Overview

overview

10

Static

static

1

python-3.1...64.exe

windows10-1703-x64

4

python-3.1...64.exe

windows10-2004-x64

10

python-3.1...64.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    1200s
  • max time network
    1202s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    28-08-2024 01:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    python-3.12.5-amd64.exe

  • Size

    25.3MB

  • MD5

    bbcb2fcf9d739f776fb6414afc12c80d

  • SHA1

    2d78877db5a8da134ab54ed952b961a7e750ec7d

  • SHA256

    44810512af577ca70b3269b8570b10825ec2ace2b86e4297e767a0f4c0ee8bfd

  • SHA512

    0572c6345f6a4f7f3e5c2ff858e3ca7ca54ae4478f3d59d8e18cb0f596e61dcf12aef579db229e83d63b30f15d6684ee6bb3feaea9413e5e636a503933057678

  • SSDEEP

    786432:jKEO2c6viGKJXI95MB6K3qtY9a3YiVTfwtzWo2CB8:XHiRuVKCY9a3YiRws6B8

Score
10/10
cerberwannacrydefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwareworm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\_R_E_A_D___T_H_I_S___MUA3_.txt

Family

cerber

Ransom Note
CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/6C8D-FEB3-7865-0446-9329 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/6C8D-FEB3-7865-0446-9329 2. http://p27dokhpz2n7nvgr.14ewqv.top/6C8D-FEB3-7865-0446-9329 3. http://p27dokhpz2n7nvgr.14vvrc.top/6C8D-FEB3-7865-0446-9329 4. http://p27dokhpz2n7nvgr.129p1t.top/6C8D-FEB3-7865-0446-9329 5. http://p27dokhpz2n7nvgr.1apgrn.top/6C8D-FEB3-7865-0446-9329 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----
URLs

