a4f961af189d868ee8d18e29199f304c1a34bf467f4cade1fa4e8c1c04e3afb5db84e89c9d816482aeb3ced6967e39589276c0bffb0ba37362c
-
Filesize
1KB
MD54c88ffc893cbb3afe0098463239697fb
SHA1e60ae151a68fb09d94f6f72e5694b97f24eedf7b
SHA2568cfc7f230d6d4f03332a5d2aa533fdcc0a692b473c9622569e860507949b6d0d
SHA51265cc64d1c5d7f7f3b9d1197c199153780d6735d124926bd44563a22de6ea3d516524097c881edda01939e42b87088784ed2fe37aee1e2df1f6ffda7bff18c1e5
-
Filesize
2KB
MD566243694526035e0ecd9739b7828ccb2
SHA1a683d0b11bcc343a1838d38b466e7fee23596e00
SHA2566a745a4cb3c7fe00e555a222c160da6f67cfd8b60682f62ecac87c39b305c9ba
SHA512a13f6f173404cf493023b806f87d042717ca358ad896642d66a72a34b6fa7a2aa66a989991259b27739869983b239db2b2ab61a1b932a5e8e410316e313408ae
-
Filesize
2KB
MD5b3e14cf005616ece1cc6da3aed923aaa
SHA1a7dd197171444d1245c2618419f401b916822b86
SHA256b5f5487296f6e22d6eb9369c9fad66e8f5e84bfea1c60ed57bbb1073c72c7fed
SHA512d88196941da313f560a838bfb3cd74d5977be6b8c37905901072df4be5f59e3cfce096b2ac968332dd70632f970a1cfa9d561f0da033e724b74becaae41824a4
-
Filesize
3KB
MD5bbebf0ab6b8b59c5fcc3c30aa52a49bf
SHA169dbe0674131d3093b7d59875bb87687094e94f7
SHA2566ee411c6b86e1d33942b04b14d88ee0826db15014ae5c8f54d389d9b09b93288
SHA512ddf2b53d52eadeb5ee89408bd7b162e3c60ba6da97b3d633f95507db6c790f38f64319ce5a49657fdf6e61f4eefc50804ea5ce25cc300ef07c6d4a4035d5efcb
-
Filesize
2KB
MD59233ad34fa5cc3af0d6f0412ba083ec5
SHA1f9fde12938e908ae92c18b62c12f663ed0734291
SHA2561532250d3239a86d47282b4a684f2c8dd84bd096c6bb5495a439652db68200d2
SHA5129e7432ffce71fb252d9c9dafd2c6bdd052e249b69b1c8bfe1d14939fed34554d597f3faa469f5a412c3fc0188b68973e186266b8e962e3f8c6b383737ceedb7b
-
Filesize
2KB
MD520307f9255d9dbc95f76a9300faa7dce
SHA1510af6f1fbfa9c7ce5c6651f3bea0174e0af539f
SHA2566f585b0de245a788b6a2fa24a8376e678e259fe64a97f33120a5a13f84739b8e
SHA5124f5800e3173014bf3333851c36728276b17b9ba059dd20500c5af9ac4c661f09f448f9ac708abb96273286eef8868c1e5c71e3a51a637c9637e2ddc8d597adf3
-
Filesize
1KB
MD5eb1f28de5b01ce66ac5e053fc2e9218b
SHA14f559a9446f1b9866b626c39df48062b1288b253
SHA2562ddac995a3f99f4e21aef9b58e6893533b86f5ff9a5945fbebd1540d5ac579cb
SHA5129c9773fc806d9ed274c7a61635fa085854f1f3359c4b5d18c2c96c93a5e72f3c4e0f4c3b496fe0056b22912a5cb05a040d63f5f5f3cdc3ccb24283ce191124da
-
Filesize
2KB
MD522b6e443b7527bc6dc2c71aad8d6ea2a
SHA1e0682070f1b8b245b268512c5f997a4a802ee2a2
SHA256f3b579e580c186f8ac56c449d699a182399b0773e7b56c37120709e00920eb47
SHA512331e07f114aa0a37519a53cbb1aeef516f93a8d450e1372cf404f58bcfe33c0472cfdfdfff2966607e449fdca1157ce98a77b5773661b6c22f9b49c37042b1a4
-
Filesize
2KB
MD5d18b0178a431b2e116547d104bccf244
SHA13a0b07d5aad67fe6b294ab18ebd53de81001b555
SHA256dc78959e63688b138048dc2af755bd0f1b554fcee4ee60dc9085b9d62579974d
