Resubmissions
23-08-2024 11:46
240823-nw9txsvclk 320-08-2024 09:04
240820-k1x45stbrg 820-08-2024 08:51
240820-ksmy7sxapm 1020-08-2024 08:11
240820-j3k2xs1flg 10Analysis
-
max time kernel
2224s -
max time network
2221s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20-08-2024 08:11
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://clickthis.photo/7BFBNH
Resource
win10v2004-20240802-en
Errors
General
-
Target
https://clickthis.photo/7BFBNH
Malware Config
Extracted
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\!Please Read Me!.txt
wannacry
15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
Extracted
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]
wannacry
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
description pid Process procid_target PID 3328 created 5864 3328 taskmgr.exe 546 PID 3328 created 5864 3328 taskmgr.exe 546 PID 3328 created 372 3328 taskmgr.exe 630 PID 3328 created 372 3328 taskmgr.exe 630 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wscript.exe -
Wannacry
WannaCry is a ransomware cryptoworm.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Downloads MZ/PE file
-
Possible privilege escalation attempt 5 IoCs
pid Process 940 takeown.exe 1336 takeown.exe 4392 takeown.exe 3764 takeown.exe 5552 icacls.exe -
Checks computer location settings 2 TTPs 11 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation GitHubDesktop.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation GitHubDesktop.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation Update.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation Free YouTube Downloader.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation MrsMajor3.0.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation MrsMajor3.0.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation MrsMajor3.0.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation GitHubDesktop.exe -
Drops startup file 32 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDA296.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD9B89.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD9437.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD8A19.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD81B1.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD81C8.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD5691.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDEF07.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD568A.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD9430.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD4525.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD3C45.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDEF1E.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDA2AD.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD8CB6.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD8A12.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD78CB.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD5EBA.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD451E.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD9B90.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD78B4.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD70D1.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD67B6.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD67CD.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD5EC1.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD95D1.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD95D8.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD4E21.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD8CBD.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD70D8.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD4E1A.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD3C4C.tmp WannaCrypt0r.exe -
Executes dropped EXE 64 IoCs
pid Process 1256 GitHubDesktopSetup-x64.exe 4592 Update.exe 5140 Squirrel.exe 724 GitHubDesktop.exe 4420 Update.exe 6072 GitHubDesktop.exe 4832 GitHubDesktop.exe 2628 GitHubDesktop.exe 4536 GitHubDesktop.exe 1528 GitHubDesktop.exe 6036 GitHubDesktop.exe 924 git.exe 836 Update.exe 1772 git.exe 3216 git.exe 216 git.exe 4088 git-lfs.exe 5500 git.exe 5128 git.exe 4908 git.exe 4836 git.exe 5856 git.exe 4804 git.exe 2132 git.exe 1932 git.exe 5956 git.exe 5764 git.exe 2320 git.exe 1156 git.exe 1244 git.exe 5580 git.exe 1436 git.exe 1720 git.exe 3928 git.exe 1772 git.exe 4844 git.exe 3328 git.exe 668 git.exe 5000 git.exe 2824 git.exe 2272 GitHubDesktop.exe 2568 git.exe 3764 git.exe 4984 git.exe 312 git.exe 5608 git.exe 3608 git.exe 4988 git.exe 5504 git.exe 5232 git.exe 4652 git.exe 2264 git.exe 4808 git.exe 6096 git.exe 4360 git.exe 1848 git.exe 1632 git.exe 6040 git.exe 5520 git.exe 2740 git.exe 5420 git.exe 5080 git.exe 5196 git.exe 3996 git.exe -
Loads dropped DLL 64 IoCs
pid Process 724 GitHubDesktop.exe 724 GitHubDesktop.exe 724 GitHubDesktop.exe 4832 GitHubDesktop.exe 6072 GitHubDesktop.exe 6072 GitHubDesktop.exe 6072 GitHubDesktop.exe 6072 GitHubDesktop.exe 6072 GitHubDesktop.exe 2628 GitHubDesktop.exe 2628 GitHubDesktop.exe 2628 GitHubDesktop.exe 4536 GitHubDesktop.exe 1528 GitHubDesktop.exe 6036 GitHubDesktop.exe 4536 GitHubDesktop.exe 4536 GitHubDesktop.exe 4536 GitHubDesktop.exe 4536 GitHubDesktop.exe 6036 GitHubDesktop.exe 6036 GitHubDesktop.exe 6036 GitHubDesktop.exe 6036 GitHubDesktop.exe 1772 git.exe 1772 git.exe 1772 git.exe 1772 git.exe 1772 git.exe 216 git.exe 216 git.exe 216 git.exe 216 git.exe 216 git.exe 216 git.exe 5500 git.exe 5500 git.exe 5500 git.exe 5500 git.exe 5500 git.exe 5128 git.exe 5128 git.exe 5128 git.exe 5128 git.exe 5128 git.exe 4908 git.exe 4908 git.exe 4908 git.exe 4908 git.exe 4908 git.exe 4836 git.exe 4836 git.exe 4836 git.exe 4836 git.exe 4836 git.exe 5856 git.exe 5856 git.exe 5856 git.exe 5856 git.exe 5856 git.exe 4804 git.exe 4804 git.exe 4804 git.exe 4804 git.exe 4804 git.exe -
Modifies file permissions 1 TTPs 5 IoCs
pid Process 3764 takeown.exe 5552 icacls.exe 940 takeown.exe 1336 takeown.exe 4392 takeown.exe -
Obfuscated with Agile.Net obfuscator 3 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule behavioral1/memory/4724-12271-0x0000000000AD0000-0x0000000000AFA000-memory.dmp agile_net behavioral1/files/0x029c0000000241e2-12885.dat agile_net behavioral1/files/0x00090000000241d8-12883.dat agile_net -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/3228-11665-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/3228-11668-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/5260-11685-0x0000000000400000-0x0000000000409000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cmkaqiluwluphj236 = "\"C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\tasksche.exe\"" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe" FreeYoutubeDownloader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Whistler = "C:\\Windows\\system32\\whismng.exe -next" Whiter.a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\WannaCry.exe\" /r" WannaCry.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: ChilledWindows.exe File opened (read-only) \??\N: mountvol.exe File opened (read-only) \??\A: mountvol.exe File opened (read-only) \??\Q: ChilledWindows.exe File opened (read-only) \??\V: takeown.exe File opened (read-only) \??\U: mountvol.exe File opened (read-only) \??\F: WannaCry.exe File opened (read-only) \??\N: ChilledWindows.exe File opened (read-only) \??\H: ChilledWindows.exe File opened (read-only) \??\K: ChilledWindows.exe File opened (read-only) \??\M: ChilledWindows.exe File opened (read-only) \??\G: mountvol.exe File opened (read-only) \??\N: mountvol.exe File opened (read-only) \??\B: mountvol.exe File opened (read-only) \??\A: ChilledWindows.exe File opened (read-only) \??\P: ChilledWindows.exe File opened (read-only) \??\A: mountvol.exe File opened (read-only) \??\D: mountvol.exe File opened (read-only) \??\E: mountvol.exe File opened (read-only) \??\M: mountvol.exe File opened (read-only) \??\E: ChilledWindows.exe File opened (read-only) \??\L: mountvol.exe File opened (read-only) \??\S: mountvol.exe File opened (read-only) \??\T: mountvol.exe File opened (read-only) \??\Z: mountvol.exe File opened (read-only) \??\B: ChilledWindows.exe File opened (read-only) \??\D: WannaCry.exe File opened (read-only) \??\H: mountvol.exe File opened (read-only) \??\Z: ChilledWindows.exe File opened (read-only) \??\J: mountvol.exe File opened (read-only) \??\Y: mountvol.exe File opened (read-only) \??\I: mountvol.exe File opened (read-only) \??\J: mountvol.exe File opened (read-only) \??\R: ChilledWindows.exe File opened (read-only) \??\V: takeown.exe File opened (read-only) \??\E: mountvol.exe File opened (read-only) \??\H: mountvol.exe File opened (read-only) \??\Q: mountvol.exe File opened (read-only) \??\R: mountvol.exe File opened (read-only) \??\U: mountvol.exe File opened (read-only) \??\B: mountvol.exe File opened (read-only) \??\U: ChilledWindows.exe File opened (read-only) \??\Y: mountvol.exe File opened (read-only) \??\G: mountvol.exe File opened (read-only) \??\H: mountvol.exe File opened (read-only) \??\D: mountvol.exe File opened (read-only) \??\W: mountvol.exe File opened (read-only) \??\E: mountvol.exe File opened (read-only) \??\Z: mountvol.exe File opened (read-only) \??\W: ChilledWindows.exe File opened (read-only) \??\O: mountvol.exe File opened (read-only) \??\D: mountvol.exe File opened (read-only) \??\O: ChilledWindows.exe File opened (read-only) \??\I: mountvol.exe File opened (read-only) \??\S: mountvol.exe File opened (read-only) \??\V: WannaCrypt0r.exe File opened (read-only) \??\X: mountvol.exe File opened (read-only) \??\K: mountvol.exe File opened (read-only) \??\X: ChilledWindows.exe File opened (read-only) \??\K: mountvol.exe File opened (read-only) \??\L: mountvol.exe File opened (read-only) \??\E: mountvol.exe File opened (read-only) \??\F: mountvol.exe File opened (read-only) \??\W: mountvol.exe -
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 704 drive.google.com 700 raw.githubusercontent.com 701 raw.githubusercontent.com 703 drive.google.com -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\whismng.exe Whiter.a.exe File opened for modification C:\Windows\SysWOW64\whismng.exe Whiter.a.exe -
Sets desktop wallpaper using registry 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp" !WannaDecryptor!.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" WannaCrypt0r.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" @[email protected] Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp" !WannaDecryptor!.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp" !WannaDecryptor!.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe FreeYoutubeDownloader.exe File opened for modification C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe FreeYoutubeDownloader.exe File opened for modification C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe FreeYoutubeDownloader.exe File created C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini FreeYoutubeDownloader.exe File opened for modification C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe FreeYoutubeDownloader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCToaster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WannaCry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCToaster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCToaster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskhsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language !WannaDecryptor!.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCToaster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCToaster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FreeYoutubeDownloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCToaster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DesktopPuzzle.exe -
Checks SCSI registry key(s) 3 TTPs 7 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Kills process with taskkill 15 IoCs
pid Process 6224 taskkill.exe 5052 taskkill.exe 1156 taskkill.exe 4060 taskkill.exe 828 taskkill.exe 4008 taskkill.exe 6316 taskkill.exe 3336 taskkill.exe 6524 taskkill.exe 6072 taskkill.exe 5824 taskkill.exe 3800 taskkill.exe 1336 taskkill.exe 5700 taskkill.exe 1140 taskkill.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings GitHubDesktop.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" GitHubDesktop.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\x-github-desktop-auth\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\GitHubDesktop\\app-3.4.3\\GitHubDesktop.exe\" \"--protocol-launcher\" \"%1\"" GitHubDesktop.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" GitHubDesktop.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 3a002e8005398e082303024b98265d99428e115f260001002600efbe11000000599b8a67d7e4da01e5286afdd9f2da0168846804daf2da0114000000 GitHubDesktop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ GitHubDesktop.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" GitHubDesktop.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" GitHubDesktop.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 660031000000000014593b4310004749544855427e3100004e0009000400efbe14593b4314593b432e000000113f02000000080000000000000000000000000000008d0f0e0167006900740068007500620020007600690072007500730065007300000018000000 GitHubDesktop.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2" GitHubDesktop.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" GitHubDesktop.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" GitHubDesktop.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" GitHubDesktop.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" GitHubDesktop.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell GitHubDesktop.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} GitHubDesktop.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\x-github-client\shell\open\command GitHubDesktop.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" GitHubDesktop.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff GitHubDesktop.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" GitHubDesktop.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff GitHubDesktop.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\x-github-client\URL Protocol GitHubDesktop.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 GitHubDesktop.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 GitHubDesktop.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" GitHubDesktop.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" GitHubDesktop.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\x-github-desktop-auth\ = "URL:x-github-desktop-auth" GitHubDesktop.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell GitHubDesktop.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" GitHubDesktop.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 GitHubDesktop.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\NodeSlot = "3" GitHubDesktop.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" GitHubDesktop.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" GitHubDesktop.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg GitHubDesktop.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" GitHubDesktop.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\x-github-desktop-auth\shell\open\command GitHubDesktop.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" GitHubDesktop.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" GitHubDesktop.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" GitHubDesktop.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "5" GitHubDesktop.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\x-github-client\shell GitHubDesktop.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" GitHubDesktop.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 GitHubDesktop.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} GitHubDesktop.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 GitHubDesktop.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff GitHubDesktop.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202 GitHubDesktop.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\github-windows\URL Protocol GitHubDesktop.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" GitHubDesktop.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" GitHubDesktop.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\x-github-desktop-auth\URL Protocol GitHubDesktop.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg GitHubDesktop.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 GitHubDesktop.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257" GitHubDesktop.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2392887640-1187051047-2909758433-1000\{87A3B939-38C2-445D-A169-67C95ECCB76F} msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff GitHubDesktop.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" GitHubDesktop.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 GitHubDesktop.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 GitHubDesktop.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ GitHubDesktop.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell GitHubDesktop.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 GitHubDesktop.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff GitHubDesktop.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 5852 reg.exe -
NTFS ADS 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 668243.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 567085.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 128145.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3180 msedge.exe 3180 msedge.exe 784 msedge.exe 784 msedge.exe 3256 identity_helper.exe 3256 identity_helper.exe 3948 msedge.exe 3948 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 4620 msedge.exe 4620 msedge.exe 4592 Update.exe 4592 Update.exe 6036 GitHubDesktop.exe 6036 GitHubDesktop.exe 6036 GitHubDesktop.exe 6036 GitHubDesktop.exe 4088 git-lfs.exe 4088 git-lfs.exe 4088 git-lfs.exe 4088 git-lfs.exe 2272 GitHubDesktop.exe 2272 GitHubDesktop.exe 4348 git-lfs.exe 4348 git-lfs.exe 4348 git-lfs.exe 4348 git-lfs.exe 5296 msedge.exe 5296 msedge.exe 4732 taskhsvc.exe 4732 taskhsvc.exe 4732 taskhsvc.exe 4732 taskhsvc.exe 4732 taskhsvc.exe 4732 taskhsvc.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe 3328 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 4 IoCs
pid Process 2628 GitHubDesktop.exe 5864 !WannaDecryptor!.exe 2992 @[email protected] 784 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 57 IoCs