http://p27dokhpz2n7nvgr.onion/6C8D-FEB3-7865-0446-9329

http://p27dokhpz2n7nvgr.12hygy.top/6C8D-FEB3-7865-0446-9329

http://p27dokhpz2n7nvgr.14ewqv.top/6C8D-FEB3-7865-0446-9329

http://p27dokhpz2n7nvgr.14vvrc.top/6C8D-FEB3-7865-0446-9329

http://p27dokhpz2n7nvgr.129p1t.top/6C8D-FEB3-7865-0446-9329

http://p27dokhpz2n7nvgr.1apgrn.top/6C8D-FEB3-7865-0446-9329

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___3UEEQ5V_.hta

Family

cerber

Ransom Note
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>C&#069;&#82;BE&#82; &#82;ANSOMWA&#82;&#069;: Instructi&#111;ns</title> <HTA:APPLICATION APPLICATIONNAME="r29WXN95eQ" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style type="text/css"> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 13pt; line-height: 19pt; } body, h1 { margin: 0; padding: 0; } hr { color: #bda; height: 2pt; margin: 1.5%; } h1 { color: #555; font-size: 14pt; } ol { padding-left: 2.5%; } ol li { padding-bottom: 13pt; } small { color: #555; font-size: 11pt; } ul { list-style-type: none; margin: 0; padding: 0; } .button { color: #04a; cursor: pointer; } .button:hover { text-decoration: underline; } .container { background-color: #fff; border: 2pt solid #c7c7c7; margin: 5%; min-width: 850px; padding: 2.5%; } .header { border-bottom: 2pt solid #c7c7c7; margin-bottom: 2.5%; padding-bottom: 2.5%; } .h { display: none; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .info { background-color: #efe; border: 2pt solid #bda; display: inline-block; padding: 1.5%; text-align: center; } .updating { color: red; display: none; padding-left: 35px; background: url("data:image/gif;base64,R0lGODlhGQAZAKIEAMzMzJmZmTMzM2ZmZgAAAAAAAAAAAAAAACH/C05FVFNDQVBFMi4wAwEAAAAh+QQFAAAEACwAAAAAGQAZAAADVki63P4wSEiZvLXemRf4yhYoQ0l9aMiVLISCDms+L/DIwwnfc+c3qZ9g6Hn5hkhF7YgUKI2dpvNpExJ/WKquSoMCvd9geDeuBpcuGFrcQWep5Df7jU0AACH5BAUAAAQALAoAAQAOABQAAAMwSLDU/iu+Gdl0FbTAqeXg5YCdSJCBuZVqKw5wC8/qHJv2IN+uKvytn9AnFBCHx0cCACH5BAUAAAQALAoABAAOABQAAAMzSLoEzrC5F9Wk9YK6Jv8gEYzgaH4myaVBqYbfIINyHdcDI+wKniu7YG+2CPI4RgFI+EkAACH5BAUAAAQALAQACgAUAA4AAAMzSLrcBNDJBeuUNd6WwXbWtwnkFZwMqUpnu6il06IKLChDrsxBGufAHW0C1IlwxeMieEkAACH5BAUAAAQALAEACgAUAA4AAAM0SLLU/lAtFquctk6aIe5gGA1kBpwPqVZn66hl1KINPDRB3sxAGufAHc0C1IkIxcARZ4QkAAAh+QQFAAAEACwBAAQADgAUAAADMUhK0vurSfiko8oKHC//yyCCYvmVI4cOZAq+UCCDcv3VM4cHCuDHOZ/wI/xxigDQMAEAIfkEBQAABAAsAQABAA4AFAAAAzNIuizOkLgZ13xraHVF1puEKWBYlUP1pWrLBLALz+0cq3Yg324PAUAXcNgaBlVGgPAISQAAIfkEBQAABAAsAQABABQADgAAAzRIujzOMBJHpaXPksAVHoogMlzpZWK6lF2UjgobSK9AtjSs7QTg8xCfELgQ/og9I1IxXCYAADs=") left no-repeat; } #change_language { float: right; } #change_language, #texts div { display: none; } </style> </head> <body> <div class="container"> <div class="header"> <a id="change_language" href="#" onclick="return changeLanguage1();" title="English">&#9745; English</a> <h1>C&#069;&#82;BE&#82; &#82;ANSOMWA&#82;&#069;</h1> <small id="title">Instructions</small> </div> <div id="languages"> <p>&#9745; Select your language</p> <ul> <li><a href="#" title="English" onclick="return sh_bl('en');">English</a></li> <li><a href="#" title="Arabic" onclick="return sh_bl('ar');">العربية</a></li> <li><a href="#" title="Chinese" onclick="return sh_bl('zh');">中文</a></li> <li><a href="#" title="Dutch" onclick="return sh_bl('nl');">Nederlands</a></li> <li><a href="#" title="French" onclick="return sh_bl('fr');">Français</a></li> <li><a href="#" title="German" onclick="return sh_bl('de');">Deutsch</a></li> <li><a href="#" title="Italian" onclick="return sh_bl('it');">Italiano</a></li> <li><a href="#" title="Japanese" onclick="return sh_bl('ja');">日本語</a></li> <li><a href="#" title="Korean" onclick="return sh_bl('ko');">한국어</a></li> <li><a href="#" title="Polish" onclick="return sh_bl('pl');">Polski</a></li> <li><a href="#" title="Portuguese" onclick="return sh_bl('pt');">Português</a></li> <li><a href="#" title="Spanish" onclick="return sh_bl('es');">Español</a></li> <li><a href="#" title="Turkish" onclick="return sh_bl('tr');">Türkçe</a></li> </ul> </div> <div id="texts"> <div id="en"> <p>Can't yo<span class="h">SXaCp</span>u find the necessary files?