SHA51220a089a63c95cdf8ca2b9b2821d89194d161450e054c32e24379c2ff07f8e2575385cea343d5a0948e89dd2771dfe6e5a14d26c63984c6cd0330628a1671b551
-
Filesize
2KB
MD586cc18471ef1cf1403962c18e45c64fe
SHA1f88cac18737aaacd76f5c682394643a31b28fb8f
SHA25648dcca890fe3ed49b652a8f3ac7b3b30f8c8bb48b2e1e103943a983ffc5aa8bc
SHA5120e4784cace12853241b5ce4b78ed70493fd83edc40b7318531846d6e7ea7bdbbe34da21495ff9978d9234ec1c0efcd43e184696731f9896d2bd1b7504dbf7353
-
Filesize
3KB
MD5d29fd6a450035516c96807ec3eadb741
SHA1754c6641f5c5309ca728fb665bdd5da07d966f89
SHA256221b3ce20dc396aada3facb223d9e6092d974a5259108a26bd96a51ae9fd6603
SHA512511f7274daf50d742af3b784f794d2fcd97c8e159ad1f81b561fb7cbcfa775be38092bd933efbb541aa339be7eb98117b3f275ee4bfa15e396d03f721e55f3b4
-
Filesize
1KB
MD535a9f9b87d147d250e98800f62e6561e
SHA1c4ea41794468064496ae193dbe4339efd5564f08
SHA256105337d2e7c8cc0297aa58f7f8a4505fad88b82cd9e6707856443efd26311584
SHA512e37fb0fcd4c679d9da538be5ce8b46e4d7a48b281d05cc19563dbe1d264764be07e21a167786e27da29d648b60cef75f9218b72741d2b5d6a3cf90b274f9b2f0
-
Filesize
2KB
MD5ac305556969a03cc8097d99b56517baa
SHA17c263b242a1ad22988c75e7b19eee917180eeaf1
SHA25613b0858545cbfbf0522850fde0c50a6c50441fe2fe40d4dae101166c2525c9dd
SHA51276201429a48a3c7a6ebf77dfcb57da0432b373a4472323fb07c5223cf575168abc28fff20872d8ba14d47601f371bf98f929e52dca463aea2d0e5f746d8466fc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cb372160-856e-4667-893d-25541662cede.tmp
Filesize10KB
MD52ab7000cbf8fc06b22093e9cac218e70
SHA1d013fb5176fc721695858f94de8de9e036481025
SHA25638c998101f30a4947aa7976d4952c464123653ae1f5fd4a7e58067b84af70438
SHA5123f4fff6ce950e5dd96674ec99a2691db0b4ba314a30c36ebfc327648eed57a602aeda9a4cba114af00b6cb7fb56ab635f8a54114d1e479f3bcbbda8e977dc0ed
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5c2c5d3c3556afd90c9eb85dd38955c67
SHA1829347e91a958e2b92b557b64bcfb2da0c61651e
SHA25608eb82e28c95328324505ef038c84ad4a69631b620e96d59e83ff381529fa0c6
SHA512670476841f1f47e1763a81f1ffd4f87c0390b2183ca22fcd68031008e66c604c2d8f36c004885a66b8f090b8c17574fcdfa02ffc2da4c117ed58681dcd5266b6
-
Filesize
11KB
MD5fd226959f7af46d2a05052352ab2c468
SHA12ae20d99944f75569de19a0c4fbfb512b7f9c8ae
SHA256456bfb18884d31f084d2e1c807fe9641e02f769a76fc24c8e7ec2da695c66fb8
SHA5129c6534d8416b5a0ecca58e32e00ebc0d7c41cb3416d711fc7c81cf57c5046207f3147fd993e85c6f11830fb8ea234b77512c47d56b4902a055bcb4da500301a4
-
Filesize
11KB
MD58a056e57e2076a345e100d9282de8d38
SHA17baeccf9013c2d32ba9132788da9e53afa83a11a
SHA2566da1375e41702f5b0f4ba1c9e3738ddc6f81ffc0ad9418ab75a82b3452414a3c
SHA5122d6e8d14a38f486a93784e03ff705fe3bc784cbce095ed822aaea22749f024377f9f0b06959db5e77f5df99690cd66c078cb0fc223ca8db04722212de47d8fb8
-
Filesize
11KB