pid Process 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4592 Update.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeDebugPrivilege 836 Update.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe Token: SeShutdownPrivilege 2628 GitHubDesktop.exe Token: SeCreatePagefilePrivilege 2628 GitHubDesktop.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 2628 GitHubDesktop.exe 2628 GitHubDesktop.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 2628 GitHubDesktop.exe 2628 GitHubDesktop.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2628 GitHubDesktop.exe 2628 GitHubDesktop.exe 2628 GitHubDesktop.exe 5524 !WannaDecryptor!.exe 5524 !WannaDecryptor!.exe 3884 !WannaDecryptor!.exe 3884 !WannaDecryptor!.exe 4272 !WannaDecryptor!.exe 4272 !WannaDecryptor!.exe 5864 !WannaDecryptor!.exe 5864 !WannaDecryptor!.exe 4420 @[email protected] 4420 @[email protected] 2992 @[email protected] 2992 @[email protected] 5648 @[email protected] 5116 @[email protected] 5568 @[email protected] 576 @[email protected] 372 !WannaDecryptor!.exe 372 !WannaDecryptor!.exe 3128 !WannaDecryptor!.exe 3128 !WannaDecryptor!.exe 4272 @[email protected] 5620 @[email protected] 5196 !WannaDecryptor!.exe 5024 @[email protected] 5924 @[email protected] 5948 @[email protected] 5308 @[email protected] 3088 @[email protected] 1540 @[email protected] 2540 @[email protected] 3648 @[email protected] 5700 @[email protected] 5600 @[email protected] 4712 @[email protected] 1660 @[email protected] 5660 OpenWith.exe 352 FreeYoutubeDownloader.exe 1980 FreeYoutubeDownloader.exe 1624 @[email protected] 6040 @[email protected] 3036 @[email protected] 5312 @[email protected] 416 @[email protected] 416 @[email protected] 4864 MrsMajor3.0.exe 4008 @[email protected] 2380 @[email protected] 5908 javaw.exe 4864 javaw.exe 4864 javaw.exe 5908 javaw.exe 5332 javaw.exe 5332 javaw.exe 4196 javaw.exe 4196 javaw.exe 468 javaw.exe 468 javaw.exe 684 @[email protected] 3884 javaw.exe 3884 javaw.exe 5996 MrsMajor3.0.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 784 wrote to memory of 4948 784 msedge.exe 84 PID 784 wrote to memory of 4948 784 msedge.exe 84 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 2096 784 msedge.exe 85 PID 784 wrote to memory of 3180 784 msedge.exe 86 PID 784 wrote to memory of 3180 784 msedge.exe 86 PID 784 wrote to memory of 212 784 msedge.exe 87 PID 784 wrote to memory of 212 784 msedge.exe 87 PID 784 wrote to memory of 212 784 msedge.exe 87 PID 784 wrote to memory of 212 784 msedge.exe 87 PID 784 wrote to memory of 212 784 msedge.exe 87 PID 784 wrote to memory of 212 784 msedge.exe 87 PID 784 wrote to memory of 212 784 msedge.exe 87 PID 784 wrote to memory of 212 784 msedge.exe 87 PID 784 wrote to memory of 212 784 msedge.exe 87 PID 784 wrote to memory of 212 784 msedge.exe 87 PID 784 wrote to memory of 212 784 msedge.exe 87 PID 784 wrote to memory of 212 784 msedge.exe 87 PID 784 wrote to memory of 212 784 msedge.exe 87 PID 784 wrote to memory of 212 784 msedge.exe 87 PID 784 wrote to memory of 212 784 msedge.exe 87 PID 784 wrote to memory of 212 784 msedge.exe 87 PID 784 wrote to memory of 212 784 msedge.exe 87 PID 784 wrote to memory of 212 784 msedge.exe 87 PID 784 wrote to memory of 212 784 msedge.exe 87 PID 784 wrote to memory of 212 784 msedge.exe 87 -
System policy modification 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wscript.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wscript.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wscript.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System wscript.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 20 IoCs
pid Process 2296 attrib.exe 1952 attrib.exe 6692 attrib.exe 5264 attrib.exe 5612 attrib.exe 5532 attrib.exe 2528 attrib.exe 4160 attrib.exe 3948 attrib.exe 5948 attrib.exe 836 attrib.exe 876 attrib.exe 5732 attrib.exe 4124 attrib.exe 5680 attrib.exe 3028 attrib.exe 5204 attrib.exe 5940 attrib.exe 2280 attrib.exe 460 attrib.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://clickthis.photo/7BFBNH1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd70fd46f8,0x7ffd70fd4708,0x7ffd70fd47182⤵PID:4948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:2096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 /prefetch:82⤵PID:212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:12⤵PID:1876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:12⤵PID:1508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:12⤵PID:1444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:12⤵PID:3664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:12⤵PID:1772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:82⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:12⤵PID:4752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:12⤵PID:1592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:12⤵PID:2516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:12⤵PID:740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:12⤵PID:2508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:12⤵PID:5252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:12⤵PID:5260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:12⤵PID:5572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:12⤵PID:5912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3548 /prefetch:82⤵PID:2404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6432 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:12⤵PID:6092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:12⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:12⤵PID:1056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:12⤵PID:5168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1856 /prefetch:12⤵PID:5200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2764 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:12⤵PID:2736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:12⤵PID:3232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4236 /prefetch:82⤵PID:1524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:12⤵PID:4228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7264 /prefetch:82⤵PID:6032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:12⤵PID:5216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:12⤵PID:5224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7776 /prefetch:12⤵PID:4216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:12⤵PID:1528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:12⤵PID:2768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:12⤵PID:5464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7984 /prefetch:12⤵PID:3808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7556 /prefetch:12⤵PID:5816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7084 /prefetch:12⤵PID:5068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:12⤵PID:5988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7476 /prefetch:12⤵PID:5784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7388 /prefetch:12⤵PID:4984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7020 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:12⤵PID:444
-
-
C:\Users\Admin\Downloads\GitHubDesktopSetup-x64.exe"C:\Users\Admin\Downloads\GitHubDesktopSetup-x64.exe"2⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4592 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\Squirrel.exe"C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe4⤵
- Executes dropped EXE
PID:5140
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe"C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe" --squirrel-install 3.4.34⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:724 -
C:\Users\Admin\AppData\Local\GitHubDesktop\Update.exeC:\Users\Admin\AppData\Local\GitHubDesktop\Update.exe --createShortcut GitHubDesktop.exe -l StartMenu,Desktop5⤵
- Executes dropped EXE
PID:4420
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe"C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\GitHub Desktop" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1884,i,2577384626541461106,542073849165868911,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6072
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe"C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\GitHub Desktop" --field-trial-handle=2068,i,2577384626541461106,542073849165868911,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4832
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe"C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe" --squirrel-firstrun4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2628 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe"C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\GitHub Desktop" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2008,i,15512622964302013275,9973907934409060862,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4536
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe"C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\GitHub Desktop" --field-trial-handle=2388,i,15512622964302013275,9973907934409060862,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe"C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\GitHub Desktop" --app-user-model-id=com.squirrel.GitHubDesktop.GitHubDesktop --app-path="C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app" --no-sandbox --no-zygote --disable-blink-features=Auxclick --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2576,i,15512622964302013275,9973907934409060862,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:6036 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe --version6⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe --version7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe lfs install --skip-repo6⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe lfs install --skip-repo7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:216 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\libexec\git-core\git-lfs.exegit-lfs install --skip-repo8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4088 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit version9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5500
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit -c filter.lfs.smudge= -c filter.lfs.clean= -c filter.lfs.process= -c filter.lfs.required=false rev-parse --git-dir9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5128
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit -c filter.lfs.smudge= -c filter.lfs.clean= -c filter.lfs.process= -c filter.lfs.required=false remote9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4908
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit config --includes --global filter.lfs.process9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4836
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit config --includes --global --replace-all filter.lfs.process "git-lfs filter-process"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5856
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit config --includes --global filter.lfs.required9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4804
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit config --includes --global --replace-all filter.lfs.required true9⤵
- Executes dropped EXE
PID:2132
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit config --includes --global filter.lfs.clean9⤵
- Executes dropped EXE
PID:1932
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit config --includes --global --replace-all filter.lfs.clean "git-lfs clean -- %f"9⤵
- Executes dropped EXE
PID:5956
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit config --includes --global filter.lfs.smudge9⤵
- Executes dropped EXE
PID:5764
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit config --includes --global --replace-all filter.lfs.smudge "git-lfs smudge -- %f"9⤵
- Executes dropped EXE
PID:2320
-
-
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z --global user.name6⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z --global user.name7⤵
- Executes dropped EXE
PID:1436
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z --global user.email6⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z --global user.email7⤵
- Executes dropped EXE
PID:5580
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z --global user.name6⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z --global user.name7⤵
- Executes dropped EXE
PID:4844
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z --global user.email6⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z --global user.email7⤵
- Executes dropped EXE
PID:1772
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config --global --replace-all user.name vvvvvvvvvvvvvvvvvvvvvvalllllllllllllll6⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config --global --replace-all user.name vvvvvvvvvvvvvvvvvvvvvvalllllllllllllll7⤵
- Executes dropped EXE
PID:668
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config --global --replace-all user.email [email protected]6⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exePID:2824
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z --global init.defaultBranch6⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z --global init.defaultBranch7⤵
- Executes dropped EXE
PID:3764
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe -c init.defaultBranch=main clone --recursive --progress -- https://www.bing.com/ck/a?!&&p=83f36d8db971f9bcJmltdHM9MTcyNDExMjAwMCZpZ3VpZD0zNWVhNWFlZi1jYjU3LTY3OTEtMWQzZC00ZTBlY2FlYTY2YTQmaW5zaWQ9NTQ5NA&ptn=3&ver=2&hsh=3&fclid=35ea5aef-cb57-6791-1d3d-4e0ecaea66a4&psq=github+viruses&u=a1aHR0cHM6Ly9naXRodWIuY29tL0RhMmRhbHVzL1RoZS1NQUxXQVJFLVJlcG8&ntb=1 C:\Users\Admin\Documents\GitHub\a?!&&p=83f36d8db971f9bcJmltdHM9MTcyNDExMjAwMCZpZ3VpZD0zNWVhNWFlZi1jYjU3LTY3OTEtMWQzZC00ZTBlY2FlYTY2YTQmaW5zaWQ9NTQ5NA&ptn=3&ver=2&hsh=3&fclid=35ea5aef-cb57-6791-1d3d-4e0ecaea66a4&psq=github+viruses&u=a1aHR0cHM6Ly9naXRodWIuY29tL0RhMmRhbHVzL1RoZS1NQUxXQVJFLVJlcG8&ntb=16⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe -c init.defaultBranch=main clone --recursive --progress -- https://www.bing.com/ck/a?!&&p=83f36d8db971f9bcJmltdHM9MTcyNDExMjAwMCZpZ3VpZD0zNWVhNWFlZi1jYjU3LTY3OTEtMWQzZC00ZTBlY2FlYTY2YTQmaW5zaWQ9NTQ5NA&ptn=3&ver=2&hsh=3&fclid=35ea5aef-cb57-6791-1d3d-4e0ecaea66a4&psq=github+viruses&u=a1aHR0cHM6Ly9naXRodWIuY29tL0RhMmRhbHVzL1RoZS1NQUxXQVJFLVJlcG8&ntb=1 C:\Users\Admin\Documents\GitHub\a?!&&p=83f36d8db971f9bcJmltdHM9MTcyNDExMjAwMCZpZ3VpZD0zNWVhNWFlZi1jYjU3LTY3OTEtMWQzZC00ZTBlY2FlYTY2YTQmaW5zaWQ9NTQ5NA&ptn=3&ver=2&hsh=3&fclid=35ea5aef-cb57-6791-1d3d-4e0ecaea66a4&psq=github+viruses&u=a1aHR0cHM6Ly9naXRodWIuY29tL0RhMmRhbHVzL1RoZS1NQUxXQVJFLVJlcG8&ntb=17⤵
- Executes dropped EXE
PID:312
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z --global init.defaultBranch6⤵
- Executes dropped EXE
PID:5608 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z --global init.defaultBranch7⤵
- Executes dropped EXE
PID:3608
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe -c init.defaultBranch=main clone --recursive --progress -- https://www.bing.com/ck/a?!&&p=83f36d8db971f9bcJmltdHM9MTcyNDExMjAwMCZpZ3VpZD0zNWVhNWFlZi1jYjU3LTY3OTEtMWQzZC00ZTBlY2FlYTY2YTQmaW5zaWQ9NTQ5NA&ptn=3&ver=2&hsh=3&fclid=35ea5aef-cb57-6791-1d3d-4e0ecaea66a4&psq=github+viruses&u=a1aHR0cHM6Ly9naXRodWIuY29tL0RhMmRhbHVzL1RoZS1NQUxXQVJFLVJlcG8&ntb=1 C:\Users\Admin\Documents\GitHub\a?!&&p=83f36d8db971f9bcJmltdHM9MTcyNDExMjAwMCZpZ3VpZD0zNWVhNWFlZi1jYjU3LTY3OTEtMWQzZC00ZTBlY2FlYTY2YTQmaW5zaWQ9NTQ5NA&ptn=3&ver=2&hsh=3&fclid=35ea5aef-cb57-6791-1d3d-4e0ecaea66a4&psq=github+viruses&u=a1aHR0cHM6Ly9naXRodWIuY29tL0RhMmRhbHVzL1RoZS1NQUxXQVJFLVJlcG8&ntb=16⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe -c init.defaultBranch=main clone --recursive --progress -- https://www.bing.com/ck/a?!&&p=83f36d8db971f9bcJmltdHM9MTcyNDExMjAwMCZpZ3VpZD0zNWVhNWFlZi1jYjU3LTY3OTEtMWQzZC00ZTBlY2FlYTY2YTQmaW5zaWQ9NTQ5NA&ptn=3&ver=2&hsh=3&fclid=35ea5aef-cb57-6791-1d3d-4e0ecaea66a4&psq=github+viruses&u=a1aHR0cHM6Ly9naXRodWIuY29tL0RhMmRhbHVzL1RoZS1NQUxXQVJFLVJlcG8&ntb=1 C:\Users\Admin\Documents\GitHub\a?!&&p=83f36d8db971f9bcJmltdHM9MTcyNDExMjAwMCZpZ3VpZD0zNWVhNWFlZi1jYjU3LTY3OTEtMWQzZC00ZTBlY2FlYTY2YTQmaW5zaWQ9NTQ5NA&ptn=3&ver=2&hsh=3&fclid=35ea5aef-cb57-6791-1d3d-4e0ecaea66a4&psq=github+viruses&u=a1aHR0cHM6Ly9naXRodWIuY29tL0RhMmRhbHVzL1RoZS1NQUxXQVJFLVJlcG8&ntb=17⤵
- Executes dropped EXE
PID:5504
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z --global init.defaultBranch6⤵
- Executes dropped EXE
PID:5232 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z --global init.defaultBranch7⤵
- Executes dropped EXE
PID:4652
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe -c init.defaultBranch=main clone --recursive --progress -- https://www.bing.com/ck/a?!&&p=83f36d8db971f9bcJmltdHM9MTcyNDExMjAwMCZpZ3VpZD0zNWVhNWFlZi1jYjU3LTY3OTEtMWQzZC00ZTBlY2FlYTY2YTQmaW5zaWQ9NTQ5NA&ptn=3&ver=2&hsh=3&fclid=35ea5aef-cb57-6791-1d3d-4e0ecaea66a4&psq=github+viruses&u=a1aHR0cHM6Ly9naXRodWIuY29tL0RhMmRhbHVzL1RoZS1NQUxXQVJFLVJlcG8&ntb=1 "C:\Users\Admin\Desktop\github viruses\a?!&&p=83f36d8db971f9bcJmltdHM9MTcyNDExMjAwMCZpZ3VpZD0zNWVhNWFlZi1jYjU3LTY3OTEtMWQzZC00ZTBlY2FlYTY2YTQmaW5zaWQ9NTQ5NA&ptn=3&ver=2&hsh=3&fclid=35ea5aef-cb57-6791-1d3d-4e0ecaea66a4&psq=github+viruses&u=a1aHR0cHM6Ly9naXRodWIuY29tL0RhMmRhbHVzL1RoZS1NQUxXQVJFLVJlcG8&ntb=1"6⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe -c init.defaultBranch=main clone --recursive --progress -- https://www.bing.com/ck/a?!&&p=83f36d8db971f9bcJmltdHM9MTcyNDExMjAwMCZpZ3VpZD0zNWVhNWFlZi1jYjU3LTY3OTEtMWQzZC00ZTBlY2FlYTY2YTQmaW5zaWQ9NTQ5NA&ptn=3&ver=2&hsh=3&fclid=35ea5aef-cb57-6791-1d3d-4e0ecaea66a4&psq=github+viruses&u=a1aHR0cHM6Ly9naXRodWIuY29tL0RhMmRhbHVzL1RoZS1NQUxXQVJFLVJlcG8&ntb=1 "C:\Users\Admin\Desktop\github viruses\a?!&&p=83f36d8db971f9bcJmltdHM9MTcyNDExMjAwMCZpZ3VpZD0zNWVhNWFlZi1jYjU3LTY3OTEtMWQzZC00ZTBlY2FlYTY2YTQmaW5zaWQ9NTQ5NA&ptn=3&ver=2&hsh=3&fclid=35ea5aef-cb57-6791-1d3d-4e0ecaea66a4&psq=github+viruses&u=a1aHR0cHM6Ly9naXRodWIuY29tL0RhMmRhbHVzL1RoZS1NQUxXQVJFLVJlcG8&ntb=1"7⤵
- Executes dropped EXE
PID:4808
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe rev-parse --is-bare-repository --show-cdup6⤵
- Executes dropped EXE
PID:6096 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe rev-parse --is-bare-repository --show-cdup7⤵
- Executes dropped EXE
PID:4360
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z --global init.defaultBranch6⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z --global init.defaultBranch7⤵
- Executes dropped EXE
PID:1632
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe -c init.defaultBranch=main init6⤵
- Executes dropped EXE
PID:6040 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe -c init.defaultBranch=main init7⤵
- Executes dropped EXE
PID:5520
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe rev-parse --is-bare-repository --show-cdup6⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe rev-parse --is-bare-repository --show-cdup7⤵
- Executes dropped EXE
PID:5420
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe remote -v6⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe remote -v7⤵PID:5568
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe remote -v6⤵
- Executes dropped EXE
PID:5196 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe remote -v7⤵PID:1012
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe --no-optional-locks status --untracked-files=all --branch --porcelain=2 -z6⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe --no-optional-locks status --untracked-files=all --branch --porcelain=2 -z7⤵PID:5620
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z --local user.name6⤵PID:3420
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z --local user.name7⤵PID:5672
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe remote -v6⤵PID:3692
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe remote -v7⤵PID:4624
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe lfs track6⤵PID:2408
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe lfs track7⤵PID:2016
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\libexec\git-core\git-lfs.exegit-lfs track8⤵
- Suspicious behavior: EnumeratesProcesses
PID:4348 -