<br>Is the c<span class="h">JAgeitqw6s</span>ontent of your files not readable?</p> <p>It is normal be<span class="h">eP</span>cause the files' names and the data in your files have been encryp<span class="h">Be5</span>ted by "Ce<span class="h">qS</span>r&#98;er&nbsp;Rans&#111;mware".</p> <p>It me<span class="h">DsyWE</span>ans your files are NOT damage<span class="h">H</span>d! Your files are modified only. This modification is reversible.<br>F<span class="h">LI1Na3Z</span>rom now it is not poss<span class="h">9ac8</span>ible to use your files until they will be decrypted.</p> <p>The only way to dec<span class="h">v1D</span>rypt your files safely is to &#98;uy the special decryption software "C<span class="h">JaPp</span>er&#98;er&nbsp;Decryptor".</p> <p>Any attempts to rest<span class="h">ktBqvnF</span>ore your files with the thir<span class="h">glulHC</span>d-party software will be fatal for your files!</p> <hr> <p class="w331208">You can proc<span class="h">v1</span>eed with purchasing of the decryption softw<span class="h">At9c</span>are at your personal page:</p> <p><span class="info"><span class="updating">Ple<span class="h">JeEG9bO</span>ase wait...</span><a class="url" href="http://p27dokhpz2n7nvgr.12hygy.top/6C8D-FEB3-7865-0446-9329" target="_blank">http://p27dokhpz2n7nvgr.12hygy.top/6C8D-FEB3-7865-0446-9329</a><hr><a href="http://p27dokhpz2n7nvgr.14ewqv.top/6C8D-FEB3-7865-0446-9329" target="_blank">http://p27dokhpz2n7nvgr.14ewqv.top/6C8D-FEB3-7865-0446-9329</a><hr><a href="http://p27dokhpz2n7nvgr.14vvrc.top/6C8D-FEB3-7865-0446-9329" target="_blank">http://p27dokhpz2n7nvgr.14vvrc.top/6C8D-FEB3-7865-0446-9329</a><hr><a href="http://p27dokhpz2n7nvgr.129p1t.top/6C8D-FEB3-7865-0446-9329" target="_blank">http://p27dokhpz2n7nvgr.129p1t.top/6C8D-FEB3-7865-0446-9329</a><hr><a href="http://p27dokhpz2n7nvgr.1apgrn.top/6C8D-FEB3-7865-0446-9329" target="_blank">http://p27dokhpz2n7nvgr.1apgrn.top/6C8D-FEB3-7865-0446-9329</a></span></p> <p>If t<span class="h">lwQbkbhiI</span>his page cannot be opened &nbsp;<span class="button" onclick="return _url_upd_('en');">cli<span class="h">dst7UXB5i</span>ck here</span>&nbsp; to get a new addr<span class="h">npO</span>ess of your personal page.<br><br>If the addre<span class="h">8k9</span>ss of your personal page is the same as befo<span class="h">14rCurwD</span>re after you tried to get a new one,<br>you c<span class="h">1Zenc</span>an try to get a new address in one hour.</p> <p>At th<span class="h">X1a9ggC</span>is p&#097;ge you will receive the complete instr<span class="h">BiL3TnX1F</span>uctions how to buy the decrypti<span class="h">ZeKjhpo3</span>on software for restoring all your files.</p> <p>Also at this p&#097;ge you will be able to res<span class="h">WDXFRrU0</span>tore any one file for free to be sure "Cer&#98;e<span class="h">V8d</span>r&nbsp;Decryptor" will help you.