MD572c68676b2d2006f9532ee6c8ac36d20
SHA15bfa66f25cba0db2a768b3809332a842c26a4975
SHA256cf1e024071eb703d806c22cab5467ca8e292f3b94baee67c74afbe468d8ace1f
SHA512b932b1c50a9fdf82d7664cf5241af1724ae4fce52786573830c8f6ef0855fdb1573b5b10917577d628b73010f773ac44b8f2e646266d3ebaae734196feca126a
-
Filesize
11KB
MD5eab88e9d7028912cf7414ac6cecc6367
SHA17219071f0b8fca7a16a86d7061e0cc17df9bb7ca
SHA256c22c1bb94b67877c2f2cb9775c52ac9781129613e890a5bf519100e44a028cfc
SHA512f4e2304482e386d79cc5d53dc9101e75bdd4b19f197e35c4f482ca507128899b77449f82efe4bd12f56b896416286f60397fc341b75cac8cc3a9c84cd2928d7a
-
Filesize
11KB
MD5a218829ac1bb405702ef7a93cc576117
SHA1e48d3c1e9f241a56fa8ab7fe4e6a35c3b7acd915
SHA256d7f094cd5d3e294619da820affa29cd5890d8c6990b7a0211fab83d164354c62
SHA512ac68a4b5a5aef52d1822a7fa78ce319040068ba7086c4dcc3846b95f9e8ef53b94964a5eeb0d3ddab3927485d7633f47f66086f6e953a4ca12d28f318222d343
-
Filesize
11KB
MD54647d98df3d61b74e1860df2329c7e6a
SHA1cbedab6814a013a061b4725f81ea506c5260be8e
SHA256932c0f8597906552b6404880705f387abcfc93656b23e81285ee33c077290c58
SHA5125701e6b4191e92e8c7fa86621afd600febce678df0fe33e34abd8de9973bd19dea55723fcf81199197b83ca687612d8fc4eba5e7dc5025d68c63e46d19658bb6
-
Filesize
11KB
MD5a977969cfde40802da8815d9170d025c
SHA143aaff529d4319e637a3bdec735c19b68e46f6fc
SHA25643a0b0d448c6f9c0c65445bb208b753d8935fed55b199715139541277221a326
SHA5128ad28f641b43609a7cbe757cbaadd33f622acb877802443b6aa740298535e5280ba6c8b25bdd126048e9c62f2200628c20e1ab5ca3a7ab4339d71ae788c364da
-
Filesize
11KB
MD5ea6a54902cbfa0b340b68f1b8e2e8d1b
SHA1662452bf0fbe52d2331df0a843b49b51c4cdb510
SHA25678fadb4582ec6335ba068f32f3709006b1412919a4ee72839ed943085dc53da4
SHA512a7a2f6e9c75cf853d3dd086add8c7416050fa59a293a850810cd9b708a4ffedf49b80162e1c6fcd3e3c62ef0e6d04a57a54b10670c33347bb5dec7b4e15ea2a6
-
Filesize
11KB
MD5f5d715bda6b36eba641b4ff29f820b31
SHA183bae1ee01d3afb8a496f32d464acb959d064b35
SHA256b8419e620d8d72c488865e01a96bf36cc8da0b56ab61388a36c4cca8446885ed
SHA51268648b82c924e2ff6d28c162fb64ef5265f669e0ddf631d7cc1cbaf11468a6520244272cb4bcc20736f7442c895274fb71ac6946e1e6f201a59c9c83040574aa
-
Filesize
11KB
MD5570926dfcd71e873c0bae67d9fefdefe
SHA12cb81b50103fa203da6bfd50a69b6799f8cdf209
SHA2564693d46762190c9f3e38d1021b6af4913e353692d82c1c3069a20794eed5e573
SHA512c18deb8d1209837f84c12460a0de068f6f86fbc8fea11dd37f7107a1515b7d2ae5a21f60ec71c2af9dca73654549ac530c5270de052833d5ecac43f0875ec37a
-
Filesize
11KB
MD5c75ba0ebb8c5ff98d2e2b99787b33bde
SHA16a010f32d0bf4af5b828d8258c9a3be84e73fc05
SHA256598a57c38f5a9001b3d40d863a23688ac5b0e0f565043023bc23a5ffb8faa323
SHA512c541ecb155a91818d747410b2804615dc2d5eb47e552fd9edf4d1f6446cfdb01c16c59fa80a7d0a1f8646576505a1c075d8d097e41a0cb495c97be9e5df550eb