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit version9⤵PID:5812
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit -c filter.lfs.smudge= -c filter.lfs.clean= -c filter.lfs.process= -c filter.lfs.required=false rev-parse --git-dir9⤵PID:3852
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\usr\bin\uname.exeuname9⤵PID:2872
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit -c filter.lfs.smudge= -c filter.lfs.clean= -c filter.lfs.process= -c filter.lfs.required=false remote9⤵PID:1888
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit -c filter.lfs.smudge= -c filter.lfs.clean= -c filter.lfs.process= -c filter.lfs.required=false rev-parse --git-dir --show-toplevel9⤵PID:5008
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit config --includes --local lfs.repositoryformatversion9⤵PID:2284
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit config --includes --replace-all lfs.repositoryformatversion 09⤵PID:2568
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit -c filter.lfs.smudge= -c filter.lfs.clean= -c filter.lfs.process= -c filter.lfs.required=false var GIT_ATTR_SYSTEM9⤵PID:640
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit config --includes -l9⤵PID:3528
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit rev-parse --is-bare-repository9⤵PID:5400
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit config --includes -l --blob :.lfsconfig9⤵PID:4604
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit config --includes -l --blob HEAD:.lfsconfig9⤵PID:5560
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit -c filter.lfs.smudge= -c filter.lfs.clean= -c filter.lfs.process= -c filter.lfs.required=false ls-files -z --cached --sparse --exclude-standard --others9⤵PID:2704
-
-
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe remote -v6⤵PID:836
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe remote -v7⤵PID:3556
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z --local user.email6⤵PID:2828
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z --local user.email7⤵PID:5700
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe for-each-ref --format=%00%(refname)%00%(refname:short)%00%(upstream:short)%00%(objectname)%00%(author)%00%(symref)%00 refs/heads refs/remotes6⤵PID:4600
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe for-each-ref --format=%00%(refname)%00%(refname:short)%00%(upstream:short)%00%(objectname)%00%(author)%00%(symref)%00 refs/heads refs/remotes7⤵PID:6076
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe log -g --no-abbrev-commit --pretty=oneline HEAD -n 2500 --6⤵PID:3896
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe log -g --no-abbrev-commit --pretty=oneline HEAD -n 2500 --7⤵PID:4612
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z --global init.defaultBranch6⤵PID:4756
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z --global init.defaultBranch7⤵PID:5044
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z pull.rebase6⤵PID:1632
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z pull.rebase7⤵PID:2540
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe log -g -z --format=%gD%x00%H%x00%gs%x00%T%x00%P refs/stash6⤵PID:5104
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe log -g -z --format=%gD%x00%H%x00%gs%x00%T%x00%P refs/stash7⤵PID:444
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe var GIT_AUTHOR_IDENT6⤵PID:6132
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe var GIT_AUTHOR_IDENT7⤵PID:3168
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe show-ref --tags -d6⤵PID:5516
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe show-ref --tags -d7⤵PID:3032
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z --local user.name6⤵PID:2740
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z --local user.name7⤵PID:5908
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe log HEAD --date=raw --max-count=100 --skip=0 -z "--format=%H%x00%h%x00%s%x00%b%x00%an <%ae> %ad%x00%cn <%ce> %cd%x00%P%x00%(trailers:unfold,only)%x00%D" --no-show-signature --no-color --6⤵PID:5196
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe log HEAD --date=raw --max-count=100 --skip=0 -z "--format=%H%x00%h%x00%s%x00%b%x00%an <%ae> %ad%x00%cn <%ce> %cd%x00%P%x00%(trailers:unfold,only)%x00%D" --no-show-signature --no-color --7⤵PID:740
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z --local user.email6⤵PID:5920
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z --local user.email7⤵PID:4944
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe --no-optional-locks status --untracked-files=all --branch --porcelain=2 -z6⤵PID:452
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe --no-optional-locks status --untracked-files=all --branch --porcelain=2 -z7⤵PID:2560
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe reset -- .6⤵PID:5976
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe reset -- .7⤵PID:5044
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe update-index --add --remove --replace -z --stdin6⤵PID:1876
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe update-index --add --remove --replace -z --stdin7⤵PID:1632
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe commit -F -6⤵PID:4476
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe commit -F -7⤵PID:5228
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit maintenance run --auto --no-quiet8⤵PID:3336
-
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe remote -v6⤵PID:5676
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe remote -v7⤵PID:216
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe --no-optional-locks status --untracked-files=all --branch --porcelain=2 -z6⤵PID:4036
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe --no-optional-locks status --untracked-files=all --branch --porcelain=2 -z7⤵PID:1012
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe log 01f23afce94fbd1a13892742c65082a97c895c80 --date=raw --max-count=1 -z "--format=%H%x00%h%x00%s%x00%b%x00%an <%ae> %ad%x00%cn <%ce> %cd%x00%P%x00%(trailers:unfold,only)%x00%D" --no-show-signature --no-color --6⤵PID:5908
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe log 01f23afce94fbd1a13892742c65082a97c895c80 --date=raw --max-count=1 -z "--format=%H%x00%h%x00%s%x00%b%x00%an <%ae> %ad%x00%cn <%ce> %cd%x00%P%x00%(trailers:unfold,only)%x00%D" --no-show-signature --no-color --7⤵PID:5656
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe remote -v6⤵PID:4180
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵PID:3556
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe remote -v7⤵PID:1972
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe for-each-ref --format=%00%(refname)%00%(refname:short)%00%(upstream:short)%00%(objectname)%00%(author)%00%(symref)%00 refs/heads refs/remotes6⤵PID:4944
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe for-each-ref --format=%00%(refname)%00%(refname:short)%00%(upstream:short)%00%(objectname)%00%(author)%00%(symref)%00 refs/heads refs/remotes7⤵PID:3692
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe log -g --no-abbrev-commit --pretty=oneline HEAD -n 2500 --6⤵PID:3420
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵PID:740
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe log -g --no-abbrev-commit --pretty=oneline HEAD -n 2500 --7⤵PID:5920
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z --global init.defaultBranch6⤵PID:4604
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z --global init.defaultBranch7⤵PID:5812
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z pull.rebase6⤵PID:2704
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z pull.rebase7⤵PID:3860
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe log HEAD --date=raw --max-count=100 -z "--format=%H%x00%h%x00%s%x00%b%x00%an <%ae> %ad%x00%cn <%ce> %cd%x00%P%x00%(trailers:unfold,only)%x00%D" --no-show-signature --no-color --not --remotes --6⤵PID:6080
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵PID:6076
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe log HEAD --date=raw --max-count=100 -z "--format=%H%x00%h%x00%s%x00%b%x00%an <%ae> %ad%x00%cn <%ce> %cd%x00%P%x00%(trailers:unfold,only)%x00%D" --no-show-signature --no-color --not --remotes --7⤵PID:4348
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe log -g -z --format=%gD%x00%H%x00%gs%x00%T%x00%P refs/stash6⤵PID:5504
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe log -g -z --format=%gD%x00%H%x00%gs%x00%T%x00%P refs/stash7⤵PID:452
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe var GIT_AUTHOR_IDENT6⤵PID:5864
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵PID:3852
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe var GIT_AUTHOR_IDENT7⤵PID:3476
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe show-ref --tags -d6⤵PID:4172
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe show-ref --tags -d7⤵PID:4908
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe log HEAD --date=raw --max-count=100 --skip=0 -z "--format=%H%x00%h%x00%s%x00%b%x00%an <%ae> %ad%x00%cn <%ce> %cd%x00%P%x00%(trailers:unfold,only)%x00%D" --no-show-signature --no-color --6⤵PID:3948
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe log HEAD --date=raw --max-count=100 --skip=0 -z "--format=%H%x00%h%x00%s%x00%b%x00%an <%ae> %ad%x00%cn <%ce> %cd%x00%P%x00%(trailers:unfold,only)%x00%D" --no-show-signature --no-color --7⤵PID:3808
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe log 01f23afce94fbd1a13892742c65082a97c895c80 -C -M -m -1 --no-show-signature --first-parent --raw --format=format: --numstat -z --6⤵PID:1772
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe log 01f23afce94fbd1a13892742c65082a97c895c80 -C -M -m -1 --no-show-signature --first-parent --raw --format=format: --numstat -z --7⤵PID:3280
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe log 01f23afce94fbd1a13892742c65082a97c895c80 -m -1 --first-parent --patch-with-raw -z --no-color -- .gitattributes6⤵PID:6088
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵PID:4476
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe log 01f23afce94fbd1a13892742c65082a97c895c80 -m -1 --first-parent --patch-with-raw -z --no-color -- .gitattributes7⤵PID:2980
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe --no-optional-locks status --untracked-files=all --branch --porcelain=2 -z6⤵PID:5656
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe --no-optional-locks status --untracked-files=all --branch --porcelain=2 -z7⤵PID:5272
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe remote -v6⤵PID:4700
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe remote -v7⤵PID:1980
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe for-each-ref --format=%00%(refname)%00%(refname:short)%00%(upstream:short)%00%(objectname)%00%(author)%00%(symref)%00 refs/heads refs/remotes6⤵PID:5296
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe for-each-ref --format=%00%(refname)%00%(refname:short)%00%(upstream:short)%00%(objectname)%00%(author)%00%(symref)%00 refs/heads refs/remotes7⤵PID:4108
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe log -g --no-abbrev-commit --pretty=oneline HEAD -n 2500 --6⤵PID:4804
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe log -g --no-abbrev-commit --pretty=oneline HEAD -n 2500 --7⤵PID:5636
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z --global init.defaultBranch6⤵PID:4044
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z --global init.defaultBranch7⤵PID:1620
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z pull.rebase6⤵PID:3592
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z pull.rebase7⤵PID:5608
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe log HEAD --date=raw --max-count=100 -z "--format=%H%x00%h%x00%s%x00%b%x00%an <%ae> %ad%x00%cn <%ce> %cd%x00%P%x00%(trailers:unfold,only)%x00%D" --no-show-signature --no-color --not --remotes --6⤵PID:3120
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe log HEAD --date=raw --max-count=100 -z "--format=%H%x00%h%x00%s%x00%b%x00%an <%ae> %ad%x00%cn <%ce> %cd%x00%P%x00%(trailers:unfold,only)%x00%D" --no-show-signature --no-color --not --remotes --7⤵PID:924
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe log -g -z --format=%gD%x00%H%x00%gs%x00%T%x00%P refs/stash6⤵PID:6068
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe log -g -z --format=%gD%x00%H%x00%gs%x00%T%x00%P refs/stash7⤵PID:5964
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe var GIT_AUTHOR_IDENT6⤵PID:4784
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe var GIT_AUTHOR_IDENT7⤵PID:2072
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe show-ref --tags -d6⤵PID:6076
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe show-ref --tags -d7⤵PID:2584
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe --no-optional-locks status --untracked-files=all --branch --porcelain=2 -z6⤵PID:3588
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe --no-optional-locks status --untracked-files=all --branch --porcelain=2 -z7⤵PID:6032
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe rev-parse --is-bare-repository --show-cdup6⤵PID:2284
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe rev-parse --is-bare-repository --show-cdup7⤵PID:5620
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe remote -v6⤵PID:6108
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe remote -v7⤵PID:4988
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe for-each-ref --format=%00%(refname)%00%(refname:short)%00%(upstream:short)%00%(objectname)%00%(author)%00%(symref)%00 refs/heads refs/remotes6⤵PID:5924
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe for-each-ref --format=%00%(refname)%00%(refname:short)%00%(upstream:short)%00%(objectname)%00%(author)%00%(symref)%00 refs/heads refs/remotes7⤵PID:1912
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe log -g --no-abbrev-commit --pretty=oneline HEAD -n 2500 --6⤵PID:2588
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe log -g --no-abbrev-commit --pretty=oneline HEAD -n 2500 --7⤵PID:3268
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z --global init.defaultBranch6⤵PID:4732
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z --global init.defaultBranch7⤵PID:3908
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z pull.rebase6⤵PID:3444
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z pull.rebase7⤵PID:5164
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe log HEAD --date=raw --max-count=100 -z "--format=%H%x00%h%x00%s%x00%b%x00%an <%ae> %ad%x00%cn <%ce> %cd%x00%P%x00%(trailers:unfold,only)%x00%D" --no-show-signature --no-color --not --remotes --6⤵PID:4064
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe log HEAD --date=raw --max-count=100 -z "--format=%H%x00%h%x00%s%x00%b%x00%an <%ae> %ad%x00%cn <%ce> %cd%x00%P%x00%(trailers:unfold,only)%x00%D" --no-show-signature --no-color --not --remotes --7⤵PID:4508
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe log -g -z --format=%gD%x00%H%x00%gs%x00%T%x00%P refs/stash6⤵PID:2372
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe log -g -z --format=%gD%x00%H%x00%gs%x00%T%x00%P refs/stash7⤵PID:2200
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe var GIT_AUTHOR_IDENT6⤵PID:3420
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe var GIT_AUTHOR_IDENT7⤵PID:2808
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe show-ref --tags -d6⤵PID:5084
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe show-ref --tags -d7⤵PID:2824
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe rev-parse --is-bare-repository --show-cdup6⤵PID:2492
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe rev-parse --is-bare-repository --show-cdup7⤵PID:5556
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe remote -v6⤵PID:5428
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe remote -v7⤵PID:1352
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe --no-optional-locks status --untracked-files=all --branch --porcelain=2 -z6⤵PID:4856
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe --no-optional-locks status --untracked-files=all --branch --porcelain=2 -z7⤵PID:1716
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe remote -v6⤵PID:1840
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe remote -v7⤵PID:6140
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe for-each-ref --format=%00%(refname)%00%(refname:short)%00%(upstream:short)%00%(objectname)%00%(author)%00%(symref)%00 refs/heads refs/remotes6⤵PID:4652
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe for-each-ref --format=%00%(refname)%00%(refname:short)%00%(upstream:short)%00%(objectname)%00%(author)%00%(symref)%00 refs/heads refs/remotes7⤵PID:780
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe log -g --no-abbrev-commit --pretty=oneline HEAD -n 2500 --6⤵PID:3996
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe log -g --no-abbrev-commit --pretty=oneline HEAD -n 2500 --7⤵PID:3216
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z --global init.defaultBranch6⤵PID:456
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z --global init.defaultBranch7⤵PID:2040
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z pull.rebase6⤵PID:4512
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z pull.rebase7⤵PID:2416
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe log HEAD --date=raw --max-count=100 -z "--format=%H%x00%h%x00%s%x00%b%x00%an <%ae> %ad%x00%cn <%ce> %cd%x00%P%x00%(trailers:unfold,only)%x00%D" --no-show-signature --no-color --not --remotes --6⤵PID:5132
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe log HEAD --date=raw --max-count=100 -z "--format=%H%x00%h%x00%s%x00%b%x00%an <%ae> %ad%x00%cn <%ce> %cd%x00%P%x00%(trailers:unfold,only)%x00%D" --no-show-signature --no-color --not --remotes --7⤵PID:2016
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe log -g -z --format=%gD%x00%H%x00%gs%x00%T%x00%P refs/stash6⤵PID:3924
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe log -g -z --format=%gD%x00%H%x00%gs%x00%T%x00%P refs/stash7⤵PID:2508
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe var GIT_AUTHOR_IDENT6⤵PID:1956
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe var GIT_AUTHOR_IDENT7⤵PID:3644
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe show-ref --tags -d6⤵PID:3908
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe show-ref --tags -d7⤵PID:5920
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe --no-optional-locks status --untracked-files=all --branch --porcelain=2 -z6⤵PID:5620
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe --no-optional-locks status --untracked-files=all --branch --porcelain=2 -z7⤵PID:456
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe remote -v6⤵PID:1384
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe remote -v7⤵PID:4036
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe for-each-ref --format=%00%(refname)%00%(refname:short)%00%(upstream:short)%00%(objectname)%00%(author)%00%(symref)%00 refs/heads refs/remotes6⤵PID:3412
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe for-each-ref --format=%00%(refname)%00%(refname:short)%00%(upstream:short)%00%(objectname)%00%(author)%00%(symref)%00 refs/heads refs/remotes7⤵PID:5656
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe log -g --no-abbrev-commit --pretty=oneline HEAD -n 2500 --6⤵PID:2508
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe log -g --no-abbrev-commit --pretty=oneline HEAD -n 2500 --7⤵PID:836