</p> <hr> <p>If your per<span class="h">E5SW7</span>sonal page is not availa<span class="h">6fkGlb</span>ble for a long period there is another way to open your personal page - insta<span class="h">6ijHYE8qx</span>llation and use of Tor&nbsp;Browser:</p> <ol> <li>run your Inte<span class="h">JyFJH</span>rnet browser (if you do not know wh&#097;t it is run the Internet&nbsp;Explorer);</li> <li>ent<span class="h">K3A3m</span>er or copy the &#097;ddress <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/downlo&#097;d/download-easy.html.en</a> into the address bar of your browser &#097;nd press ENTER;</li> <li>wait for the site load<span class="h">yBQKXfGT92</span>ing;</li> <li>on the site you will be offered to do<span class="h">kISh</span>wnload Tor&nbsp;Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>ru<span class="h">ZC7</span>n Tor&nbsp;Browser;</li> <li>connect with the butt<span class="h">1AGMC</span>on "Connect" (if you use the English version);</li> <li>a normal Internet bro<span class="h">nwHfQ</span>wser window will be opened &#097;fter the initialization;</li> <li>type or copy the add<span class="h">hc</span>ress <br><span class="info">http://p27dokhpz2n7nvgr.onion/6C8D-FEB3-7865-0446-9329</span><br> in this browser address bar;</li> <li>pre<span class="h">Ft</span>ss ENTER;</li> <li>the site sho<span class="h">K4Kox1</span>uld be loaded; if for some reason the site is not lo<span class="h">HE2P44xj</span>ading wait for a moment and try again.</li> </ol> <p>If you have any pr<span class="h">akKxBvHbC6</span>oblems during installation or use of Tor&nbsp;Browser, please, visit <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> and type request in the searc<span class="h">eU0z</span>h bar "Install Tor&nbsp;Browser Windows" and you will find a lot of training videos about Tor&nbsp;Browser installation and use.</p> <hr> <p><strong>Addit<span class="h">gXYLYTy</span>ional information:</strong></p> <p>You will fi<span class="h">Gb4LtouZX</span>nd the instru<span class="h">dz6mVYIE</span>cti&#111;ns ("*_READ_THIS_FILE_*.hta") for re<span class="h">abXY5jmpr</span>st&#111;ring y&#111;ur files in &#097;ny f<span class="h">UzUY4d6kW</span>&#111;lder with your enc<span class="h">iLBafBCauW</span>rypted files.</p> <p>The instr<span class="h">QW73fYDg</span>ucti&#111;ns "*_READ_THIS_FILE_*.hta" in the f<span class="h">HCcF2Fov</span>&#111;lder<span class="h">zU</span>s with your encry<span class="h">OL8</span>pted files are not vir<span class="h">q</span>uses! The instruc<span class="h">tr</span>tions "*_READ_THIS_FILE_*.hta" will he<span class="h">8AXJp</span>lp you to dec<span class="h">1</span>rypt your files.</p> <p>Remembe<span class="h">ts</span>r! The w&#111;rst si<span class="h">5vn1</span>tu&#097;tion already happ<span class="h">p9Vm</span>ened and n&#111;w the future of your files de<span class="h">6</span>pends on your determ<span class="h">VVuN</span>ination and speed of your actions.</p> </div> <div id="ar" style="direction: rtl;"> <p>لا يمكنك العثور على الملفات الضرورية؟<br>هل محتوى الملفات غير قابل للقراءة؟</p> <p>هذا أمر طبيعي لأن أسماء الملفات والبيانات في الملفات قد تم تشفيرها بواسطة "Cer&#98;er&nbsp;Rans&#111;mware".</p> <p>وهذا يعني أن الملفات الخاصة بك ليست تالفة! فقد تم تعديل ملفاتك فقط. ويمكن التراجع عن هذا.<br>ومن الآن فإنه لا يكن استخدام الملفات الخاصة بك حتى يتم فك تشفيرها.</p> <p>الطريقة الوحيدة لفك تشفير ملفاتك بأمان هو أن تشتري برنامج فك التشفير المتخصص "Cer&#98;er&nbsp;Decryptor".</p> <p>إن أية محاولات لاستعادة الملفات الخاصة بك بواسطة برامج من طرف ثالث سوف تكون مدمرة لملفاتك!</p> <hr> <p>يمكنك الشروع في شراء برنامج فك التشفير من صفحتك الشخصية:</p> <p><span class="info"><span class="updating">أرجو الإنتظار...</span><a class="url" href="http://p27dokhpz2n7nvgr.12hygy.top/6C8D-FEB3-7865-0446-9329" target="_blank">http://p27dokhpz2n7nvgr.12hygy.top/6C8D-FEB3-7865-0446-9329</a><hr><a href="http://p27dokhpz2n7nvgr.14ewqv.top/6C8D-FEB3-7865-0446-9329" target="_blank">http://p27dokhpz2n7nvgr.14ewqv.top/6C8D-FEB3-7865-0446-9329</a><hr><a href="http://p27dokhpz2n7nvgr.14vvrc.top/6C8D-FEB3-7865-0446-9329" target="_blank">http://p27dokhpz2n7nvgr.14vvrc.top/6C8D-FEB3-7865-0446-9329</a><hr><a href="http://p27dokhpz2n7nvgr.129p1t.top/6C8D-FEB3-7865-0446-9329" target="_blank">http://p27dokhpz2n7nvgr.129p1t.top/6C8D-FEB3-7865-0446-9329</a><hr><a href="http://p27dokhpz2n7nvgr.1apgrn.top/6C8D-FEB3-7865-0446-9329" target="_blank">http://p27dokhpz2n7nvgr.1apgrn.top/6C8D-FEB3-7865-0446-9329</a></span></p> <p>في حالة تعذر فتح هذه الصفحة &nbsp;<span class="button" onclick="return _url_upd_('ar');">انقر هنا</span>&nbsp; لإنشاء عنوان جديد لصفحتك الشخصية.