-
Filesize
11KB
MD5742ec4d57ce97b006cca0d274a3dbc9e
SHA1487ee2304be1eee80a0ef0f33ba9954bff7ad0ef
SHA256d4a3d62fe99a0a42d28d7e2e3d276ca5d72cedc4b8f1a37c263855ec2331afbc
SHA5120e9356dddc4725740c1f45be423f0dc79195e5cd43a8cbd52e8cbc6ed8cac37a05fda9375e4f946d905dc1bde3a947a4d389dba0d7bfe8315db08c8450e4bd5f
-
Filesize
11KB
MD510667f703f59ce45ae6be8282976f147
SHA19495f6dc6567d602f21c24c8c8c30351f0e445b5
SHA25620dfb8396791893e75014acc68bbc0bbd72ff5e4556f8138aada19985bebdb17
SHA512ea2a2c84c5f49b85c0912b9d10fa26dbe25c469fcc8fb554ad5c71adaf92e89589b1bcaacab17f3f194e284bff71d6128f673b7a05d0a748a6465efd9a151931
-
Filesize
11KB
MD5244a589fbdd4541ef811109a20d18f82
SHA14161bf41caca36e70c2c7faad3aa47ef7d39c7e0
SHA256695ff4eeb410df714c7bc406d189436eb3f224100d10f6c2f73d85716709966a
SHA5126e1d566fb945a429be3c0b41145687480d0eb89e3acdfdc58413c896b8c385426ea5c4aa2c71c786613eb965a4e18720893c9506efc2f0a785e37bff1607e74a
-
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
Filesize4KB
MD5c08d65f88e7537ae308a4517353d0bff
SHA17865f3806342c1c83870d554567e0085ca39d425
SHA256d977cf97267a7914294ef684027bba2e074e14b19e6de616865496cb532df190
SHA51217cbedd7d8f3d65d5e5c9f4230dd08888ba1b3672e208197f9a63daef333d62b02eef3348ba126664013c1a7f4fa0745aa4433c953000c92db0e982325029860
-
Filesize
36B
MD58708699d2c73bed30a0a08d80f96d6d7
SHA1684cb9d317146553e8c5269c8afb1539565f4f78
SHA256a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f
SHA51238ece3e441cc5d8e97781801d5b19bdede6065a0a50f7f87337039edeeb4a22ad0348e9f5b5542b26236037dd35d0563f62d7f4c4f991c51020552cfae03b264
-
Filesize
176KB
MD5bc82784f4aa47bcfed93e81a3b9950f2
SHA1f5f2238d45733a6dde53c7b7dfe3645ee8ae3830
SHA256dd47684334f0a2b716e96f142e8915266d5bc1725853fd0bdc6d06148db6167f
SHA512d2378f324d430f16ce7dcf1f656b504009b005cdb6df9d5215fe0786c112e8eba8c1650a83192b6a9afad5892a1a456714665233f6767765619ccb5ff28e2b8a
-
Filesize
403B
MD58a64c9c622a069c2d132b01eaadb485f
SHA13649cc9eedc1ab0b7be3262b5121ef892f79908c
SHA2565bc95627f24db49bd652904a4e2099f692e86a40052a5849f95837597fc1657b
SHA512eceb0ec7f18d9486540c649b0f5971148381d03498355c98d744ecc215606f308ab42cf968066b5fceba1b3d306c45ae16cbc69926c57738da848e8231ed0815
-
Filesize
31KB
MD5eb5b28b98b7e63f233c33b3b8d93605e
SHA1f6d808fb12211e320b8b12ef19bd67d2d330410f
SHA256d1fef93c14aa067c3096f70881cab89306d9c9a38461cda4bf21e4a0024a4b91
SHA5125917ca601194a92d17b18a1de5a257480399b147965afc3b6f32617bb5ab5d0f4dc2fc3c3e5b78e83cfa55cbf976ca31a32d444435276f2e3d6442d4a89bc1d7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms
Filesize4KB
MD5b3a271b8a756a2b590e759df3289b3ae
SHA111a59e884794469ad7f1208630ebd3424f1d493f
SHA2569c515d4406dbc8262b00282493065440b2c6a100b607c8d5590c55ffd6a7e2e7