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z --global init.defaultBranch6⤵PID:5924
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z --global init.defaultBranch7⤵PID:4624
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe config -z pull.rebase6⤵PID:5920
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe config -z pull.rebase7⤵PID:3436
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe log HEAD --date=raw --max-count=100 -z "--format=%H%x00%h%x00%s%x00%b%x00%an <%ae> %ad%x00%cn <%ce> %cd%x00%P%x00%(trailers:unfold,only)%x00%D" --no-show-signature --no-color --not --remotes --6⤵PID:2196
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe log HEAD --date=raw --max-count=100 -z "--format=%H%x00%h%x00%s%x00%b%x00%an <%ae> %ad%x00%cn <%ce> %cd%x00%P%x00%(trailers:unfold,only)%x00%D" --no-show-signature --no-color --not --remotes --7⤵PID:3920
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe log -g -z --format=%gD%x00%H%x00%gs%x00%T%x00%P refs/stash6⤵PID:4636
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe log -g -z --format=%gD%x00%H%x00%gs%x00%T%x00%P refs/stash7⤵PID:668
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe var GIT_AUTHOR_IDENT6⤵PID:5476
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe var GIT_AUTHOR_IDENT7⤵PID:1532
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exeC:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe show-ref --tags -d6⤵PID:5060
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exegit.exe show-ref --tags -d7⤵PID:2824
-
-
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\Update.exeC:\Users\Admin\AppData\Local\GitHubDesktop\Update.exe --checkForUpdate https://central.github.com/api/deployments/desktop/desktop/latest?version=3.4.3&env=production&guid=3764fd6c-8938-44af-a648-fc9953366d2e5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:836
-
-
C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe"C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\GitHub Desktop" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2584,i,15512622964302013275,9973907934409060862,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:85⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2272
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:12⤵PID:6056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7476 /prefetch:12⤵PID:3984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:12⤵PID:5972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7076 /prefetch:12⤵PID:5072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:12⤵PID:2996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:12⤵PID:5440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7160 /prefetch:82⤵PID:116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7844 /prefetch:12⤵PID:2092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7604 /prefetch:12⤵PID:4276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7080 /prefetch:12⤵PID:1912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7640 /prefetch:12⤵PID:3768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:12⤵PID:5832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6912 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7896 /prefetch:12⤵PID:5560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8932 /prefetch:12⤵PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9204 /prefetch:12⤵PID:3444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3076 /prefetch:82⤵PID:392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7976 /prefetch:12⤵PID:1144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7408 /prefetch:12⤵PID:5664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9132 /prefetch:12⤵PID:4904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8712 /prefetch:12⤵PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7128 /prefetch:12⤵PID:5856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7988 /prefetch:82⤵PID:3884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:82⤵PID:2460
-
-
C:\Users\Admin\Downloads\MrsMajor3.0.exe"C:\Users\Admin\Downloads\MrsMajor3.0.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:4864 -
C:\Windows\system32\wscript.exe"C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\C230.tmp\C231.tmp\C232.vbs //Nologo3⤵
- UAC bypass
- Checks computer location settings
- System policy modification
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\C230.tmp\eulascr.exe"C:\Users\Admin\AppData\Local\Temp\C230.tmp\eulascr.exe"4⤵PID:4724
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8648 /prefetch:12⤵PID:5920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8560 /prefetch:82⤵PID:5924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8320 /prefetch:12⤵PID:3908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7640 /prefetch:82⤵PID:5204
-
-
C:\Users\Admin\Downloads\PCToaster.exe"C:\Users\Admin\Downloads\PCToaster.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1476 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\PCToaster.exe"3⤵
- Suspicious use of SetWindowsHookEx
PID:5908 -
C:\Windows\SYSTEM32\attrib.exeattrib +h C:\Users\Admin\Downloads\scr.txt4⤵
- Views/modifies file attributes
PID:2528
-
-
C:\Windows\SYSTEM32\diskpart.exediskpart /s C:\Users\Admin\Downloads\scr.txt4⤵PID:5572
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f V:\Boot /r4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Enumerates connected drives
PID:940
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f V:\Recovery /r4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4392
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /im lsass.exe /f4⤵
- Kills process with taskkill
PID:6316
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol A: /d4⤵
- Enumerates connected drives
PID:1168
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol B: /d4⤵PID:768
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol D: /d4⤵PID:6320
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol E: /d4⤵
- Enumerates connected drives
PID:3736
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol F: /d4⤵PID:6496
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol G: /d4⤵
- Enumerates connected drives
PID:2104
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol H: /d4⤵
- Enumerates connected drives
PID:6636
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol I: /d4⤵
- Enumerates connected drives
PID:6668
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol J: /d4⤵PID:6980
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol K: /d4⤵PID:7040
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol L: /d4⤵
- Enumerates connected drives
PID:6288
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol M: /d4⤵PID:6308
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol N: /d4⤵
- Enumerates connected drives
PID:6444
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol O: /d4⤵
- Enumerates connected drives
PID:6436
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol P: /d4⤵PID:4516
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol Q: /d4⤵
- Enumerates connected drives
PID:6612
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol R: /d4⤵
- Enumerates connected drives
PID:6820
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol S: /d4⤵
- Enumerates connected drives
PID:4628
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol T: /d4⤵PID:6376
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol U: /d4⤵
- Enumerates connected drives
PID:668
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol V: /d4⤵PID:6620
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol W: /d4⤵
- Enumerates connected drives
PID:4800
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol X: /d4⤵
- Enumerates connected drives
PID:2852
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol Y: /d4⤵
- Enumerates connected drives
PID:6656
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol Z: /d4⤵
- Enumerates connected drives
PID:2124
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol C: /d4⤵PID:6780
-
-
-
-
C:\Users\Admin\Downloads\PCToaster.exe"C:\Users\Admin\Downloads\PCToaster.exe"2⤵PID:6032
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\PCToaster.exe"3⤵
- Suspicious use of SetWindowsHookEx
PID:4864 -
C:\Windows\SYSTEM32\attrib.exeattrib +h C:\Users\Admin\Downloads\scr.txt4⤵
- Views/modifies file attributes
PID:4160
-
-
C:\Windows\SYSTEM32\diskpart.exediskpart /s C:\Users\Admin\Downloads\scr.txt4⤵PID:5316
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f V:\Boot /r4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1336
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f V:\Recovery /r4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Enumerates connected drives
PID:3764
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /im lsass.exe /f4⤵
- Kills process with taskkill
PID:6224
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol A: /d4⤵PID:2272
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol B: /d4⤵PID:688
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol D: /d4⤵
- Enumerates connected drives
PID:4144
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol E: /d4⤵
- Enumerates connected drives
PID:1744
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol F: /d4⤵PID:5328
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol G: /d4⤵
- Enumerates connected drives
PID:6584
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol H: /d4⤵
- Enumerates connected drives
PID:5228
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol I: /d4⤵PID:6924
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol J: /d4⤵
- Enumerates connected drives
PID:4528
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol K: /d4⤵
- Enumerates connected drives
PID:4468
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol L: /d4⤵
- Enumerates connected drives
PID:708
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol M: /d4⤵
- Enumerates connected drives
PID:4896
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol N: /d4⤵
- Enumerates connected drives
PID:5608
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol O: /d4⤵PID:6256
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol P: /d4⤵PID:6616
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol Q: /d4⤵PID:6648
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol R: /d4⤵PID:6856
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol S: /d4⤵
- Enumerates connected drives
PID:5312
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol T: /d4⤵
- Enumerates connected drives
PID:6292
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol U: /d4⤵
- Enumerates connected drives
PID:6588
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol V: /d4⤵PID:6812
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol W: /d4⤵
- Enumerates connected drives
PID:4856
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol X: /d4⤵PID:6824
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol Y: /d4⤵
- Enumerates connected drives
PID:6164
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol Z: /d4⤵
- Enumerates connected drives
PID:4704
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol C: /d4⤵PID:6284
-
-
-
-
C:\Users\Admin\Downloads\PCToaster.exe"C:\Users\Admin\Downloads\PCToaster.exe"2⤵PID:1692
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\PCToaster.exe"3⤵
- Suspicious use of SetWindowsHookEx
PID:5332 -
C:\Windows\SYSTEM32\taskkill.exetaskkill /im lsass.exe /f4⤵
- Kills process with taskkill
PID:3336
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol A: /d4⤵PID:6932
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol B: /d4⤵
- Enumerates connected drives
PID:6204
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol D: /d4⤵
- Enumerates connected drives
PID:3952
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol E: /d4⤵
- Enumerates connected drives
PID:3028
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol F: /d4⤵
- Enumerates connected drives
PID:5132
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol G: /d4⤵PID:5104
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol H: /d4⤵
- Enumerates connected drives
PID:3668
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol I: /d4⤵
- Enumerates connected drives
PID:164
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol J: /d4⤵
- Enumerates connected drives
PID:5852
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol K: /d4⤵
- Enumerates connected drives
PID:4044
-
-
-
-
C:\Users\Admin\Downloads\PCToaster.exe"C:\Users\Admin\Downloads\PCToaster.exe"2⤵PID:2104
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\PCToaster.exe"3⤵
- Suspicious use of SetWindowsHookEx
PID:4196 -
C:\Windows\SYSTEM32\taskkill.exetaskkill /im lsass.exe /f4⤵
- Kills process with taskkill
PID:5052
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol A: /d4⤵
- Enumerates connected drives
PID:6384
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol B: /d4⤵
- Enumerates connected drives
PID:4088
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol D: /d4⤵
- Enumerates connected drives
PID:6372
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol E: /d4⤵
- Enumerates connected drives
PID:6252
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol F: /d4⤵PID:7012
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol G: /d4⤵PID:6244
-
-
C:\Windows\SYSTEM32\mountvol.exemountvol H: /d4⤵PID:6280
-
-
-
-
C:\Users\Admin\Downloads\PCToaster.exe"C:\Users\Admin\Downloads\PCToaster.exe"2⤵PID:2456
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\PCToaster.exe"3⤵
- Suspicious use of SetWindowsHookEx
PID:468 -
C:\Windows\SYSTEM32\taskkill.exetaskkill /im lsass.exe /f4⤵
- Kills process with taskkill
PID:1140
-
-
-
-
C:\Users\Admin\Downloads\PCToaster.exe"C:\Users\Admin\Downloads\PCToaster.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4944 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\PCToaster.exe"3⤵
- Suspicious use of SetWindowsHookEx
PID:3884 -
C:\Windows\SYSTEM32\taskkill.exetaskkill /im lsass.exe /f4⤵
- Kills process with taskkill
PID:6524
-
-
-
-
C:\Users\Admin\Downloads\MrsMajor3.0.exe"C:\Users\Admin\Downloads\MrsMajor3.0.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:5996 -
C:\Windows\system32\wscript.exe"C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\FD50.tmp\FD51.tmp\FD52.vbs //Nologo3⤵
- UAC bypass
- Checks computer location settings
- System policy modification
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\FD50.tmp\eulascr.exe"C:\Users\Admin\AppData\Local\Temp\FD50.tmp\eulascr.exe"4⤵PID:6196
-
-
-
-
C:\Users\Admin\Downloads\PCToaster.exe"C:\Users\Admin\Downloads\PCToaster.exe"2⤵
- System Location Discovery: System Language Discovery
PID:6668 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\PCToaster.exe"3⤵PID:6684
-
-
-
C:\Users\Admin\Downloads\PCToaster.exe"C:\Users\Admin\Downloads\PCToaster.exe"2⤵
- System Location Discovery: System Language Discovery
PID:6816 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\PCToaster.exe"3⤵PID:6828
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16372847418001909191,6744317689532263237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8276 /prefetch:12⤵PID:7060
-
-
C:\Users\Admin\Downloads\PCToaster.exe"C:\Users\Admin\Downloads\PCToaster.exe"2⤵
- System Location Discovery: System Language Discovery
PID:6164 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\PCToaster.exe"3⤵PID:6148
-
-
-
C:\Users\Admin\Downloads\PCToaster.exe"C:\Users\Admin\Downloads\PCToaster.exe"2⤵PID:6584
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\PCToaster.exe"3⤵PID:6576
-
-
-
C:\Users\Admin\Downloads\PCToaster.exe"C:\Users\Admin\Downloads\PCToaster.exe"2⤵
- System Location Discovery: System Language Discovery
PID:6668 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\PCToaster.exe"3⤵PID:6756
-
-
-
C:\Users\Admin\Downloads\MrsMajor3.0.exe"C:\Users\Admin\Downloads\MrsMajor3.0.exe"2⤵
- Checks computer location settings
PID:6932 -
C:\Windows\system32\wscript.exe"C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\AAC6.tmp\AAC7.tmp\AAC8.vbs //Nologo3⤵
- UAC bypass
- Checks computer location settings
- System policy modification
PID:7048 -
C:\Users\Admin\AppData\Local\Temp\AAC6.tmp\eulascr.exe"C:\Users\Admin\AppData\Local\Temp\AAC6.tmp\eulascr.exe"4⤵PID:5968
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1428
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3628
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4a0 0x4f41⤵PID:2964
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1796
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\WannaCry.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\WannaCry.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 14231724142778.bat2⤵PID:4624
-
C:\Windows\SysWOW64\cscript.execscript //nologo c.vbs3⤵
- System Location Discovery: System Language Discovery
PID:3908
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe!WannaDecryptor!.exe f2⤵
- Suspicious use of SetWindowsHookEx
PID:5524
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im MSExchange*2⤵
- Kills process with taskkill
PID:6072
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Microsoft.Exchange.*2⤵
- Kills process with taskkill
PID:1156
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlserver.exe2⤵
- Kills process with taskkill
PID:5824
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlwriter.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:5700
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe!WannaDecryptor!.exe c2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3884
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b !WannaDecryptor!.exe v2⤵PID:3360
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe!WannaDecryptor!.exe v3⤵
- Suspicious use of SetWindowsHookEx
PID:4272 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵PID:1972
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵PID:2488
-
-
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe!WannaDecryptor!.exe2⤵
- Sets desktop wallpaper using registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5864 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.btcfrog.com/qr/bitcoinPNG.php?address=15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V13⤵PID:2676
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd70fd46f8,0x7ffd70fd4708,0x7ffd70fd47184⤵PID:740
-
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe!WannaDecryptor!.exe2⤵
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:372
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe!WannaDecryptor!.exe2⤵
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:3128
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:5628
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\WannaCrypt0r.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\WannaCrypt0r.exe"1⤵
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
PID:2488 -
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3948
-
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5552
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- System Location Discovery: System Language Discovery
PID:4612
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵PID:2592
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "cmkaqiluwluphj236" /t REG_SZ /d "\"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\tasksche.exe\"" /f2⤵
- System Location Discovery: System Language Discovery