SHA512cdb6515645529c42424f90aa3cf6f2ffa0fe90a20c8283595aca3793f261c937e936e1361b7fa96fbf95a527d6986ec8eaf7b568d661a7af3613db77d617f22e
-
Filesize
797B
MD5afa18cf4aa2660392111763fb93a8c3d
SHA1c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA256227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
SHA5124161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b
-
Filesize
5KB
MD535937222009a6aef52ca2cba21f81adb
SHA17454250c354d8108cf72dcf5fd5511b4a002522b
SHA25662dfa5bef3215aaeed8b100ee5c7e9e6b84dee461f3888ec6b2163f03c1fa751
SHA51221fb8fbd55db8604a217e000b6b32e31c6b2bb46ba37288ffafd43984b7965dbee5e24703135615b8e3f73fad0725b9d4409b73f7cc7cd22faf0be614c6157fb
-
Filesize
40KB
MD54b68fdec8e89b3983ceb5190a2924003
SHA145588547dc335d87ea5768512b9f3fc72ffd84a3
SHA256554701bc874da646285689df79e5002b3b1a1f76daf705bea9586640026697ca
SHA512b2205ad850301f179a078219c6ce29da82f8259f4ec05d980c210718551de916df52c314cb3963f3dd99dcfb9de188bd1c7c9ee310662ece426706493500036f
-
Filesize
4.0MB
MD542585ccd2b7867c12052653e4d54b7cc
SHA1a9348c3aabcc0171d1e35edeb37fd2da0fff0ad4
SHA256b47bcc55ca8dc0625a145d6809cfa3ad78e9e3b4f33bc608b5bcaf7e9e1e5827
SHA512e270bd1fbbaaccf3382048e9ac2489444a735ed32fb83f7681526a1edb0b7847d6adb8d75064b065309293ef75c45e2ea85fb132a1c12afd08b3a1346caad550
-
Filesize
27KB
MD5cffe1f958643d6120ca4b41ffc8c88cb
SHA16f65c3011fc96dc987411be51992ce40d411c890
SHA256e6aebf723ca843c4c97532256851fd7bc6daf9d9acbcf5fff2b2135616f1e434
SHA5122694ea6582521849d13a1dff07b9c30d5fe29ec21031bea0f683be582f7e949c7f0065445e7943c930c7906bc13267961b85b067c39f7ed12a9f87f3de922cc6
-
Filesize
2.8MB
MD51535aa21451192109b86be9bcc7c4345
SHA11af211c686c4d4bf0239ed6620358a19691cf88c
SHA2564641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6
SHA5121762b29f7b26911a7e6d244454eac7268235e2e0c27cd2ca639b8acdde2528c9ddf202ed59ca3155ee1d6ad3deba559a6eaf4ed74624c68688761e3e404e54da
-
Filesize
396KB
MD513f4b868603cf0dd6c32702d1bd858c9
SHA1a595ab75e134f5616679be5f11deefdfaae1de15
SHA256cae57a60c4d269cd1ca43ef143aedb8bfc4c09a7e4a689544883d05ce89406e7
SHA512e0d7a81c9cdd15a4ef7c8a9492fffb2c520b28cebc54a139e1bffa5c523cf17dfb9ffe57188cf8843d74479df402306f4f0ce9fc09d87c7cca92aea287e5ff24
-
Filesize
53KB
MD56536b10e5a713803d034c607d2de19e3
SHA1a6000c05f565a36d2250bdab2ce78f505ca624b7
SHA256775ba68597507cf3c24663f5016d257446abeb66627f20f8f832c0860cad84de
SHA51261727cf0b150aad6965b4f118f33fd43600fb23dde5f0a3e780cc9998dfcc038b7542bfae9043ce28fb08d613c2a91ff9166f28a2a449d0e3253adc2cb110018
-
Filesize
1.0MB
MD5055d1462f66a350d9886542d4d79bc2b
SHA1f1086d2f667d807dbb1aa362a7a809ea119f2565
SHA256dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0
SHA5122c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1