PID:5184 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "cmkaqiluwluphj236" /t REG_SZ /d "\"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\tasksche.exe\"" /f3⤵
- Adds Run key to start application
- Modifies registry key
PID:5852
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 7511724142888.bat2⤵PID:4924
-
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵PID:5276
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- Views/modifies file attributes
PID:5940
-
-
C:\Windows\SysWOW64\cmd.exePID:416
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]PID:4420
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵PID:640
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵PID:1476
-
-
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵PID:3948
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
PID:1624
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Sets desktop wallpaper using registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2992 -
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=how+to+buy+bitcoin3⤵PID:1496
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd70fd46f8,0x7ffd70fd4708,0x7ffd70fd47184⤵PID:2768
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=how+to+buy+bitcoin3⤵PID:5936
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd70fd46f8,0x7ffd70fd4708,0x7ffd70fd47184⤵PID:5940
-
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵PID:4620
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵PID:5436
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5648
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /f /im Microsoft.Exchange.*2⤵
- Kills process with taskkill
PID:4060
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /f /im MSExchange*2⤵
- Kills process with taskkill
PID:828
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /f /im sqlserver.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:4008
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /f /im sqlwriter.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:3800
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /f /im mysqld.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:1336
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- Views/modifies file attributes
PID:5948
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵PID:5668
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵PID:2872
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]PID:5116
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
PID:1244
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]PID:5568
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵PID:3648
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- Views/modifies file attributes
PID:876
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
PID:6064
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:576
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵PID:1804
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
PID:5720
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]PID:4272
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- System Location Discovery: System Language Discovery
PID:2744
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:5264
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵PID:1336
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5024
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- System Location Discovery: System Language Discovery
PID:2196
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵PID:5776
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5924
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- System Location Discovery: System Language Discovery
PID:876
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- Views/modifies file attributes
PID:5612
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵PID:1208
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]PID:5948
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵PID:5628
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵PID:1644
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5308
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵PID:1476
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- Views/modifies file attributes
PID:2280
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵PID:5952
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]PID:3088
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- System Location Discovery: System Language Discovery
PID:1152
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
PID:468
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]PID:1540
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- System Location Discovery: System Language Discovery
PID:4852
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- Views/modifies file attributes
PID:5732
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵PID:644
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2540
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- System Location Discovery: System Language Discovery
PID:4776
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
PID:1336
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]PID:3648
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- System Location Discovery: System Language Discovery
PID:2300
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:5532
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
PID:3996
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]PID:5700
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵PID:3928
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
PID:4448
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]PID:5600
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- System Location Discovery: System Language Discovery
PID:2336
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- Views/modifies file attributes
PID:2296
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
PID:4608
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]PID:4712
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- System Location Discovery: System Language Discovery
PID:876
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵PID:3168
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]PID:1660
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵PID:5568
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- Views/modifies file attributes
PID:836
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵PID:4468
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1624
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵PID:2828
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
PID:4440
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6040
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵PID:5056
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- Views/modifies file attributes
PID:460
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵PID:3908
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3036
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- System Location Discovery: System Language Discovery
PID:6024
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
PID:1168
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]PID:5312
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- System Location Discovery: System Language Discovery
PID:5812
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1952
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
PID:1440
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]PID:416
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- System Location Discovery: System Language Discovery
PID:1644
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵PID:1160
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]PID:416
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵PID:5064
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- Views/modifies file attributes
PID:5680
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵PID:1804
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]PID:4008
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵PID:3316
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
PID:5148
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2380
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- System Location Discovery: System Language Discovery
PID:5996
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3028
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s V:\$RECYCLE2⤵
- Views/modifies file attributes
PID:5204
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s V:\$RECYCLE2⤵
- Views/modifies file attributes
PID:4124
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
PID:3796
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:684
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵PID:5196
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵PID:6572
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]PID:6580
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- System Location Discovery: System Language Discovery
PID:6624
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s V:\$RECYCLE2⤵
- Views/modifies file attributes
PID:6692
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3328
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\11acb2b8aa244ffdb18fb87fbd3a04f8 /t 5304 /p 58641⤵PID:928
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\e4d0a357ca344480a8498f59dbd6352a /t 1644 /p 3721⤵PID:2088
-
C:\Users\Public\Desktop\@[email protected]"C:\Users\Public\Desktop\@[email protected]"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5620
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:5196
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ChilledWindows.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ChilledWindows.exe"1⤵
- Enumerates connected drives
PID:640
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4a0 0x4f41⤵PID:6088
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\BlueScreen.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\BlueScreen.exe"1⤵PID:3228
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\BlueScreen.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\BlueScreen.exe"1⤵PID:5260
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5660
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\FreeYoutubeDownloader.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\FreeYoutubeDownloader.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:352 -
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"2⤵
- Checks computer location settings
PID:828 -
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"3⤵PID:744
-
-
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"3⤵PID:928
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\FreeYoutubeDownloader.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\FreeYoutubeDownloader.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1980
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Whiter.a.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Whiter.a.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:4224 -
C:\Windows\SysWOW64\notepad.exenotepad.exe C:\Users\Admin\AppData\Local\Temp\~sn8242.tmp2⤵
- System Location Discovery: System Language Discovery
PID:2816
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\DesktopPuzzle.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\DesktopPuzzle.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3608
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:5816
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:352
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1File Deletion
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Diagnosis\@[email protected]
Filesize978B
MD5e7db18b2981ab13513652b988e880907
SHA117a2b6fc59607d2920479e9113841e2f16a2a730
SHA25676c8110f46fbe1aaecff115e6f0705bb3e48794472dc9ee9a9fef949bfb985df
SHA5121b44b0866b000e1ecccf729988ea57bec52d86f249f872c4b23bc015bb26b2b879f28097e07204fd5937f5fe10d2f0aaf937dbe614c834071224629298aca36f
-
Filesize
983B
MD5a5fa8e2fe8e369fd0f6cc973ea1532f2
SHA10bf0097488d01569bce3607bc75ff1c86d07b2d4
SHA25685bcedd17911ff4edb1e67249bb2b7cee79f640c8f9148323f6f63e1df4a043c
SHA5122e61836a5f256f4d93b7cd4a69872e6ce45592e99f4a70faf95cd5303f8d60932f565c67651c01344cb3dfe5a4061fcbc23a309b954cb1b0fc069a83026aed3e
-
Filesize
2.6MB
MD51a95b9e8ccd6a96074526fedecfa4b03
SHA17a9653ac38b8f62e4fa03853bc8cb2bfe1aea9be
SHA256b46d1f013db32c17625bb21e4ac3b39306aef6ba681a13b88127ba376d9d73b6
SHA512c10cd7ef0d2ff01863542252f863d0991dc0a79da6c15331bdb3e5cf08abaf12441bd18e50958bea13a96622f71a0a803a2d0b7c45373044c928b9a4bdc0d834
-
Filesize
10.2MB
MD574bded81ce10a426df54da39cfa132ff
SHA1eb26bcc7d24be42bd8cfbded53bd62d605989bbf
SHA2567bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
SHA512bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a
-
Filesize
248KB
MD535a6a60a1880f3948050db8454bbd8e1
SHA18f21641cd973c7e64347a406638c6427d0a8a766
SHA25655824485ca11a66be274012a2a0c2d65705710872bb65b52c1b3e5692206712f
SHA5125f1aacbf27662e690c0dc82ce547410da6d136ea2c6831907c2328cfef71e2bb6b5783cf94f0728dcf2807de8ef3c17e3c12200594cb6d72f450e11e9116cf09
-
Filesize
446B
MD59ea6afc90d486c855b849eab6d02e12e
SHA15e081e3531d72b317e4e383d88d55a03c98b8aaf
SHA2569f3412fe395b97a467829e77d575c9b87a5db208650b702235a6fcce78820dfc
SHA51204dda3bcc5444b942ee8826f40d1b81f853fa9d578f17414a47ce880aef7378f48e7e354d366ecf505a47a1de27a44b1dd2817962397d7d7c64929ffba9675b9
-
Filesize
695KB
MD56aa9188b2ef0d9537f5f29323b7ab6e4
SHA1924e3894b9a5a8898a6245aad4f99466f7c8f5a7
SHA2562a86dd7cde320eb4adb2dd6289fa771c389690487ee4322079518f3795dc6fc9
SHA51258fa979f77d7cbafdeb4d3a96c62384d93a8cbf2ab5a3da0513ecb35849724c64f0b680fd56350751abec4128fba17068827bd716f82766aa709032d8073021b
-
Filesize
2.0MB
MD5fa81136f232e93cf5f6bb5972c6dda74
SHA1c6d792a84d1b1adb5ea25aff941297ed204685cc
SHA256f28929f7af38e544d4609cf9f7963a4ec7f87c95df832a715f49adaa9783cc5c
SHA512759a3b7b5fcd19a7bd77bb036ef8e4658546e6659b611ff5ab59bf06222c2fb1050b46c38d45cb6795edfb4fc0d3fa6e3c7ebd70967540822fe73850d30f0b31
-
Filesize
641KB
MD50028b7601ef225663b8c0c57089617db
SHA140a46d864b59eefa30c2f825bf6530ffd8029be4
SHA256367d41b832f2c870c544934b08fa271786b02b8a8cbadc026f02e869c54ce13b
SHA5125a32b8e064d073b248154794a0452ec3771b5bbc6e4bab7582e30278c8863fb77d9b002588b2d05ce9cb5406739cafe04af8c9a9db7b010921d8660ce44988c3
-
Filesize
152B
MD5eeaa8087eba2f63f31e599f6a7b46ef4
SHA1f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA25650fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
SHA512eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
-
Filesize
152B
MD5b9569e123772ae290f9bac07e0d31748
SHA15806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA25620ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
SHA512cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\20e80476-18e2-4e48-9318-d983104a2c31.tmp
Filesize7KB
MD529a015d662110bf29d7b5955a6df68c6
SHA120783329bff17f1db3c36a8907d1381266454127
SHA256c8d1c37731781f33763053c6549ee36ca88379ac6cd824e3e1eddfb753dc915d
SHA512f7221c9498703f274fba25e16ff38aa5126b3055d9a45f2e654849936fe5a9ce3be56873d17d3c8d7ab931cbb2c3867146c2918420e5009f8072553d7e1c024d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\30545e85-7714-40f9-bc91-5cfd53ff3335.tmp
Filesize10KB
MD5125ca1c47916660585206e50abc3a444
SHA10421f438e356f4f64f849f98f3537f4d37987ee3
SHA256e6d13f1878da2c6ad348b44c641fb68c8598036b7ea829450f272c289560d8ce
SHA5120f8d8837ef761379a4c9624efefeb1f43e3bf9ed0a859ca382942c85d76de6574be7114610792c5daf2f825f5c1f6f490801992d16679fa3ba8969981ae6c1b0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5d42fa37-75a4-4ec8-9ea0-97a1af449401.tmp
Filesize9KB
MD5afff20357a4072ce5ebb3e85416cea21
SHA157bad688aaf7501377a9ae0d03b8d3e228f0ef4c
SHA256bd660fe97fed6547760947370958a89471d20605f97575f8db7f5c807300af3d
SHA5128e9a6b7cd9c3f13660ca9245a6d03860c22afe1886ea40227643480e244102e1d9bc2c715a9f534affb377b4465ef0503ec62e477ffc78c931cc7ff97bd60a49
-
Filesize
62KB
MD5c3c0eb5e044497577bec91b5970f6d30
SHA1d833f81cf21f68d43ba64a6c28892945adc317a6
SHA256eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb
SHA51283d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38
-
Filesize
70KB
MD50f6e110e02a790b2f0635d0815c12e5c
SHA12411810c083a7fda31c5e6dd6f1f9cf1b971e46c
SHA2562f7018f3c214ace280e4bd37aabe0690bd9d8d0532f38e32a29d1f9de1320605
SHA5122f2fb7c4ddfb6abb5dcde466269f625eea58a2c69d25830e6bb24126e7679ec7c83fdb0d8ff2a7de4dd4b994513f5e80813dbf1f5d6a9a474c3a60d8bee74f4f
-
Filesize
43KB
MD5e352d970a4f70796e375f56686933101
SHA120638161142277687374c446440c3239840362b4
SHA2568a346ccc26d3ae6ded2665b27b443d6f17580650d3fdd44ef1bb6305bee37d52
SHA512b2c95bc6a7bd4cc5ef1d7ea17d839219a1aa5eba6baeb5eab6a57ec0a7adbc341eb7c4d328bcc03476d73fd4d70f3a4bdec471a22f9eb3e42eb2cae94eeb1ccc
-
Filesize
65KB
MD556d57bc655526551f217536f19195495
SHA128b430886d1220855a805d78dc5d6414aeee6995
SHA256f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
SHA5127814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
-
Filesize
19KB
MD52e86a72f4e82614cd4842950d2e0a716
SHA1d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA256c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
SHA5127a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
-
Filesize
84KB
MD574e33b4b54f4d1f3da06ab47c5936a13
SHA16e5976d593b6ee3dca3c4dbbb90071b76e1cd85c
SHA256535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287
SHA51279218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2
-
Filesize
1.2MB
MD5ae79a3e945e45f571fdf9ab94bcab4ee
SHA1eac343e9f3660f78ea5e2f1bd634c8123f207642
SHA256039c61c90725ad5a7422c5f00cc6d85ff2c57e3f7697b75ec57668e62fc209f7
SHA5120bfd27261eae0cc6462b71fce73461639fd1b6071797b29e047b16940ce25e79bb50032c289401fef4a10d22f0b1afd801dc9d29e0dbc085486d5fdeb88cb814
-
Filesize
43KB
MD5d9b427d32109a7367b92e57dae471874
SHA1ce04c8aeb6d89d0961f65b28a6f4a03381fc9c39
SHA2569b02f8fe6810cacb76fbbcefdb708f590e22b1014dcae2732b43896a7ac060f3
SHA512dcabc4223745b69039ea6a634b2c5922f0a603e5eeb339f42160adc41c33b74911bb5a3daa169cd01c197aeaca09c5e4a34e759b64f552d15f7a45816105fb07
-
Filesize
74KB
MD5b07f576446fc2d6b9923828d656cadff
SHA135b2a39b66c3de60e7ec273bdf5e71a7c1f4b103
SHA256d261915939a3b9c6e9b877d3a71a3783ed5504d3492ef3f64e0cb508fee59496
SHA5127358cbb9ddd472a97240bd43e9cc4f659ff0f24bf7c2b39c608f8d4832da001a95e21764160c8c66efd107c55ff1666a48ecc1ad4a0d72f995c0301325e1b1df
-
Filesize
27KB
MD5c3bd38af3c74a1efb0a240bf69a7c700
SHA17e4b80264179518c362bef5aa3d3a0eab00edccd
SHA2561151160e75f88cbc8fe3ada9125cc2822abc1386c0eab7a1d5465cfd004522c8
SHA51241a2852c8a38700cf4b38697f3a6cde3216c50b7ed23d80e16dea7f5700e074f08a52a10ba48d17111bb164c0a613732548fe65648658b52db882cacb87b9e8e
-
Filesize
40KB
MD53051c1e179d84292d3f84a1a0a112c80
SHA1c11a63236373abfe574f2935a0e7024688b71ccb
SHA256992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3
SHA512df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff
-
Filesize
53KB
MD568f0a51fa86985999964ee43de12cdd5
SHA1bbfc7666be00c560b7394fa0b82b864237a99d8c
SHA256f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f
SHA5123049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7
-
Filesize
20KB
MD588924e883819450fea6752faf211c02e
SHA1f65cd48ba61e6854b8695490e82b8ef1256c0ad7
SHA2562775bac57d4aa61e0bafe9902dda744b81a6bc392a953a125fad1da7c949fbec
SHA512c3aaeb5f7016f819015b54ac7f2cde14cb71b613b046b7097a61d7836f3cf67d38bc6eaad619561c72828d6f930de0362cacddade2f4590389e6c363755c68e3
-
Filesize
57KB
MD5c7499ca185afb8a4b149196d729b7d1a
SHA1515a63fde84030ddad31b84390f9ab655637705a
SHA256517f12733d8c3f36f4acf51221bba37f77af472a283b7e65e9c6fa6ec8615ead
SHA5124737416dae70e637999ec218c38d176ce2571cfe892b704bcb3a68cfe4c0a8a2deea50f9e1cfc2f70da05126d748df73747e19d72f983eb335ddd350068e23e4
-
Filesize
18KB
MD5c99ec4b3300805f368cf2865fc04a7d7
SHA12e88c1165df1b26309abebff1639c2e4f41ae6a2
SHA256678bb5211b5504285bf72419476bdeb2bb6a2b7d1f0e4ebfc84eb2e1f0a752a1
SHA512d2df2e697de8e394f9664d3cdd8dd84fb48617fce5eba2df02b25b308eaa5dc55bfa62e54de517dd9970567ba3562f95404b3c9ef79d9cbb012cabfdacf5aec4
-
Filesize
209KB
MD53e552d017d45f8fd93b94cfc86f842f2
SHA1dbeebe83854328e2575ff67259e3fb6704b17a47
SHA25627d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
SHA512e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
-
Filesize
24KB
MD5c594a826934b9505d591d0f7a7df80b7
SHA1c04b8637e686f71f3fc46a29a86346ba9b04ae18
SHA256e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610
SHA51204a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961
-
Filesize
2KB
MD553589df13155973b58af72e3d17c75d5
SHA1cf12880d2a3fcc2108f9216478071e07328cbe99
SHA2567f95f65712015050445f3801994256c0f1adf8b19232a8533ec60fe645c7587c
SHA512a8eb2f44d63fb17bf7735fe08cec979db73bbb5c199a6b9e3d452170613e9c93de3e238175f6428db6e8a8a0aafdf918bc4db643cd2ebdd3361a1415ec93cf9c
-
Filesize
2KB
MD56efbd6720ae900603efd722ba196a54a
SHA13ed5975f40f008320ea1ca8a6e34383a1e28134d
SHA2563926f67e0cf31415fd6305abebe96f0b2b473111ce6ccd9813aa0bfc943f5c45
SHA51293537839bb2c99e8ff5298528aa8f57ef3157c2d2f4e7f679232b3298ab7c4827e410cecd877edaa5b91dc1745ebf0f3642109996dab6150329b748fe2814773
-
Filesize
2KB
MD5ec32aa91a29ec860b44291a97f94d2ea
SHA1e86fbfdba3cb17fa189040659b4176cf527e832c
SHA256a85c9187277c7a25a440e32a082e2de844012ee26e0ed9e7b3ac544a2bbb4699
SHA51208f8d14ccd5852c4be876edd6b6469d83ae3d5e82b168ff4e362ae47af7425d3a3df1f49a8bf58721908ee4283679ee288a3b8ddd6b394b1520b041533548906
-
Filesize
1KB
MD5e9f2559644b2d5324494ed94b8935cb3
SHA1c25b7810e12e3582a17731e964f28ebf53665a29
SHA2566d7c0c7697f2e5213b4cbcae7d2eef8a381ba84bf42dd2942748075a842cf796
SHA51294cd783a88559d23b469ff0a0df48a2c9954dcad508c2fbc307f3cddfb6b16f7c8342d2ae6af87e7d44ce3ba93b69573b156abf8a93f0acce4058d61c897fa18
-
Filesize
3KB
MD51e94ee8871d7462db9cf6c45fd3fe293
SHA1fc4711de49b7b8f5651d1ca389cd94f7bfc8e97f
SHA256c340af1c124186688d56146fbac3f10471d0ea4e0670e7b22ae7d81f5ed31052
SHA512e4d262d9be4f52dfffde24e0b6cb7508a504109cadcaef14f860c08cc4196322951eb533889bfac76cf7f8d8d6c172833e779fc2a805021dd599d41816f15f8b
-
Filesize
1KB
MD50e636b4c02510055568441c00ed2873d
SHA1a57f097e81aaf1754c78b496b9fbfa65b8530338
SHA256c0e9ef5fe0259800876c28b146cdf5740e67b2ba20f58c207dca41bb0ec1caf5
SHA512c24bced8fa9a8065a3a157b246dca11fc5059c80d15040d27597d49e24092faf4675afe940a66e443d4891162069577366df298e0432d2c0ef56123dfc135f1d
-
Filesize
75KB
MD5b1f59fdbc5ef552a9bcf206d5df6a4fc
SHA13c91de296d300b58ad8e883fc9ee36315118c349
SHA2563d699f8c88330d0dd1f8923747ee890c898355b32f85ae85515ed14239234d57
SHA512607139b64830484b701462c5fc18799393e81631c648ea2e75fc63c1cc1b6f8566107c8b0ed25715c179a9420966c314c7c000ae9e884df598899ec7f85c3b86
-
Filesize
29KB
MD5085d3f42694e6b036dcfc93a01e2263b
SHA11c31661f007d7559ed024ebe029d00290fadf32b
SHA256d2013cf9f7fbdac97890537488b4f519e1815b99709d0c3bc0aa724333261f1a
SHA5128b1813cff05d74be1d5b367ad81a4a6da5dd71f017653c0e42954a6c456716bf921372b1fcde4b7144f5e5af944a48b5062781dce0a5d3b56ff4d0e0fc6e1e08
-
Filesize
2KB
MD52152b33d6493546aa0dd9df90421f517
SHA13ee6fd610483ccb97787b1b15b379f80bcd02ef3
SHA2567431ffa8ac9da9333419d2660765f7b029ff9942bccdfa5bfa12345041a6fc0a
SHA512572591ba974be7f32f047896674506b8e2c0bb41b529d8ec60673ff2534ddc785f409f602dc77e1522d9d6bcd16b90f4b2e1c4f000c610fa82c122a1a851f938
-
Filesize
1KB
MD561e8ff66c7929b3e3f700031656dc90b
SHA103eb705cb48ddea54815b2dcd7fcf742d7d27fc8
SHA256421ff8933636a24330c1d9710f1b491518f71ac9d21fad59a9c4265ac7de2e40
SHA512b8f0a3821a3873867227040c1dbb177cfd5b179a3ab5de5aaa212fb824dc09c7862fbd2ce4ff0e00216fdf9d2aba26c34e7207ecefe5ba7991d25b20b002b16d
-
Filesize
262B
MD58f061f5904abfc1d8b67dd48af6f96e9
SHA1457da2537192d95e9ebbaf1f492499967e0b0a5c
SHA256b134428e8434fe069da0accb57d83e41a0c5af14cd6eac896e86e04d1550189a
SHA512ba59fa35dc7076b99973566a0f3b04d12976c25e8f2438887bc3fad9b5f45f6b52dc01aa7640de40392b9be130f7f5b96989a7f4b4b69dacd6c86cc7c83da416
-
Filesize
1KB
MD533f36e740ed4543b817da3bb3ab9ccea
SHA1fcd9fe0bad56f77f79a2413d36a8be80042ef47a
SHA25653a07c62ccc7e692d4e3547a9d2432f11a3c5851ad88e293330a561d126ad4c6
SHA51266f131b6226a1d6a997fa1ab303e95b144dedd4f70d3fb6c057d067b5e2994384099b5cecd8cdf95f0ae46bb85462b391de353745930c19eae85a924cd48c078
-
Filesize
2KB
MD5319705dd499a5d44aabf4cf83ef58f27
SHA108e0a92bf307b0b651fa8df5c879f39e89ce2e1b
SHA2560eb24d34b7bd847d89feb8096ceaf8c9c5fc0475a6291732a46d1638d277ccc6
SHA51250292f1877ea84e55bda968e554be2ad88e07e65c3170e91ef867911ff9127d144e0866e839d55a87613bd7d32105ef9f4cf53e03861deb1119ef2c00559e2ee
-
Filesize
7KB
MD56cf78c867ce124063038eba1b21187e6
SHA13cefac7b49122aa9de9f2e4db3d37ab8ddd81743
SHA2563330a47d56da651e5f0947774e58e0cb81eb15045eaf85a2dd104f16309762d2
SHA5121be64262216dfe6cda24d8d1e4b156ad1e03e266c2d13710743d4e52cfae32bebbfc2d199abaa1ef69e2a9dc1c061ced0e73663f7a6034023aaf16fd805f10b6
-
Filesize
5KB
MD53b2c4256e19447575d42f001331ea5ca
SHA12b59890476132d6b20935a7cc25d2e1291769faa
SHA256e4c79af60ddf530080ba25e47dd41a12c3afcd81d22fe2c4240189229b275fa2
SHA5129ae342fdf5802ecd519217496aa520351a4567e2aa28756f4df2c72028643f06f3b386dc1ed66577635b94e9e76a44cb0860b8ed467ed2316fb0af0a7b3035b1
-
Filesize
4KB
MD5d50f67fc9dfa4a6dc57549a4c6876366
SHA18c7097657905919a65442cffd0c16944ab8b8766
SHA256046d3bfcbc745edaa3c0feb352294329091d426ffeb4a33499dddb57341bb401
SHA512c3df65420dd09d8ba5c7f0440faa6f8adfd6c6cd5c55979f6f313e3e795e77b0ef20a52d1204b0bf92633f07921b9b907de66058927853b3630e24b0ade3a97a
-
Filesize
3KB
MD51563ee2b452629fb5ea801f276cd0a26
SHA15ce4da44b0da3970a70900fb80aa1898f1b4daf9
SHA256a3ca2f0fa8f54ba88e67f5ebe21f04e0b0585d95e508d7bb4551f870bf308f12
SHA5128f0ad5ffea2e4df576ce5ea732a05e1790fcef7194872e21a85871cf1ca8777a545fd449b499e28798ddd6b67a8ad7979f487b0c0abf40bc82850c82b86a5c30
-
Filesize
289KB
MD511e09ac5c295ffa83853ee4a4d44a585
SHA1b7c8d831b4f8514401968b36263fb320ad63a860
SHA256167ebc7b57dacc323cad8370fde6511657b276bc8510486b597328eb164fa75f
SHA512bf573c4f6c42dd44e5a5ddba6d8d34441eb6a13d2c1648c9a5aec42fbba51f87f5425b27d5c79153c061e28fdf05affa2630977a8996991bf9ad9f5c5a0022fd
-
Filesize
1KB
MD51f6adce45b97e366ad6acce0fa950da2
SHA118e714ca7b8375615aa96f3ab2dab85e2788a398
SHA25683fb57bc5399b8c98c56232c07b9d888761b31f43e026e559736c67f940db9d6
SHA512e36cb308fec35b6bc79503789604b0095858819191710a0f615b52543cbd0014613238d88e7d3794120435c780c24d800144f5b7f5350e3dc5e956044acd6f77
-
Filesize
175KB
MD53fde22d46492122305d0bee88b316b1f
SHA1cd447602f507d577521e10fa3360d066d9ec743d
SHA256d5544a6e6f115025267602bc1a5bd557028b595f24456d15f84fc888680de04b
SHA512222751e60c76c707ef0837e40dc43d028c83a1cb1da6a28ab0c9b445e3d39d6b5da21af082c8b3978c9db0eaa40833b78701967cb679a86d46889837ca29a303
-
Filesize
1KB
MD519b4616ffdd3372d6dcb439aadfc2a75
SHA1a74bbe2b0ca0b54b165eb658f6b671f460a246af
SHA2561f6ad6c0a3123d500d90cbdae98a260384c2b910132d0a3e50b08bbba0416a99
SHA5122b8846fcf733a8c150bf7991dd43b38c07923015f097ca419f93ba89929815343b8c264644b2a30e7703b53ad619d1912c49d0fc60f9cf30417ee14a6dbc92e8
-
Filesize
9KB
MD5b197b2020da0ce0a2395160b54b0d256
SHA1f23a1a43edd49bfe9bd9ba31a4d918cc61bae34e
SHA2561d404672b8a1965e03dbadbc8ebcf3f86b483258aeda33d21c76a1ef241cd24e
SHA512e2d677a496fe4057cd14d96a707532aba19295b00700561dfc8ee21b59fbaa0f565c6454f88703adebecfb8944d1825dcc264cadf3d74613583f0ec92a8b9898
-
Filesize
14KB
MD5d050026e3c066aa3b743148ff9a2ba95
SHA17ddfddb7379092d80a14f1456e87aca3ae52eccc
SHA25668f83f7e6162f97791a7393e1c20979831d697f02820d2acabae627262c50f1f
SHA512f86bd3138dd88a76f697d7ce6d034c3a98f405a3455394f46f9afed593712ee244d41dbc14aabf376cdcd531b4137709aafb3713020878044954810d2225aee6
-
Filesize
6KB
MD53c33bf6cbccf843d2cb47d5f33c17803
SHA14d75bbf806c8f83f90b6c2863d9a319797a2785f
SHA256b9170083317dc2c9ab12b9b0ddc790f29664e850372fd03f8e21992b5b862261
SHA512104a16504f96a3fe856b0d1c99b7918b562eb1d3d6fad14a22ba5d4ea472b9d1f1c3a85720cc3aa85e1016fdae027c46c41ff0818b094483fc4af073648de56d
-
Filesize
22KB
MD589d5c575aab26f9e045c9712b336d782
SHA18cdd8590969c41ceffc9ca557332f7d1ab10b2fa
SHA2565209b6533ed0894c7421f81e848e8b24d3bcda0b8eab3685ccef0f81e1cb16e0
SHA5127845c201724fcbf83d62402db58b9876d0865f4044a507d624b845001393a9eeb22863ed06d938513f0233339fad647ef48e47f6294d80da6fb85d9ad8d8c952
-
Filesize
6KB
MD5741cf13915ec41f565abdd151f94469d
SHA12708d15dd441ee25b3585a1a3484f6806c02e945
SHA256da4c2103add15ef8aaacbe692c9a638980f315e1e7920416f8dceb481ba66f49
SHA5126629ed34d55acfd2bebfea1a027b5471723c9638e2d132476d2f0e4960f6de67fcee7524b017b1ed1cc922e79c0f2769ae6dd4bb5e970d687ac914f7f44ed7a0
-
Filesize
17KB
MD5748230051cd7e5f3a8524ba26416806a
SHA126c84164e3bfae640640bd889406ad146cdb778a
SHA2566b5c1199b9d94184ac1d340f1560c43296c30cf324774644223228ee766fbfee
SHA512126d66aaf38b5140bd7826921f6bdc0bee300f7358a0eaefaf343908e2cda3ae7030e549f8344c4c78ec4c06b3a017c23dc5691e9d445cde0d2a0696269e73f7
-
Filesize
1KB
MD5937c176c3962e16945e499a42a617c15
SHA19a2b7869c55174a1d005d9407e7b8f434d3213e1
SHA2561bcd41872f5ab02ba37eaea8ff14dbe14441f51ef331081ed08310359553e1ff
SHA512cdddbbe379a2558581431c1373d72719ffe8631db5e69286f3c073b9fe61380402b3a1afe1e141b6584745d9d666a2e43a6a4c17b50a3c274e1c3d5ad3675d67
-
Filesize
262B
MD52589e80e8cc11ed15db58404cf3964e2
SHA1ab821215946bf611726bb608546d7fd1bfec7c4e
SHA2563e7a6f693d65e2783194368973677a11e28605b83553ee5e942bd5be0667c6e3
SHA512db9bb67cec569e25359d854deaaab6bdcc3c4fe893fad643b7f1c04a67c04a5d1886a42560cce0093c4a85277c21717f525fcc9e71c83b8125af57dee0595b2e
-
Filesize
6KB
MD509a6b8c2265ab747c889b1d3cf736023
SHA1852cf73be01c86503584115fc90430589aa896e1
SHA2560f3d7a1e3313b69ad5cd4e8f57c5b1f0386d27c9fb771ade17e1fff013cf8a09
SHA51227dd81195b53758f3cc3513352150e5b0deb03cff486dcb6f767e8570c9e3d22dfa5feb8e4875266bd7da120ef149a84e26278e8f521a6795306619d32f43eba
-
Filesize
47KB
MD56ec0c9d46deea3aef7afc28dd918af3c
SHA16bc40f67c66bd19d6ee44afd0346b203afae5293
SHA256ced4a9780a50081cd8c955ca0ef844795ae1fe7db50465c2a514c17e600dd473
SHA512c19b3c534262990d68695a4c77721c958a80ba79f1ae0ceb42823e7e565d4304830e6b08641da90e495ed4c8aa8c40219c65e923b9a2e48219a9b207d2ebaa28
-
Filesize
9KB
MD5965587f0700cab17e589b265f64b121b
SHA103c8ae4a36b34151b31e9994a92bf2b638e81900
SHA25684d4801627c9e6e0d16a2715d5fdc8ae85808eac2704900c281930ab88963f57
SHA512967333ade591b82aa0010a2ca151e46a0cc19f6dd10523ee226dad260878074b6b186c24827d859dbc77e52b9c1bb5b396ff451e2198c820f635a2cde78ea8f0
-
Filesize
2KB
MD520c0fec4931b85f4dd675ca356b32074
SHA135eefef419b23f308b7621808ae0414bacb248e8
SHA2565ad02e0ed9d8040c233543f2511693f44567b1c1a8d74190f6837ea503e79bd4
SHA512129bf1e014c7fdef0d748fcf6cadf1b7c951fa59d1831565ac44ae0ffc6a6dd2984a21cf9986a0039418e5018be4060a231090c3eb5f6055599061ef46fada50
-
Filesize
2KB
MD566e5d521c746190ae47188cbee6a4ad3
SHA143b9c01ed7d0551a71d038cdc65b00648e52bdf6
SHA256c02d3d62d9d62c505a8538a92889445fc62a73931b831e7d09c06fd8db272302
SHA512df5c41b7a6af04881fd71a290403600566d385c4c741fca3f5764aa8acbd7469584ab40905e64623f7cd346e2d8ac63cf6050f732b3dc8f6fc5ae1aa6a0eca10
-
Filesize
1KB
MD592e683c29f2cdb5936baf6511cb3eb02
SHA19893cab6b9e90b06369a52be22e83848ba964b66
SHA25603bd45c0379aa6465e81030c2d4cca47af6d613c39e54ee666fdfaefa9d54fd5
SHA512fac87593f87a621c828d0c131222e7c984e73e07e75b1400594a62cb7f040c9511c4cfb7e1b2610568310a90afee2639da1ea7ef18f9d1f6e66bfa1af3efe549
-
Filesize
262B
MD530ff917a0a6670b57768b5a3e5e378d7
SHA16cd75bd0b21d5003e887f11841bb72ba0e5d34a5
SHA256d12d8d59aeb917edc98251259e7a1b72cc15a44414264f80e8cd2643d847b4ba
SHA5126807ebc12255fe53d98452b1c5c70ef1bda35ea18e98a50694f6e979dc40d3e41dd116d4d0400198685598180eb8989ec87a3a242d9e8be23f53011fb76c911b
-
Filesize
2KB
MD5684e24d70e077c849e3066d9829172a6
SHA158ed068515f9ceb05829aef9f57aaff48a9441ba
SHA2566b4a6d4a85a70ff6dc67b10384c30afd48a513166761de2f63ec62949e35b7fa
SHA5129282ae0f4b14c3e495566d8a6a1b42b9ad9b5519c8b4b1ac9da1fe6e50dfef4674ffa7125ff4450e8e347eec76d49592f57e6bc3554d3cae5cc54c0d70a0880e
-
Filesize
5KB
MD59e96b0ed7f460d77959e47de2cded390
SHA1e0c6a8f4db4976e03b4c0e6e65e637c50838a2ee
SHA256cd0c7e8733f086047a4c80fe9923d357540eae6bce3757fe8afb8a75488b9a63
SHA512e3ba2998ed07f329e198039cd974e353edd2cd7bfe74e9048ddad9a77332271c2a4319dc3ba16736fe50724be3b1ef143abda1af2287e9d542e402e47285f21f
-
Filesize
1KB
MD5287026a6e49c15749b248e8a3ca2e8f1
SHA1412372316dbe40cbca3f448d9a46e1b32888721e
SHA256e4f5f5e1cae19cc4043f1cce26bbde73d88ced002e73fc53d42e5c82fc1f1bb1
SHA512e413c38b8f4861bb15a8e09d5a18d19f737ac96e6b99f6cb0a8f2dddb37ad3edf5fb49ae7bab35712076f35832ad4027555a832d182e6116831811728820ef7d
-
Filesize
26KB
MD568a343b81ee895bab3fe1d218d27f173
SHA18cd98b62d1c7300e7bfccf0cc8a0d624374ae893
SHA256a7a733fc132c76ab06ff0621034ce7635be976ddb273d38f7ee44e11bf932beb
SHA512a0d458eca2ceb5831f8ea1829c3f1affdc6957d0e55f4e1e4cdc5345a1b6ee9fa78c94e05d28188e8ea80ef7e93148ebbccc167951ca96ab39542c1b29173947
-
Filesize
1KB
MD51764cad8bc84f47c481f7ad90f1d6665
SHA17b5f75396ce515ff7ccaa28d690123b54108771d
SHA256acec7573c18a7f40864e105a6b47e0db54f98723355bd35df905502260903dc9
SHA512f1bdf88ec31bd5114af96b1751cf628dc6ed539a8dbd5d36aaabc1bf832757474e77940049137749e5b06a7d5065974e261138957d0867786f90f0eb66599aa9
-
Filesize
2KB
MD521cd48685f04c139783a283683d44f13
SHA1e8d54d170fa466630c51c0dc2abae485d03a9673
SHA256973725fbefa39126cec7b47a6f0b7cbc9e89f1e7e92e71c0397b64361db36421
SHA512cf3f4c9e5048826f40d11546c673c45d0349b73ad031f0979759bd24db5e87294d75af8b0cf283253e6658781b7031231a68df68bba2a2c52c3af4acb02a502d
-
Filesize
262B
MD54e8ca119b3100e0e994aa7294d564c1b
SHA192fc3e44364c793f8960d17239c4ea5a46910b14
SHA256f7f57fffa12389dfcd1c3359574b3609c48a262995899b8f8e6bf983b7c89c49
SHA5121e57a785c070e45586e95fe5e7f09106775a9e091c993eb4060721b8edabf0883ec45059340ef0f476006dd12c2d20ea7361495d0e04bd40fb20fb98a9dfeeb9
-
Filesize
3KB
MD58410b00e168c7dea80c27431668e5bb4
SHA1519da36edf8bef2d192a492e7175d01cef153713
SHA256651dbca240f805e69b17f2c26b4956f2c0bc989a9eaeafcd9781cabebef5390a
SHA51298622ba603aaa3d1d6b03ba998528c5c852ca752c725aeebe50bb290b1663d644d1fcca3de94c72defa9f36f2df98f09fb69df15498f91e474bbf817de115b85
-
Filesize
262B
MD523ea5862a182d3a975bc8d9faea8b107
SHA174c6e983250e96bbaabad3be8fa012a0ebe9816f
SHA25694a80fdd0b6f4429f31b0f9960e23aa30d0d2edf13b652bb2d19e1141d1bb78b
SHA51271a7bf357a761212050c3143057ced4766811a4ee7dbb7b0667e36a664a6153b09503bb142cf95d7ef45e0d01752a73193caee3fab9289352f7c961e4d7db363
-
Filesize
433KB
MD507df1997407f02466ae9e7d0ea87b6b8
SHA1f65502613715aa187ef35d23e649996d3c2160de
SHA256fa6a08ebe901eb58b2cc107fb21ae3c4f99633670d259f0f6b407050c1c16a91
SHA51291121d9199685e345ce9b1f32a1f9367d119e4b200e64f17e85a046ae223a40a5c051ebd4ea7f1eb865376555ad82f924e1501ad2c866047f82e053fc0e7a617
-
Filesize
262B
MD5c8d97ece96e2452961e90258ff894eac
SHA1bb98e3efd9b97e5c48a4bab51afb2393a1829ddb
SHA2562470eeb97733922351f304ab6c00dec84225511579f16a078b7006fb970bec16
SHA512af0c7b7e1104d62713dc448a1d449f9d8df7f04f8a97927a330d5a5ed8766af89cf93bcd67f5d90c59d8297468d96b218505b4717bbcad8697a14f2bc2c337bc
-
Filesize
6KB
MD5becf12fe9d49649784000a286606e682
SHA1dd0164e8afc3fe1a9f22f58567a3a43ccd8b095d
SHA256023c4279358164427e2691da934d23dd4ddf975cbdc6ae67c5471b8c175c917d
SHA51289f99a90719d56faf491f6597e4d89dc300da99bb1f065da139881b232f338928fcbdbba805c1e39b73dff0f98bfbdc89c4c54699828bfdfa0dc5ccc5feebc6f
-
Filesize
2KB
MD5243b175d84e14f70f6720ea53ff03ec2
SHA1e413f0b59a9fc469412f8ad053e84249db8628dd
SHA25623880d697e4268c074d3bfebd99e002a190910bc0a8527e2fcbe31f29dbf5f72
SHA512234c31ee3ce2cc7950a4258cfaf43894da2514ef295d5bbb128ed39f72f111da671bd62923f93bc6745e2ce1a23faecef5f369ff64a3822f8075df9f89586a91
-
Filesize
28KB
MD5add69278ef9d87b401ab47a66614d17f
SHA146ae3597aa43156f806c5c21c7f384350eb01da2
SHA25674419fe2e42ff5acbdad8c45c150e871bd09f9338956dc544d8cfeed25decbc0
SHA5120d1bcdd90c33a392c7c0491be35a41248ee0b8b05ce085aaa5ac6030a5c7c0d54f53267221b3d182d3703090fc899da6526cf1757b621f97e63c2627be1c3ef4
-
Filesize
4KB
MD5a470468a6742fdf51b029f8b6b6b4444
SHA1f1065ecdc6dc83bb8552b3949a62ef4fd1ea39b3
SHA2561d0cae32949eb07e1cab8d9f57d179182f279b89194bbaba23ef676eef52bdb2
SHA51263f53140c85563a332710b8dcdf1d52442ad017dd9118456d67c200bf4a2febb352965436bafa40646f74922f4397a0e86cc333d7cd965c2ec6bf757c31322dc
-
Filesize
2KB
MD584428217d37ecce3957e9469e73b05a7
SHA17d28263e7bebe15e929837baa2567552eefdb908
SHA25624ba7b7568e5e87eeaa292922159c2e6258dc74a9a33c95cd9d866030c672a4d
SHA5126d1679a5dfd8b13bd7d945a80526de0242f9da827474f1ce6d0fbb28e83c88dd61df4e45acbe3d18b245dddc08b31d08ea8a21ae94f8271a930776993ed1ad47
-
Filesize
3KB
MD53c22c8b7eb0b4c3d8408fd376e39500f
SHA1de9b74986f4c83b8d227d377659f31b7678d1719
SHA2562db9789a0b0a840e09de22af86f66c5c081c3804752b11a996414d4ab4cff2bc
SHA5125536a92b53a511c459bb3fe602c565e2d75499ca46db370357e78a66d14931d7ae1a759d772700cff3a08817e7a3010e52f4f1aca757317ea271ac931bdb4788
-
Filesize
6KB
MD5a3c886cddf29d1d0421260ffe7e0e3e4
SHA1d80b35b252bfda3b84b917baf1ae4dc2d9d9d57a
SHA256ee6a04f2d5b68c9e804ceb0d5f186982db8c439154501eeed630ddf068139c71
SHA51286afbaf794bf9ec4bb4f036b2ac48266f20465557751f388f1d659499d223bbaa75c3654974e2116cef9146350dab199ddc73199ef7c3180a559042583217049
-
Filesize
2KB
MD5b5cb5fd78538e9a82b368c5d54c66d7e
SHA1f78cbcf20b9bd3a5df421b84472fbf8b5fee57f4
SHA2566e082e675a9c8c889f9393712c1ee2dbe69a6185f0029285d3eb29c378ca9169
SHA512e8ab1972e280e3a152f567d93179af26f0091b2952cbc76443ddcf78066ac4a71f56c009f960021d97e289140d0fcc437a08f9c2a5ccac88e597afa7635a0367
-
Filesize
2KB
MD55fb0ede7f1f14eee8561e34cd8423256
SHA18a2a4db82471015574e98e941c3304a643394932
SHA256f784926b2ac0cabc4242ac1a925a08e3b9a7221ecd2fb759a5354cc1c403a3bd
SHA5122fe0b5538bb95b02ba8e797f24c2af8481e7e25e0d6bb3084df52d4ff38b69c274c8740407589d8002a063650e08e8a91eeec0ec594ed279a104862fc2d89ef9
-
Filesize
68KB
MD515105141c9b68892a2736f3c50333191
SHA12430da6008fad4677d77cae7e387bfd66656ac72
SHA2566cfa1103bf72c35fd5d41ce86d33c362b9e9802fe75e4a27cd581f098b2672a6
SHA51295a10994273b5ac081c4debd9c301d6f852d1d7d57fe52479fc185747a6dcec8c399159e1bd5c4f891072a6500cd94e5ea69814cf5af086a4e5bdf45ef02f9c1
-
Filesize
3KB
MD5f79d339343afbfedc8c6621ae55435bf
SHA160aaf4f68899e23287c1d49175b63c0a71953c0e
SHA2563cc027650f12b0ae19b67ac1fbf58d2aa6aa7173de17afa2e748aeb948a0f467
SHA51289a11aa301ca44b1a57e90c0fb94608400fd5d2260d239961a0621af912a15522a0c84d11dd9343cfb41e0fb12432ec00ccc48cf63552bf907b0811f0976976e
-
Filesize
1KB
MD580265382c5c2a83d43e61ebd1a5bc44d
SHA1acbca57f5fcef259045fd5990c97770ee457fc8f
SHA25680af4b71d209546bc34dc161a2854470e418b2420b8592bc0f7c8c03c8d9d391
SHA512bb33db260a99e90bcdec5fb87fa541d2cb2c2f1732377e66eb0f80d128e30a48ac845d84d65b14428bd9c794b02a0123b65208b118eba89b332105cfdaf99062
-
Filesize
303KB
MD563aacb2705bc8704adddfbbfecbbd82c
SHA10d9a26ff9cfdaca484460edc9271f59189820e8d
SHA256ce43ea2767136e2a82413f28280f1bce7dc66fafad7af01d1e20ce08d6fd2d04
SHA512c798d37814129483e95d6c9a027c218741ba504837828f228095349e6acb6c3f14e7fce3c729fead9cd5070ab7e91fe35d3abd260577818edd0188de274c8014
-
Filesize
6KB
MD54222545fee861dfc37ab7f1d8cd0e437
SHA1a3f9234f4daebe4a21c1ea1ad2c0e6cc22dcde4a
SHA2565b23ab2bc064f743742eb9783313de06271ddc6c7e4d8470e1c8e5e941577785
SHA512f92d0d44b4e57fe7abdb8a8717de7ea29bef0c2fdff10702dde4405e145bf07521073ed221685b9e708b8324e2ab70b6150ca8632fc809cbb1489333bb27bd3b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize6KB