-
Filesize
7B
MD54047530ecbc0170039e76fe1657bdb01
SHA132db7d5e662ebccdd1d71de285f907e3a1c68ac5
SHA25682254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750
SHA5128f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e
-
Filesize
32KB
MD5eb9324121994e5e41f1738b5af8944b1
SHA1aa63c521b64602fa9c3a73dadd412fdaf181b690
SHA2562f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a
SHA5127f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2
-
Filesize
2KB
MD5a56d479405b23976f162f3a4a74e48aa
SHA1f4f433b3f56315e1d469148bdfd835469526262f
SHA25617d81134a5957fb758b9d69a90b033477a991c8b0f107d9864dc790ca37e6a23
SHA512f5594cde50ca5235f7759c9350d4054d7a61b5e61a197dffc04eb8cdef368572e99d212dd406ad296484b5f0f880bdc5ec9e155781101d15083c1564738a900a
-
Filesize
411KB
MD504251a49a240dbf60975ac262fc6aeb7
SHA1e211ca63af2ab85ffab1e5fbbdf28a4ef8f77de0
SHA25685a58aa96dccd94316a34608ba996656a22c8158d5156b6e454d9d69e6ff38c3
SHA5123422a231e1dadb68d3567a99d46791392ecf5883fd3bbc2cae19a595364dac46e4b2712db70b61b488937d906413d39411554034ffd3058389700a93c17568d2
-
Filesize
224KB
MD55c7fb0927db37372da25f270708103a2
SHA1120ed9279d85cbfa56e5b7779ffa7162074f7a29
SHA256be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
SHA512a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206
-
Filesize
111KB
MD5e8ed8aaf35e6059ba28504c19ff50bab
SHA101412235baf64c5b928252639369eea4e2ba5192
SHA2562d2a22db20a44474afbd7b0e6488690bad584dcae9789a5db776cc1a00b98728
SHA512d007c96b2fad26763d27be8447ca65e0ab890deb6388b90cf83c0b3431e09b225f7424098927b54f15fe34eae953b61b45371b0df4b2d89c60be9c006ffe9034
-
Filesize
236KB
MD5cf1416074cd7791ab80a18f9e7e219d9
SHA1276d2ec82c518d887a8a3608e51c56fa28716ded
SHA25678e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA5120bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5
-
Filesize
438KB
MD51bb4dd43a8aebc8f3b53acd05e31d5b5
SHA154cd1a4a505b301df636903b2293d995d560887e
SHA256a2380a5f503bc6f5fcfd4c72e5b807df0740a60a298e8686bf6454f92e5d3c02
SHA51294c70d592e806bb426760f61122b8321e8dc5cff7f793d51f9d5650821c502c43096f41d3e61207ca6989df5bfdbff57bc23328de16e99dd56e85efc90affdce
-
Filesize
153KB
MD5f33a4e991a11baf336a2324f700d874d
SHA19da1891a164f2fc0a88d0de1ba397585b455b0f4
SHA256a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7
SHA512edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20
-
Filesize
110KB
MD5139df873521412f2aebc4b45da0bc3e9
SHA13fd72fd5bad8ee9422fb9efa5f601f6b485404df
SHA256efe6bd2e0fc7030994fc2837b389da22c52a7b0bbdbd41852fcaf4308a23da10
SHA512d85cf83d3b2cf9af3076e40d7419be42a561bce1160376ba580b3078b581ed2bd6d274fb2a0767aa81a9e92052762f39c1c391ca0cac3043ad85a72862713bd3
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e