MD501432235a36b0f7a1e575a2d494c8861
SHA1de1ab7d288926e68d84a62617028e82304290770
SHA2564216bf981f42cc2e12ec528460a808007175f30d3c5252ecef158ad5f4b7a685
SHA512694545e9957595c557c91d268cbd5382368259bcc2b98d483d94278dbe7f0ff509e5604202805e6ada24952c8629bc58c5c1dd67e19b2e0c2a2066f76523f13d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize4KB
MD51c3d339d3b222883d3abb017af6e3a4b
SHA11ca33b1cd6fb640c599f6d63cd680bdfb88bb0cf
SHA256f49f783ac417c7194e3e83cdc92bba0db6e94258e94745fa734ca2eb73ebe129
SHA5129aa1adf9c7d32950562d19f5d0ac594eba64fd22fe48e3616aa8a989f8c6a20548f6bd4c2ef8fcb2fc229c987ae47016e8e79e5de0a32be3373d4939b5a7a74e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize6KB
MD56ac38553ac21131ec8c19ba9ada56065
SHA1ecb0806310f979a09a2e7a3fe3d5a5bdd9de6625
SHA256232bdfad0b85b24138549795e168bc8571e22447d75186a1e8acfc83aa9965b8
SHA5123df0cc58062356de3678a26f0ec9a1e03b8b17ee169db8ca89dde5c4e7f143889de1e24dbc4b691ae675730eadd2f070b4911e52fd3e835a7059a455e6c353d3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize6KB
MD5c04c588acc3a0d9e228804bf67fd2292
SHA1974572db52da5865215614d01fc19856dab7b148
SHA25640be612bc116630268e58034bf9996e3723c79dfbe4b62c41a0e77eda4940373
SHA5123cd60fd331a555be4d036b91f70156ec80f535e4a61d6a0acff97bd298b0de1c9f125eaf79805ae62280cd9100e0801bf1dd65b32fb496aeec8eb4d28100f86c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize960B
MD5a26877720cf617fedc3d9ce7f8900c42
SHA1a17a77175db8c9f1d68693f368c34003124b038e
SHA25643682ab23c12e1b38f73dfced87ed348e518087ef8cff79c8b56421ea8baf384
SHA51242a045c4c396a5b6abcfe7bd3e2742705d55b6b034f73f2f7884702f9ac220de7bf2bcdf72e6b3276650f42cdc0fc346a178aa63a12872f9d418b1329dd7c482
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize7KB
MD5a7cad56ebcd1ab59074a52ed24dcffd2
SHA1321b914c4e804f67494dd3e6b127ade3d7718280
SHA25628383b0ac35618b2deb150f86daeb6cd2d744d46be1f80aa595072ee1d98b0d0
SHA512713f32bb6c7d69c1411101e1e3107338a84a15ddb14850a36c9aacfaa49d6fce5cdcd7440f228c1011d2af52a2efcb371d3021c6b1fe4b5096ea446347f38f6c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize6KB
MD5e17a89e4bcd5fb56bfa648e9288807b3
SHA1e530f5ea326f59eb1c2e97ed2b472f8e789ad9b8
SHA256143c1ec6595900ad94edbcfc8bc6fe1cebf5c7c73d25cc4eb73b3fdae5e70ad5
SHA51218a6a7fb8f31268c8c471b89571d15ccb93885fdc32a14edced890dbc2ffdb7cbcae21a2076a1c1bfcdfe50e6e547b13aa0d9524c766a8ddc4691316d355ad26
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize8KB
MD5bf872e16793249bc397050a3dec41616
SHA1f343d4ddf77dcfba6307da888d23a65de66795fa
SHA25680c86919ab50d7c07c51dab83ff94345ff593147411a779951ac60b4e6070865
SHA5129e97040f9df4190be18f65657bd330cad9bdd1fe0310e4d14a0520e0f490b59568913f4ea72a44c251eeaff38025ae9cc1f3489de877af285fcf87e7a6149e45
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize8KB
MD58f2e196fd25af8520cdb93e25eae1ea1
SHA135a8e4f3de91a8eb47eae02dad99d119bdad9f2c
SHA256f24a1e22c7f109e5830f90bd671cb3f6121e9b21c754917ff9b24d1ca201811c
SHA512791b8100a444b67fb0df8dc5a6672708c69e591823f95e06ecb38650bf5e1c3d0e5ce40122753190f7bcdbbc5564fd6d3afaee498dc9a95d18d59eb482047939
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize8KB
MD584c05437d6404e4de344be0cb3b7b877
SHA1d27e6196f9b062137e56d906cb68d79635c52e78
SHA256831c2898c2728e0ea7e7754cf86972024c37837f89bd81be86aadc16eff9bbf0
SHA512715261132051930c1d202460f5ae1c4bf6fc1bcf8646f250f82401ed513e19bb7749803f21991a5705bd9a45d0314b6ba387d00e872a0cc3c7392ab1b41d8aee
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD5fb946c734ab17bf71ce2318bd0745da5
SHA10419cddc4543eaf1dc3b5923008cf5bb40c90bc4
SHA25627288726ffe2d4eb9b58ffed7d33d708d85f271160110f4f52faa9c64e85bf3d
SHA5124115e1e603f5e37f6c01f313cb59ea6f1a2971a1ae40cbc056fe1467929e01356dad8ae36ef3b7de8c48bb794666c4c05ff2e98935c01a31d18b96f13b1112db
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize8KB
MD5b9d0265e3a2778f4f26fe1a768a4154a
SHA1d96ffb15808bd2f123c3207dafc3f8b3bb62d862
SHA2564adb876ff7d38c704ef3756f4febf0051ceaa755a0ce2af0b7df222aa9b394e6
SHA512f28d21a803cdfffc22627572f0ddeffed16f479a1ae656ad50d0afdf153e35f0175a4f19da624b801d1b7a79256101db0986967b5367088528dbebf67bc0facb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize7KB
MD54d57acf03fe5da89fd1a06e40ad93e37
SHA1af7db13910caf38fcfd64e5b08de1c242abea15c
SHA256c90c57861a665b169db53b19d6e3134a15f5d6c0ce7125147b86c3b4e48ecf12
SHA5120ca48b18530fac4d77adf33977a2bef84e75a58894f62b7d3d3c999d84971f02709074ba51d2d130cd457e0dd63e0a6751e5c6e15d819c55ecd3b11419ee3b49
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize8KB
MD5d183cd136405ba7d7a9de01018332e3c
SHA144c44f431f3a8d61d33f8c9ad4eeb551a2824e76
SHA2562efe1abbad70117d58ed5e9925e4b9749b5d35ce2e8a4a1232ed475338db9c93
SHA512e4fa5fa8878034a392b88ba6d13331016eca22452dbcde88f966ad0792ece9f7e3eed46bffc8cd6c90708085af87a6eeffa84b17656f2383778a6996a22c5da0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_devicebind.ebay.com.au_0.indexeddb.leveldb\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_devicebind.ebay.com.au_0.indexeddb.leveldb\MANIFEST-000001
Filesize23B
MD53fd11ff447c1ee23538dc4d9724427a3
SHA11335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA51210a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
-
Filesize
8KB
MD54644233ba0931a1a96fb5d9bc2785559
SHA1753b0a1da188ee5c3e1dc9b115564da83ec699ad
SHA256e959eccd23379e93d12114d554425c83ffdf597f8e84c10eb3fff24d88a03ba8
SHA51202181f1ff508aa649e06c0b4bcc58ecf86628c38907f0c9a3b2adb1e1522d076dc9cc895796a33ba710f2631b20034ea3d5245a7313dee788ab4ec8186650b47
-
Filesize
7KB
MD5b5c1c0344d47de7a7699ed3ec83fa80b
SHA1ebd65d399fbabec85da61502febdd91342a571d4
SHA256d60e4fd4412ede40d76d501e57890f1d8dcb3a1f904fca137b2d8fd64790bc0c
SHA51261eb88dbc609cfefe1a926b044098210316fa9774f6533006c9d0bfb8ab002c5ce267c6caca462a346f058fa462b5c4531e25cc2e6cec8f9c12024a4cc6cf074
-
Filesize
7KB
MD5b34c4ed7364af06ec549a2c442e720ce
SHA16484257e4cf6795402f4f864e0ae391825bdd41a
SHA256c86fc7aefef66603dcd854304db1e5b70561b28921f9e50b614ce608c46391e0
SHA512a661179b388a6d88ba8f3ba0462d0b5863c7a23cf7a5c45e3ed19ba47925db2f7571445f150f61154a29d84a97672865dc67f704e44bab8f0d23c89c2c691f94
-
Filesize
4KB
MD58498fcaaf3f4daa653dabd2ffb23e511
SHA1333c8d5e1d322a35b292aa66916ee6a2ab314002
SHA256005f57ebe9fab0498c167d687bf2615c6f59b8204826c1c006df01a6510e73d6
SHA512b4ab402656eecd3bdda0082e45caf3e21ce476d9c775b0a7c6de5c70f85f6ad50474f925026ef8b1bb2f1ed231f094933c7deca5ed7ea48ee21d2671d6b4e85c
-
Filesize
7KB
MD55716730684c87c90cd5d67a544162d23
SHA1e366528bbcb89615f1390b98ad55839ef277871c
SHA25601821af6301e0e74c2778d6349ab4978e5740e03bef6d596e5da3b6c78a90b46
SHA512408c521bdec1269da690e63783479a34e87981e629e6ae7de2270ff9897a53e6a4ff25f3751389eac3d27e040bde95d06cbdf796af6aa9b66d9fc0e213ff15e4
-
Filesize
7KB
MD51e27e290d2c8f6442516c28104125c8a
SHA1e690217f047bb38590e5bcc0df7a3f8fef22e035
SHA25613a15e9f21844a687231e85b6c2011bdc54b12eee622ae5c2b88153b6600589d
SHA5122e93eb3c84b57437cfed0e8b8374580c294a1e497394c7851008c434ef185251e46f8b6083d816d7895844e5a8f05b317165c8a504c5b09776f50b11936e1519
-
Filesize
7KB
MD54b4aa69e327c73e2a59f4673911545fc
SHA1218b2efc03b03e3be06cdbd3febfef767f79a0b4
SHA2563ae095e84f8c99f3f256b4699fa2451967d7c9e6325cad54f7b9f167659d0a72
SHA5129d3ef3845cd115e1989243bd8b44fb426231499470532f1744d54fb0bfaffd570ed371e00a36e9d3f048159da6ffd7998e15366868ebf5e5d179f8df91304f32
-
Filesize
3KB
MD5bb59cc5be80ed52974313820639e6c45
SHA131c10b2ef82d4a3d1b924b93e631aeb09dc10ddd
SHA2564d9c9b3563daa375af4ffd7373f8b35104de2fb5f36fbc155b17dd4b8442764d
SHA51221118921d50a875df72eebc43d6285bc93aa168e6a3c34c4c1eaa4cceb17cb6f4424e049b61ede2c4278404d0cb84c512c2e5ccdee0a8526c9c822becab4420e
-
Filesize
2KB
MD533d4809a8603c5884901cfa8b1186624
SHA1d6ff9225d862b20d366c9854c05bc1b0308b2471
SHA2566884dbfe779a82f05bc84a1e413ac614291dd1d8487c5893219f902302c9fd20
SHA512add1dd7bea4c3c6fa9ade8038d4d15a82200e50a1e8f4b3ba3426d97438247fecf760501529edc44555babff099dbb703217722754a83d4674abb9428e62ae0c
-
Filesize
7KB
MD5bed3ea724693cb1545d9c77b71d067ad
SHA191fe541c73ce7f4e0490f9720023585fe58ba3b5
SHA2567bcc2cf2cbaf45012f73d4bd25c71d18fe37c77f5c89cd23174593fef79ac537
SHA512e65d7c22680e107c99edcff420265b68a0ec30523f436ce31f28abc35a10bca27bbcc9d8a14ac9dfc1b74125a1ed1b7f473a3def8b419eb12733910212aff180
-
Filesize
12KB
MD5c2406a20b1d640cac91f095001391ead
SHA11f5426ca2ec7b932317238c9882ab0b69a7f954a
SHA2565ab1eacf7a5242b94974bb9f8a3e64a17c7756c1dfaa534267318a1fbb87bfca
SHA512b3a1741e01b354ee7455fdf562e034a503a4cfbc1ab90d597c3ea9c1e4aaeeed0c4d4f3869cac401b303a6f93fb93c4857af4ec64342452239f8fb25d48925b1
-
Filesize
12KB
MD5a1cbcccb446deedac433913e066ba8cb
SHA17196f7142b9c72a5190a76d5be20203150ab22d1
SHA2566262ef56bae19c65d67f6154c126f0d8679cb1eb5d54838c029c648cafe37efb
SHA51283e1fb67dba35d526c1e70f4098888843fb8f68f08e98594f2c265fb56d9a0c145624693f63f3fe03b6fe0dbd616ca500abee0ad915bf6db70360b74952e990c
-
Filesize
12KB
MD5493fba11416800d49204b83f06e878b2
SHA1c37cc02ef15b2090609f39344cddc290ac361b20
SHA256636382dee57ab7cd7e9e6da670e05d0987e6a9126fc8e398c865cdc24e4ea394
SHA512f573af62b0f565d5549096912f330b36995be5b868dc9b34d57e4c1f16118ad31b5f5e06f720f027bd9f1fbbeb61a6de673c2d9f1d983211bb2a627d99afa6ec
-
Filesize
5KB
MD5f6907f35a8574159bd221e1882797592
SHA19c48341ad4bd00f635398b9f741ca83b5fa32bea
SHA25650affe37e91d90da0623971a36f91ff2b1db368a36cfb5c6a295a84a47c38919
SHA512600615c65bf6524f7a84fed0b154d00917cdf59727bea0819622f5fbae340506948f188c4888b2373e4829714b52b2937ceba46f603627a6f9eaaa29a709a621
-
Filesize
6KB
MD58e8cfa466b44c5d13ae525798a4c1938
SHA1106b465587b369625f1e6f7a2ab75b2c211294c1
SHA2567589ab3d68bf1a77610e0d51fa3b700cdf2444fb300e0a78d736a1329a3aacee
SHA512cc2389b251d4d6cbe4f6ba0633dae30c9e4ef2277ece441f3e4c4d0d03f64cf9557c2eb46c2bdfe3734efa627ee5f7fe8eff890fe8967e400d3d31bd8e32bd80
-
Filesize
12KB
MD5b8ca981d414726e8e405feb220f7c84f
SHA1ba428b7bbec05f20afc14142f8430cfcddd2e7d0
SHA256463bb450f6a1e200c202af04ad9e3bfaa01e1dd1df5cd6cff61dd5dd3094fc02
SHA512a8796395eb42c7445e721df4380d2fe5a60e5848c9155620602d92e571fb1684b9ac55b853383f60e6efff298849944598be978ad40229be15be98a2dded1cb6
-
Filesize
13KB
MD52e7f9f13ecef035b396892c68d00516c
SHA1b6d28ed41562f0ddb3ff13cd0d6fe8a2f0c84a15
SHA25652d489103ae1a6f1482c0a3f253369c405d79c45dc219b32dfff8f4812d08f77
SHA512006b71c20619be1d78028921e2c1b152e3c282feee4b5c606316e6be47873dba6aeb49fc9b873d6a34590db9a20072ccd150d93425f6bf666eaae0a6cf3e9669
-
Filesize
13KB
MD58f4d55b22192c5d6e3eefac369a15a2c
SHA1a6255fe3fb40f220b28ef96aee18cf923e5ae700
SHA25657a9e05324df3fc59560086ebea7871e40e798c06e0d7e0a8ac2e04b578e641d
SHA51209cfb952523b0c20deb693754bb0c8fb62f2640390b4eac85a7004ecdf6688219cf02cf05a5a32595a4d1dbf9f38961a3dbe7fd78d7261755c10d369c90aed7b
-
Filesize
14KB
MD5c087a80460bf513033a07efff65eb609
SHA18be0d57aa739ad3a1408eac962eba7af5e9a603e
SHA2569a837bec44c8f5443abd30d089906068d8e164efff25c6e9bfc43dbb500a689b
SHA5120645105abe72930bf7cdaaa80266fbd10e373a75c6554a0f9d2be3b62e7f0015b0fff6d4135730b82f2c02b61fe0154f33475d40eb1b350273ec0c48ca47ee78
-
Filesize
8KB
MD51192f813e6c99228d5e4800af8bf1322
SHA1a3ea8cfb22103329eb15e0b26a74fb074885d37f
SHA2566edc482da1b3260b83f7da2fb385c493d04af3ac7815e26949ac1a50eadbe8e5
SHA5128c3f99753e6a00c087f424449e7fbcb43f5d9dcc11c52f71b206cad168334bdee8a2adceebe5798726bc6b29a0e180fb594dbf85f9b7a9c452910484f09a7c3c
-
Filesize
11KB
MD50fddb3b05b6e9d43a216391164750797
SHA12e96ef1e40860b41ca2c4d4c5ceee563df83473c
SHA256e01a26eb413662700bbe96fb63f14bbfb5c28958a5e927b40fb4aeecbd3dc485
SHA512fab1a5dd91104205a98e0117832cd827642c6b584473e074e726061fc95e606ca6267817e60548b0ad1e313d5309f44b8d702c859cd8914c60b4c6ab37d8e465
-
Filesize
13KB
MD50868557bb59f8eb42e666ea0f7824e62
SHA15b912471b3c72809df6a2c380f3107e5433981f9
SHA2566b255a7d3c5c8775a6e74e15f537e4499a8af221da3d642eade848e02fbb6a4d
SHA512126130e7e2e45c3d7090d64a41ec4ac2a8aba136e279ec9249195d48f658f87d96b816309d6abebd0d0c7b9c98ae92d79331d85acf4ecec905822ea8e1b8afba
-
Filesize
13KB
MD5ebef35131d764f73356a2ee88f07fd4d
SHA18b3563a26d4e6aa7e88c5f2ad92f63459409da81
SHA2562c0e9b3aecb3806e8e1f6650a28e113464df9ad9034af0c11ee6c584ecd82fab
SHA5124df0a8ec64c6ea092f59c85dd4214505feb22aff367613f9342bd75f1d9e2abb530b1fa05edd2fb7a9b112753088078935119102f4eb625221c1c46f71605cd2
-
Filesize
9KB
MD53c335d355a4af940c0dd9e6cb0c04bf2
SHA1772c58a503b7eb3181466cba6594897162ff014f
SHA256d2084da62665597dc41917a274a0efacf737c70fc00ba57b6bcb033d6dfb0eb3
SHA512c618aa2178607dfc98c623a819406629d190cf73424dd636f81d46555058f8b6cc313e0da66c0e4b664c9467b316c2cf2a66c141b9a838dbbaeb4b107dc97db4
-
Filesize
10KB
MD55e8e68d663ecce99fa9baae0dc121ab0
SHA1ff9dab2f070f8525b1572a40346bb0ae975397b0
SHA256610df657931853971609c7a67d501928631ad0a08f75870aee64e22e4e102b7d
SHA512a6caf4bce73914b2bd65910a21d39b908bbd895d8b5cb99b5a89464ddbcf6e12620d6fbafaf547b86e69156ebb7d2e135bcf8a79d6093385a580812a01562930
-
Filesize
13KB
MD5d39a22910c6229c199770dea619f9caa
SHA13ce273a14c80cebf16ced048ea79b489567dee06
SHA25658240a18698ad8fcde8c82c393ee095c560c94f390d29b739a23ca5e42fa37a2
SHA51277b49bbaa100b85d3c03d76445ccd398decb434e18ed750fbde6245c20e5ec730a36a0e16eb3c289147b3358644c2437bc94f02bd6dc7efd456c8f7685fbd586
-
Filesize
12KB
MD5ea758f05d170136cb44e53f0af1edd28
SHA1a84a2b9c2524d62c8d12efe184481a11a09ca88a
SHA256adad70400396da89f7c913c6d869d57b813bcd5bd35cbef2be860d8fe13741f4
SHA512087891d000469cade1af9a86715318178b0d641b6204998ac286d9e238fad8cf482c32e271996435e83900acafd717e0029365b165ca46e2ffb66338621906fc
-
Filesize
12KB
MD55f812532ac371def38a636f7dcf9436f
SHA1bb6ee22ae5585265781c205fa90835217244be33
SHA256e7964abfaf515f8739bd46efac280a09398e759c39a6c6566f1826a1bb52f8ee
SHA512a1fa83790c50a21f6e08a2f5ae69fa403d583c637ff1c734248a0d339e1cf0ec8ceff8e282327981cf34ec6d3255799b1566edd45ab8784ac7096024cfafa1bf
-
Filesize
13KB
MD5e58623a697f4baf1101f1c49421dcb8f
SHA17205e47fa9f67775e6cf132f95429859b36b984c
SHA2567bc88d3297215d87cd6eac149f00b570444da82db72bb695791849b121632e95
SHA512f4324bf5dc683e6f4d7286050ccc8cc1a25bbc3feca9154e8c38f192af31c00bc8660f5d6c49f4ef6acdaa9a47626bd66e2e29f6f5ebfe9fa9383f30f64ec204
-
Filesize
14KB
MD5bad6b9386beb2ff9891fad48572772db
SHA1ac37f12310179b376a01b2245a5ae00f24349194
SHA256375fe06f1abc642265dbf026a40fca2e5e06796c5d621e5f0fb9eb169b0f50ac
SHA512603d19522f293d619d000f5d71f9d37adb2b06ced432f3cb11fd9a15d9601d0026a047fbfbe2c0621bf8533447a819ced623d4afb829b40aae77d759523cd8bf
-
Filesize
9KB
MD54d18de0b5e4d7ea53475f08d6752f94e
SHA12aadccaf0dd0b6e6d82e4dfcec55ca7e67aa0eb0
SHA256e9f399e83b936d9738dc70af68e63f0500c1009ef3b98e4ec4665db997522cb2
SHA5120cab951eddea9a5c41a4ea1933f24313cca16ad0d8dbf9bfbb30c41b4a1171be826ea1e3f081c789b3c71b5034b8e00993bf107ed687a394a4212bb43a169f49
-
Filesize
13KB
MD5838f0f427cdef779df7a764688139624
SHA1df3df88451f383d845948b66a251bf1dd57befbe
SHA256520d9c8b175b7095563a25d39866110ec2ecd4342d58ea081b20a9d5f5059d33
SHA51288ef82517480144993e2cbc9c2112b94207572d242beeb5668956ba65c7a1e4c05dee2a6c175e64e594753536a7948b6c4744af8aa1c2c2b5499fff993b0e05e
-
Filesize
13KB
MD59d9bb915402c683c200362ca6e05f038
SHA179daf85104fd4ef58ef6cd46fe03dbe265f04cc2
SHA2567576e79c888d138426e2a6b26e22949dd6c39248e234776915fe69a351281aca
SHA51230b9259a0e0f8231ccb1a028638c97b2ee5ce630f5d66ba500fe222a9048e55719f882a48b5204dbf0e8393462dfa6a125e2b0df2aaa724f94415accbb55548c
-
Filesize
10KB
MD52b20a4d7d0358b1967b53646c6fb5070
SHA143e4c1eafac084943600c4e44fe7a796e920d66b
SHA256a4cc9bdf338234fa9dcc4a99e66b331545720f4b1efcbeac8b56fafac342cbe6
SHA512a9e098be703d23e6b2918025a68782b8ea249b2392cd3e4a74acb99fc87c8cd7a76c9eaa5716e0a1f30e1bdc29d88697b9f27ecd22a21ab4bf6b1424eae03b2d
-
Filesize
13KB
MD50dd44e630d6adc17afbb222ed6a98cf2
SHA182193aeff095a72b88e2f323e7e6c33f61b109c0
SHA2567f97076fa885cfce8b7e918ce60aa10d6fc447029b285c6a0c17dc511c7a6587
SHA51200d283f3b9900f120d1f78d827ba40dcf415a9610cfff8496a9da59ff696b4cd2678fd3c04c1f0823413f667c4fec309025ae31d0ef01f34c5ef0878170ed7c7
-
Filesize
13KB
MD527a5c6630b62c3e55e4f8b361824369a
SHA11c5a7c53ac5e0e562e422831b8b845bcc23f5735
SHA256bd1c9034b70eabfe70a48a9339554e442317025ee3cc0941ae942d7e74146de7
SHA512914600fd6ea1f619ff5e75999358d8a70fb5f24730840b8a910b333b973429595f5a77cdfc2dfe69dd2f267e4e1f0fd7056f207ca00c8f70cfc6cd7167d8f9a3
-
Filesize
14KB
MD5b7b25d6c783586292abbdf877d57da63
SHA1e8cf6f69b2e8aa6923883f8bac2e9fe445f54cb3
SHA25636636cfa0d89cbc4b29cf55d412d8ff87e46394bbd150dfe901227d7ea7e8c42
SHA51256217569d9896cfc1ab9c300fb5607b8eb9612ac30729b275ecc9c48212b6e0fdefc9112f1d0d6c06876636c64b12766013ce72549a29b1c297b1a60458e420d
-
Filesize
5KB
MD5a1b1e013b30b6fe9e0ff5b5e9635577f
SHA1911d4d13e733f30a16121eaa6a8ea8e0caa59e5d
SHA256db4ab94686eb2a87df4d3cd2e5ccb21c8076ad9cc3de718a6925bf35feedfefe
SHA512ee8f5423cbdb75c468df4140f80540ea107784f7e4b1f325c8c964e034d314ddb7ce66782a70fe5ff4c563dbce84785bfd8af4203f73ef8e9995de5e2aabb089
-
Filesize
6KB
MD5a02cf56af9c08874f5c46959c59cc111
SHA11c3e7832f81f4fcefb20e84073a3ab4e871ee4cf
SHA2560cbfc9f430b1ef57718f5e6d7c13f3569850bc1a60738d6d8ab17baf354a8a68
SHA5129f2c8b090f505bd3922a46fb178ce1af66aa415837f82d3b0ad6de136ef9f29cb50753991191fe4946d98776c806a07e127a5094e9397a351048d41cbd53922f
-
Filesize
5KB
MD512b6425b4394df518f0c663cdcbf1f99
SHA1e5456fcf9e38675b9905ae7fce6a14381744464b
SHA2561ad2e690db6cf31883a214f94d83f08131021a8d5278c528e73a374d09adaf8c
SHA512df4a7120ae8b932368068e2a87b3024bb8c706c084c05a1d670ded4743b249ecbda30294766be881a5df1cbb704b75f5adf91fe8a4a2a61baff1ffc0ba8313fa
-
Filesize
5KB
MD5101ec9611eca4f75101481e12bd8fe46
SHA19dcbd0622276da7398a554b326b16e6e20e90f66
SHA256d099b0238aca80e7bbd60f7acf51bc14e0f9bc888ceaa3a4c417903c3728ef09
SHA512628e4af3a1aebba754a77be31b493be4fae40ba2720f8139876593c18d5b2120c1c7feb1a10eedaaa0eb83758c318d879a660ca5855a8643ffd184d437e6a1eb
-
Filesize
3KB
MD51e23d960b1aab24c0018ef176eed2802
SHA18f3002e009ca3498d59f6cffb3d4ce593df0188f
SHA2561233544024433481fcc58e56e6fc2e0f62ec6f047063a031c17f15120475f625
SHA512d6b11a1e03aabad08827f8d7256d1366b2561c756bc8a84dd6677675b62ce73585023ead374a66563945e319af76e60450d98262f1e10803b2837d225493a1e2
-
Filesize
7KB
MD56f4cc9a00ff7cfff34c4d2343602423d
SHA17bb60a9db4a4a1b651e5eb88acdc6bdce5ad6e02
SHA2565a7f934675978b2740e9ef4d215ed4466ab3aa3992765cc6063d3db6cb0ed72f
SHA51283407e446159e0566d20149e161924e87a7769692262755d5b3a055ba4e8e6e88b1cb96a4bdcda15e3c0b04a8055ff33eec863d6efed30547923f024657f6afd
-
Filesize
3KB
MD510a70e77b08f3b05dd7503f69d4e73f8
SHA17b737855e0cb626dc19b1cbcb99b7d62ea3248a9
SHA256894c4c732f744a892ce939160ca21440f3beb723895c4e5af80872e34d281117
SHA51244493442de3ed2b020e57edb943084548bacd8c8e09b71a4c24451ec492ec28c23cbf21596e4057e5ffa35f20996abfa57b259e5b0aa47605d45a88ac562d31c
-
Filesize
5KB
MD5b5aa023320ce913c8b3069f69a897f0a
SHA115c4e779d6d44785389aba16ede0c91c04294507
SHA256a6db729210fb24fb8e1dbce70e46711f90221c081ac4ee6d5f49bcc52a2e1f86
SHA5120d5d1ec78b5d3070c66fa6f836693ec3fc5e9274a3ab2260bfdcf3fc92e4ec0fc47f117e0f9d5bd8ef6c072746e77ffd1ffda062f06c3bf2650ca1d4238b0b33
-
Filesize
6KB
MD564cadadb8265af495b7706a4aef69d34
SHA12a4f17dc5328c6a644de61a5c51d4c70ee0dd96b
SHA2563ebfef6c3bdbfb00c497cfffc5f7d72a21a063df7da59f78697fb74ec74d4a28
SHA51299f985fa0d7cc0a87f3ba34445fe61e327b3626b34ad17dcae8a4a8d5885832b8461074cdeecd5a3772601b473da6ba4ae908922e771a2d8ec2c90710c78412a
-
Filesize
6KB
MD5eb9ef0fafde40ca82e9abd9b823018ab
SHA19829679efd6a6ab6ebd6a8e24af5866f36000788
SHA256623cf84144fc4fbd11e9f2c1538a00ca4f0969f66c97175ec7e96ef9fc6448e6
SHA512db51e48ca950164ae2b0cf882d98411b29b431aa579c8a7d0aee47b2b0d4820b42017ad32bc5a3f3596b7b012ca97ad141b3e45a793bfd2a458f7762ee956137
-
Filesize
7KB
MD540f639c656747390e11ac7b496b44ff6
SHA1b7f3509838a09002ea9ad5f3eda738ccd2a3ad1a
SHA256e6888804a88a33783a89abb71fe801110d641f96ae71c985b171d399538fff51
SHA512838b3949816b1d22fcad070fcf1a3404109c842ab3eb359e4c353aff9a9cc3326b8fe35ff44f4d71f548e4f5336d410ae9f9c1ffe60d99341b2b46f7e2f3daf3
-
Filesize
6KB
MD5b73c5682882de8a8c8d3cf3e569a83d2
SHA1593925eb583c14348c145e137601c9273792bb95
SHA256a7fd1ac4adc66a17fe896120417f7298a694f1b6fa0aa97884f50e744fc7a942
SHA512b76414a1523fa7408b08d56b5a883eb515205672b0a8928bf378202eac8b0a9c19a18214f708d2fe28f6b74e57622cb268e4002de527d6ae1b266b1c5e86c892
-
Filesize
3KB
MD51fb99d1f1c3c5ac436c5baec46692425
SHA11dd904cdf775b8c6a9b48978a73a7fb16e9fa05a
SHA25693722f1a15464da21eea068121b0b5e267a225fc1577b979091531e5903d8dd6
SHA51275f24c5e0b1910ca68a80ce77f5c117521dc5f6b64b91006101d6cf0248ca69ee4e5ac77237c0bf7447dd3aa6f971efd85e853a88b70e2bf023e5824665bb6d6
-
Filesize
5KB
MD59e957261e7a8ee037d91881e2f0d8481
SHA14709ab9bb518709d55ca184dde961dfe1e69b571
SHA25615b4579a6b14d2f719d70079a055e3ea0863401be29adca41e28fe4a6ee2d544
SHA5121ac2bdf3a00d7be7190c8dc7d8ee22ead2fa1e121942ea7e7e6833319abf1a858aaefd210d4bbed01054d75d5394559c854f4d9d5845c225f4faa146f5ec4dbb
-
Filesize
6KB
MD5f7c94daca90f32aaac43d7fce0c8b920
SHA1cd5e567bae743d2724364681c1c898dd0458ad48
SHA2566a63b349a0e32dcf99496acdbe809f545654cd676f7868d74d646fa4f92cce90
SHA512c36d5fe13bfb9bc245cc8c5682dc008d7ff375e8d734184f0ab56c5047bd46132cecd40bc5e22c7d6d0e93d9ac552a91d1c0bf4b41a7a3c166cfb6b1ffa29412
-
Filesize
6KB
MD5e073441bfa7f20e7b885ee3da7dcdbee
SHA17ae13f47cd05c0691d68fd56028a4e41bcdaea0b
SHA256a03b4724472d9bdaa87f407b35494c8f57ab3e9eec09795af0b4a495552f6a83
SHA512ec5a38f36c5b1ed63e82776f6b785e12877fde7a8986bfed9d81071af8275563bbc30a10fd7e750490fc0b42de482f380e2d60f58592a3f8254a51add54c8d1c
-
Filesize
6KB
MD5458c7ea1edfd0c8ce111c61bf3e04ef8
SHA1a55e378df6f7bea75c4b7b6a169407d85a76719f
SHA256bb34c3d379fc2e358f131fb6e41148296876d81bc0356a6f38bff10e99899955
SHA5125fbf2c2db735ec0cdf94cafa66a7d14827be0979814a86eec73109f7323a31d0c8445307b286522a5f08ed4bf8542a8111d54256e3cb4331e1b33d06d04f2ec6
-
Filesize
6KB
MD5458afc4af683b22e3d3bde5221c4fa52
SHA15721fc080b19b6bd4bd88c40dc0c1f24060d43f0
SHA25638fbc0040efb375b419cfedd47de32116d14b56f31b1b718045924f4bedac86e
SHA512886eef6264ca932a86066aeedffbb44115cadbcf3bcd4a2b40966dbcaaeecf87bedff976201a3ccb36e9d969cdc0263bc704760b5d6fcd6832f302b21b1b6208
-
Filesize
7KB
MD5789185b2fa2990f6112fb492b87d62fb
SHA10ce4ab262cf0ba17cfb229d82695dadaddcb14b6
SHA2564b52cc794292fd7740e299cb2974428cf152626af7dde6c8dbaff940f2f3c1eb
SHA51235397c39eb5e7cd2b99f468784ca8d0485c81d318fd9d07c12d689edd123254a68be2b052be4e5427889a649875df5ef2ec0a514a857bd169f8e109dcc9a0ff7
-
Filesize
3KB
MD5e7781e108363f9d1a10862757c921566
SHA1d0d92cdc4bcf84a8620d3518932c0e7f027407e3
SHA25671acad098da7a6184db72080cdb7872d9d2f8a40f9e5d4e6da06652d42161d67
SHA5125e9a4bbba676638d763611703e7041a6ed3f5e55edb26b9ba92031e0b855f665d3b2ad93f266331f3785b2ee5454c2453076960aae6417b55b31b08ce41f2fe3
-
Filesize
4KB
MD57a6a1344d573a04525110d9b1b8a8f71
SHA181263f4482bc019b9235b18fd5608480aff3294e
SHA25687d9b397fdc10031f22d3eca87108a68d7570d238837f90a4071c1e540e1eb5c
SHA5129c0e63dcbd744b806a0dfb4fe986fba901e42134663036e4b414c8499c50d6c1580d575c78ea50815976ec8c1cb40f5788ee1ce79cc0641bb5bd6125813fbab1
-
Filesize
5KB
MD52a6d40860331eec2d3bb1d843de91ddc
SHA127ef234bf4b61d1f6db502b934728f42f76fc85e
SHA25665ae7c4ffe4bc92ed9a4704e56405d7684143abead73b211d1dd8b8e05252d54
SHA51217523caf9953bde4ffa86ca0608dc6183c2b23b4b6629762747e28c1fd35979bf16fcf55561e27c9dfad9fc41014e287b8cbb2c5fdff8fb4268ade4a7a933e07
-
Filesize
6KB
MD5edf700af6a542b6e241db5e5e11bf897
SHA1da69c44513c8866c4a04190b9953cd88a4361c88
SHA256ba2d7db3da7486e01b23ec90d67e655c0108dd58915a3c60224446934cdc9fb3
SHA5128992ae7b689557dc7af0bd2210b74d63d322f0c096b691304655cffcfeec8edb215f75f9380f6a9b692f3226213ee321193645501c870d4e418606e65564847e
-
Filesize
6KB
MD57b15df04d29c64ba85069a7242afe0e9
SHA18340b9a8c48d7b1f45e063586d3651c4c849a08e
SHA2561a53faa7b8cd06b244a88c362f2e3e27cb6add465b7efef8144e68dc9b333c69
SHA5128a1e5b5862bb85214e0abd0ac7751dd42825e68758fe6db1ee8a5aa7857a748977461d27fa8b8f523567be5a17578467270b06269c837b23a34cb948ef89b564
-
Filesize
7KB
MD59d75c572c79458eff420d6f47ae9b372
SHA1679d949ad2c6ef22020425d9f5be8b95227021ff
SHA25671d3c8d39ef354a8e8855c04cc304851aa2a721ccbfd87c83a41052b38f91800
SHA51206c2110a2390ff5ebdd87798f88063bc196e08fe7c2e18b1a33827deeb06c48b18ca37d6b36371f00893e30bc3eaf8db0e8f7d177297fc72468e006b9f1f7688
-
Filesize
6KB
MD53974d814ccc72b90e8cd0b7f3f21baec
SHA1c1217f8ba7d1ca606c47d4e5460371100093ce5b
SHA256809898bcac5229c8059f470934e59c9ea91140eb70008b96e34842a9e910e000
SHA512f2f48f7302596fe897d854e4c771253eb35804805b47f737c71b1ad91138f4c3598bbc99ff3cbd564ff604ece021b5b88eb8b011bc99200d234c58274ae0049a
-
Filesize
7KB
MD5687d5ce028acafb0407730f1e9a6d30f
SHA1227cef47126bcb80e43dd2841c60ad624a4ea44b
SHA256225013f6d3dbd006c2b8e6655b5fc53ff34dde5532903f63f3a3f9813d4178f2
SHA5122117672c5209cddcf0bcc561974c20e0efe9de3cd5dcbeff3d9f86e3561b1c3d61661552a56336b484705b94de348290d0e0a6194453633ac13ac75e7ad3fe7e
-
Filesize
4KB
MD50a14cb6ff5b3afaeebda776f6320f1eb
SHA12085bcf3d78f8fa674945c064d21930e2daa5586
SHA256bbde75f67016b00d3b885097e490ea74e28f5bcedef48021d32712712604da41
SHA512b0042a0cab18a49619e4e4445cfe2e7a01e2bd391a6acdd9b0892d36835cf9e9b6f08675e35a556bde2540f6b6075d54e74305829188684123d0269e1954e349
-
Filesize
7KB
MD526fe1aa919eefcf57de5d100687208f9
SHA1c56056076484d1b7fb4dbab95572083fd493a8a4
SHA256f5a75e072379f69536faf42fe628e199d591ba56409cefaf78b1c7606664fb15
SHA51233c59ae252bc573b907f1dff87f39b2e1708711a932fe1997d49ef60f427f6f6be5a71404801ecca60e4ee3f2a52b6e893a05252c0662daad82ebd266ec38ef3
-
Filesize
7KB
MD57039868d88b5d4fad4ad8360fd5e1358
SHA1b8dc295eb2d3b66fa2677bdbeeb3af368c9318d0
SHA2560a3eb13d1874b6b16de1e2871174180fa5e07e7d45ed6bc2b5e7a54e964b1b80
SHA51232295d8a84013a3cd66d1f8a508d5fe0adee96bf5eea049f1fe93a32ae63bb7dd1ab240441bc970afaab1a23c845b881b66957bfbb98f56e405584becbd73ac1
-
Filesize
7KB
MD5aafca3649e603d9ab8f2593a954574c3
SHA1ae53d9e50635451083a44637429fc9cbfdf6dbfe
SHA25621a96d10dd96309b4b696d50af4b8b37af0f611992d59fdd4bf97ad5ebae0944
SHA512341e5a99f9fc5485597d07be9d015d0295e817e19302c09d769130a2763f77cb086f77df084fc95d4181c2792d23242e526e9bbf3d67670ef49b8dd052118a40
-
Filesize
3KB
MD589d7eb723bbd4062df65187586951182
SHA1d6af7b7ca37e829544d84b619f99adc1566dca69
SHA256af648b68565f82dad53127cb56c154e30645a28da7486a2a4267300f25d9683f
SHA512cfb25046c5eb7d38de63431e21b154c46f9161127ced7eabf1c3541486e25a7c606bac7762784627f2c3b6cc5be6906b097653412967fd929e678431b68f5a28
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5e079acb0cbf9e7dc94f0c1d800229200
SHA1c430f8772de65de2a66620aaf841ae6fda1c6d61
SHA2562444cf54854e77dc9c6bba7785b1442e23f48ff551e173414b3c3e45365d2c32
SHA51225c58291bf26a46764006c8e39978f0af9a7c33c7e4d3241fb7096054172952ab21a4004e85c16161c84296ec50ee2868240152dfcd95c40de4612077c1efdaf
-
Filesize
12KB
MD5265fa23279bacdbcb9aa69f0d45e19bc
SHA16df645e485e06c6cd432c9908211f15d86c41ddb
SHA256799aeec9b9cff7fcca6fd23b2ae5d1d6cc1e42df9721674c5ff472ab130ee70c
SHA512c72e24740b0a091b1f777755169cbaeaf8a94f4a52a826b3ab89b922b61b2479a74f7edff23c178661325b91f0aaf61081bcaad34116c59d05e6deb69ec50de6
-
Filesize
12KB
MD5c4c10594bf2ffae19498ab3a4abf7d31
SHA166c755d24804f09e65fe29ae8e8fa1d690f61985
SHA256da332638a75dd3820c7b2d6a1fe61ca1688b43d09218db13b1e0de73c07157f2
SHA512f3308e9e6ebdbf75a0427dd6c99f8b2c0d085293e8da885710bc529e3cb727f5f2f53bf87b55f8be6557107d2c4c60456289bcfa863f8af364aef57d683ee325
-
Filesize
12KB
MD5c6e72decc2d3dd7147d1c6710b8cd8ae
SHA18537e8c73b33a86f30d7845bc2f2770f0c72d1d8
SHA256e405abe7bf6a747f99eecc2211615ea82514b01bb4cdfc14f4481006f8aa3a60
SHA512f2cff3a5b6c727ff7c73082c9461c8197d855794dc400abfa4a63b9e43aa96b48be2e67da0db51f004ff58d98f68dcf4ffeebf4a5549839a3430fcc8512a5bbb
-
Filesize
12KB
MD574c4aa21f32d8fb17724c19585059034
SHA1239debf9132bae796168ccc85bae1a5fa2271d66
SHA25670c8082aed00512898e679bb8d24bd13eb190f3c2167947d175abbf46bb91316
SHA5128b748ffcedc7dcef62a83953662c0cfcbd8098bff811ffb560c7092fff42bea3ee445a38110f1548c451a399a1b48628e239b14e1d7f571b337dfff35b68c848
-
Filesize
12KB
MD5472ac46ddf74054d1abb9136841b18ec
SHA17c656026c5b9760dda762e0f85807af526b60d79
SHA256862899659c861963995282cc08e5e2799a1bc0e0e99e4065dd3945d3623cd854
SHA512db78fd1e4cb1c85b583da9f5f85cb01c108937ccb3354108124e56f4daab707085a6f88e3680991802379c59e474bb1b80e159a17e68f23755272b704c158605
-
Filesize
12KB
MD5e435eb444f44a7377878a92d7e19b36b
SHA19544768d9924d457e388e92707bae4e423fef833
SHA2560460a11f90a46c210e210d8b5c08670d4a1dccac9ce16f42b9acc70009b3481a
SHA5121224ef3c1a5a843c6db86a67f55310cc228a4faedc61654aa794bfa3b15fabacb6b432877efc2917bd820f8db7ee5399528f542e17dc7e1686da2169340989a1
-
Filesize
12KB
MD5f45616b406b4acfcbf53e83f5b2228e0
SHA181e6ce24f7c1406c3117fed74512c2045f104580
SHA256db8c7d31e23509b7b72881f40e70665b1cfdf6ab1fc596f3c6113419060eea9b
SHA5126b43fe24f847c8fbd200988daefab34576ffb0de9515549ea0f4caf0ee39734192edd39d22e4c1af9c907d28708196ba6318161c132f6170284b825d8edeeee2
-
Filesize
12KB
MD5907d2a2e3ba58c8505b12d2d77e4702b
SHA1c0429ca941d072dd4e2101f669937178f19e5de0
SHA256ab226b36bd0cae48bad698b65aec9f2d1b69bc172dfc8e8e092375f7269b53e3
SHA512878914edc82f5ac5cc9cbcb2cb3e1b9c390d52dc337b00a7abdf1e2f93e5fd0f52509afcabc6913d01cf2f451cf181bd64e425b9d4dff8c6f406f32ae99e7bd8
-
Filesize
12KB
MD514792fb29437f3f33659b34a421951bf
SHA12ad8f7205ee14425c64b443da8f8685734f36ae7
SHA256939b0b3fdb52132e474271dcf4ea78c35d78e2a87a2f65168240c273ccd050f2
SHA512f2962e1977db8b1232b77ea904c726c54393143f179a4b4ee3d000a3ece4110b97d72aba8bc14609b857384ca7abb46b49db445a6b5a9067286db6d52d0a84b1
-
Filesize
64KB
MD5987a07b978cfe12e4ce45e513ef86619
SHA122eec9a9b2e83ad33bedc59e3205f86590b7d40c
SHA256f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8
SHA51239b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
Filesize
84B
MD50a5785a384660ac4a05980fb0d106d76
SHA14cce3b6f54e7803357a52976106aae6f045c72b9
SHA256b0b3c93b5237b0a95aa03abe1fa49a9bb114d693090e7adb32f849b59f86edba
SHA5125448c356931ffce51bc993bf5a5a9feeaaef7021089e69116654f7008d49875fcdec7c20f60cfb17d0d61bfa7dfec4d0b1fa7b78673a51961994b405233e298e
-
Filesize
1.8MB
MD5b42702f8d0627bcbaef4891d1ab31001
SHA1bb9fe44fbfb5b452a26c76e4f3b41d4796b6bd26
SHA2568096d3f3cca239cee5ef26f1a6616979485fb5680514dfa3736da5ab986f771a
SHA512eb3d89190f237e67a2185e963ec1c5a291a72df85bcd3937a601f5f115a6cc9ce9774eed12d81dbe714cdc99a6fddf9ff500fe0f4ab6c835d55a733e1fd33055
-
Filesize
28KB
MD51eb5b397a8a018b268cc40e6628af3b9
SHA1d25a56d87af30360893d5a84909e206005b4259c
SHA256f1b5abcae2553b087045362562f659f7def98edb1e003a1b4cb6f3a99dd5680e
SHA5123158da743f8b65c3f1af1111d28227bef3d71f9b20d42dd6f19a3123e7756c68018b0afb39975804b2f373e8da493155d9d8b0cc306d2c48f7bec5fa091a2adc
-
Filesize
126KB
MD51839b2cdf7b9a3f589cf204afa588076
SHA1cf24a4544ef3ef6f9969289b62cd99c6ceda616a
SHA25688517264611cdd0ea5270be87edae52447ee043f8a45b3e87a4b7a9238375333
SHA512cc4207306ac041f6794ae9b85a1d91c34a8ad8f504ede790414017447ef09312ef0e7812d04d028a54268109edd35c86356612a36048df2a79a8d70dd3229732
-
Filesize
36B
MD58708699d2c73bed30a0a08d80f96d6d7
SHA1684cb9d317146553e8c5269c8afb1539565f4f78
SHA256a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f
SHA51238ece3e441cc5d8e97781801d5b19bdede6065a0a50f7f87337039edeeb4a22ad0348e9f5b5542b26236037dd35d0563f62d7f4c4f991c51020552cfae03b264
-
Filesize
75KB
MD542b2c266e49a3acd346b91e3b0e638c0
SHA12bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1
SHA256adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29
SHA512770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81
-
Filesize
49KB
MD5266373fadd81120baeae3504e1654a5a
SHA11a66e205c7b0ba5cd235f35c0f2ea5f52fdea249
SHA2560798779dc944ba73c5a9ce4b8781d79f5dd7b5f49e4e8ef75020de665bad8ccb
SHA51212da48e8770dc511685fb5d843f73ef6b7e6747af021f4ba87494bba0ec341a6d7d3704f2501e2ad26822675e83fd2877467342aacdb2fd718e526dafd10506b
-
Filesize
143KB
MD58b1c352450e480d9320fce5e6f2c8713
SHA1d6bd88bf33de7c5d4e68b233c37cc1540c97bd3a
SHA2562c343174231b55e463ca044d19d47bd5842793c15954583eb340bfd95628516e
SHA5122d8e43b1021da08ed1bf5aff110159e6bc10478102c024371302ccfce595e77fd76794658617b5b52f9a50190db250c1ba486d247d9cd69e4732a768edbb4cbc
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
264KB
MD51a00b152c972f295ee7e31281fee4e31
SHA1a76e04c2334e5c23c232b144bc4a69c16e93dfbe
SHA256f56cb9eda380cacf3e67377435226d5703d373c2cff77e8648db3a2469b84a41
SHA512d1cf9484cec64204990b983a5535c21a11ecc3e65948b10caf20e6cdc771997746f7ade83552996b441fda652fc9f84781a70d24ac997de90594a734a60bc4bf
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
634B
MD58731eb83725190b0594399db53e19e9b
SHA1fd9172d4dce704893835d258b8e46757e57f87dd
SHA256ab07df9304d498cb82cc21ee3ee2fd3efc3c8f4f631919e2614a5a4566e0aa27
SHA512b6ee63537a8ab1820cd4520b31aa2c4f596e24df602c46041f92db33e25082b8c6029854ef1cbcf6deed36d4eaba5d77e78656af8e30e7034fd2e2e4bba3ac1a
-
Filesize
634B
MD5916f5bb409a2586b356846a33be310be
SHA1ae339fc73411ff7ece006e267434d431e91718f5
SHA25650897a12641977d1c83c82a22643c2efd409f11b0a5c5403c9d45f44ef332836
SHA51241f8b38e28d25d05557003a58381321a7a0b33f493e9321d5b411b82419f219ace4dac33c33c5452277cfe5f3fca6616527a0445e0f4dea91aa3c3e8fbe93ac1
-
Filesize
59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
691B
MD508f62c7f040cd4f9792a4e4081bdf0c8
SHA1ec45e583e68b273e979fb4d86ba0cd30d5e4f646
SHA256be0f43437bf4ba3a3e1144e792266d7374b1a6a6587b8c898ebf9c9c4c279cdf
SHA512dd1612e303d974b677bd6af14660c6b56eb33d63a9dbd983b3e99a92556004bbcbf86cd9f2be15e0b1165e786e4fa455f4bb8831eb6fc1856394c12c20ab93e5
-
Filesize
691B
MD562fa9a5d00a9effdbe0fd97dcafe801c
SHA1a48095105dec1ab5ec021d16cc58a047f1c9a3c6
SHA2568144eeebeba26f67612df173c5778a60ff955f8e5b5e8f8e94d1f5c09d743f1e
SHA5123a869d662a600d0857fa1a5954da590e5c9d735be06484496aa53d48c84196a7962955038abd8f585fd54e3e075a00f1374c9da4baf218998279d15a293bdcb8
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize10KB
MD538dfd280b9e2020fa570fa8d5d314ef4
SHA156daa0f7842c73ca10dfc94eeb650adf108d9429
SHA2566443c05b3b44246bce44562410e2e68f418c66dbfefda9e504e16ceb55e65365
SHA512deef7c2724aacb8e5fc6905bc8784e2cd5eeee6979ce990c511abf86f986513125632d336a9c4f9637ee942c585b7b439980409a0d1b355e7f8fb91af784ca94
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize10KB
MD54a9a5f5a8f738a557b563ea19cf2a21b
SHA1bcaa8a11593e509fde0b3c61777ef82be11917e9
SHA256485dadce1704d6d2dba3cb164cdb387b007f6d9a1bf00cf71aa3da2264cbcb02
SHA512db0e64c22fa4ac6e2d72e4361d1fcecd0f6200102a4c2701c1fd91e318086ec1c3f05cab8a18645d116468a392eef98d64f7502751085f9dc44370b09b74e752
-
C:\Users\Admin\Desktop\@[email protected]
Filesize1.4MB
MD517f24567b2e698d52fdbf43949cabd5a
SHA1f8d0ed83fd221d807e6749dd7d4fcad793721421
SHA256cdc8afa163164e81bb0c91104f6ea6859788fbe33d93dc6c0cab449b7c5ec4cc
SHA512e0b146da5ea5e95cc8be82457c39abbb0a239e623a2d6a002becbdf3e04718fc73b1c8c883960cd3cdd01b41ede80bb973a69e76061849c051912304ec3df3fc
-
Filesize
36B
MD58c534af220c6e2de8dc8662364427eac
SHA15ff0531d73ce971ddc5fde6e80700639f99574ce
SHA2563fcc3a7ff5b8273d86f9cff108bb48a7449601f70a4a4d0e19d89411aa812f85
SHA5128d8eeaa84f075696d9309e49fa47f0bcd172708721e8e8420d99286ff39ab39bdc5272bd9fa5f5aca1199552bdba4e106c6424883d52884a6764dd7dad52bde9
-
Filesize
54B
MD5606b0d057ba0a8f2520de6bc5cb872ae
SHA17ffbc6a70b16bf64c1608d75f425a67184bdf58f
SHA256e13b754e006cac590da9e5f26abc95035816347304bb0bef62d7c4c53d41b708
SHA5129e2347a4863322b637754bce498c4a7ee00c695492920b7f3240fd51f9a3cc3f6fa6973a4a9ea625c99ff79d2b8928b0f761468d8fa54d1ded6b51414787cf14
-
Filesize
68B
MD53386bdccce841938d882cfd7a155cd30
SHA14ee7a0efd17896672c57798c9d5f59f9cd2cf2ba
SHA2562779793109b88db4ddc1f399586cd37fb6d238ac89b83cb1a9e95d42241c68a2
SHA5122583970eef19a2dadc635502185d80203187c2dfeda82b84d8407f6e5a81ed2edca5121087ee72d94fae08aef4d14a71a765bdb007a257feaf13e01007948bcd
-
Filesize
93B
MD5e4f821133b798a11df61c827e289815e
SHA10cef25acc2a94c540e22062dd871597dcfd70da5
SHA2569dbbdbab1e106f5322578649b8582428f176266c5233a549a0b2da9213253741
SHA512b844622db54e59e1fea13d3ce08cae7c0329ce44eed3d7772fef5cab90c2dbd5bfc33642afd2e553c25624f2da49a50a14327e2fc715e2fe5549cd39948dfc64
-
Filesize
111B
MD5f3eeff3fabaf2bf6afd509406aafbae8
SHA1a9637c217a90dab2be93ab8bd0e332683b243d04
SHA256ff399a979951677457048a4112441f7262fbe8b69eb344592ff160259c44dd62
SHA5120b819eae0cc382da3110434c43c097a5d148938865ece160d3da660a5d00c4e26efb98b08b6385d8194cf1fa74e04f432ff231d65e3116a0d75cd0df519b9450
-
Filesize
3.6MB
MD5698ddcaec1edcf1245807627884edf9c
SHA1c7fcbeaa2aadffaf807c096c51fb14c47003ac20
SHA256cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b
SHA512a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\!Please Read Me!.txt
Filesize797B
MD5afa18cf4aa2660392111763fb93a8c3d
SHA1c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA256227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
SHA5124161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]
Filesize933B
MD57e6b6da7c61fcb66f3f30166871def5b
SHA100f699cf9bbc0308f6e101283eca15a7c566d4f9
SHA2564a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e
SHA512e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\@[email protected]
Filesize240KB
MD57bf2b57f2a205768755c07f238fb32cc
SHA145356a9dd616ed7161a3b9192e2f318d0ab5ad10
SHA256b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
SHA51291a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\TaskData\Tor\taskhsvc.exe
Filesize3.0MB
MD5fe7eb54691ad6e6af77f8a9a0b6de26d
SHA153912d33bec3375153b7e4e68b78d66dab62671a
SHA256e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb
SHA5128ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\msg\m_finnish.wnry
Filesize37KB
MD535c2f97eea8819b1caebd23fee732d8f
SHA1e354d1cc43d6a39d9732adea5d3b0f57284255d2
SHA2561adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
SHA512908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf
-
Filesize
236KB
MD5cf1416074cd7791ab80a18f9e7e219d9
SHA1276d2ec82c518d887a8a3608e51c56fa28716ded
SHA25678e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA5120bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5
-
Filesize
411KB
MD504251a49a240dbf60975ac262fc6aeb7
SHA1e211ca63af2ab85ffab1e5fbbdf28a4ef8f77de0
SHA25685a58aa96dccd94316a34608ba996656a22c8158d5156b6e454d9d69e6ff38c3
SHA5123422a231e1dadb68d3567a99d46791392ecf5883fd3bbc2cae19a595364dac46e4b2712db70b61b488937d906413d39411554034ffd3058389700a93c17568d2
-
Filesize
381KB
MD535a27d088cd5be278629fae37d464182
SHA1d5a291fadead1f2a0cf35082012fe6f4bf22a3ab
SHA2564a75f2db1dbd3c1218bb9994b7e1c690c4edd4e0c1a675de8d2a127611173e69
SHA512eb0be3026321864bd5bcf53b88dc951711d8c0b4bcbd46800b90ca5116a56dba22452530e29f3ccbbcc43d943bdefc8ed8ca2d31ba2e7e5f0e594f74adba4ab5
-
Filesize
719KB
MD58cd4d4694ee2081c3774ca2fd0a9a00a
SHA1a1b3d37b701f05b27b16db98a1a2a5556ae4b08d
SHA25692b0f72aaddb0ada97c7ae998f8343c3d2128d7681f6fb9fd87214f6cc3f19a2
SHA51204a4e993120ae88c14d5fd538fe1d346c594bcc2bad4136ecc16a0d9b16e61ba8b286801e819c1637eaab12342c90cb09cb705e0a99ec13920715bbf2f95a850
-
C:\Users\Default\Desktop\@[email protected]
Filesize1.4MB
MD5c17170262312f3be7027bc2ca825bf0c
SHA1f19eceda82973239a1fdc5826bce7691e5dcb4fb
SHA256d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
SHA512c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c
-
Filesize
153KB
MD5f33a4e991a11baf336a2324f700d874d
SHA19da1891a164f2fc0a88d0de1ba397585b455b0f4
SHA256a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7
SHA512edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20