</p> <p>في هذه الصفحة سوف تتلقى تعليمات كاملة حول كيفية شراء برنامج فك التشفير لاستعادة جميع الملفات الخاصة بك.</p> <p>في هذه الصفحة أيضًا سوف تتمكن من استعادة ملف واحد بشكل مجاني للتأكد من أن "Cer&#98;er&nbsp;Decryptor" سوف يساعدك.</p> <hr> <p>إذا كانت صفحتك الشخصية غير متاحة لفترة طويلة فإن ثمّة طريقة أخرى لفتح صفحتك الشخصية - تحميل واستخدام متصفح Tor:</p> <ol> <li>قم بتشغيل متصفح الإنترنت الخاص بك (إذا كنت لا تعرف ما هو قم بتشغيل إنترنت إكسبلورر);</li> <li>قم بكتابة أو نسخ العنوان <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> إلى شريط العنوان في المستعرض الخاص بك ثم اضغط ENTER;</li> <li>انتظر لتحميل الموقع;</li> <li>سوف يعرض عليك الموقع تحميل متصفح Tor. قم بتحميله وتشغيله، واتبع تعليمات التثبيت، وانتظر حتى اكتمال التثبيت;</li> <li>قم بتشغيل متصفح Tor;</li> <li>اضغط على الزر "Connect" (إذا كنت تستخدم النسخة الإنجليزية);</li> <li>سوف تُفتح نافذة متصفح الإنترنت العادي بعد البدء;</li> <li>قم بكتابة أو نسخ العنوان <br><span class="info">http://p27dokhpz2n7nvgr.onion/6C8D-FEB3-7865-0446-9329</span><br> في شريط العنوان في المتصفح;</li> <li>اضغط ENTER;</li> <li>يجب أن يتم تحميل الموقع؛ إذا لم يتم تحميل الموقع لأي سبب، انتظر للحظة وحاول مرة أخرى.</li> </ol> <p>إذا كان لديك أية مشكلات أثناء عملية التثبيت أو استخدام متصفح Tor، يُرجى زيارة <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> واكتب الطلب "install tor browser windows" أو "تثبيت نوافذ متصفح Tor" في شريط البحث، وسوف تجد الكثير من أشرطة الفيديو للتدريب حول تثبيت متصفح Tor واستخدامه.</p> <hr> <p><strong>معلومات إض<span class="h">vYvpiSn</span>افية:</strong></p> <p>س<span class="h">eyn</span>وف تجد إرشادات استعادة الملفات الخاصة بك ("*_READ_THIS_FILE_*") في أي مجلد مع ملفاتك المشفرة.</p> <p>الإرش<span class="h">7gYX9XS5</span>ادات ("*_READ_THIS_FILE_*") الموجودة في المجلدات مع ملفاتك المشفرة ليست فيروسات والإرشادات ("*_READ_THIS_FILE_*") سوف تساعدك على فك تشفير الملفات الخاصة بك.</p> <p>تذكر أن أسوأ مو<span class="h">hgjcNTzr</span>قف قد حدث بالفعل، والآن مستقبل ملفاتك يعتمد على عزيمتك وسرعة الإجراءات الخاصة بك.</p> </div> <div id="zh"> <p>您找不到所需的文件？<br>您文件的内容无法阅读？</p> <p>这是正常的，因为您文件的文件名和数据已经被“Cer&#98;er&nbsp;Rans&#111;mware”加密了。</p> <p>这意味着您的文件并没有损坏！您的文件只是被修改了，这

Extracted

Path

C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Signatures

  • Cerber

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

    ransomwarecerber
  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Contacts a large (1145) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Drops startup file 5 IoCs
  • Modifies file permissions 1 TTPs 3 IoCs
    discovery
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Downloads MZ/PE file
  • Drops desktop.ini file(s) 2 IoCs
  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Drops file in System32 directory 38 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 3 IoCs
    ransomware
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 20 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 18 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 57 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • NSIS installer 2 IoCs
    installer
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 37 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • NTFS ADS 20 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\python-3.12.5-amd64.exe
    "C:\Users\Admin\AppData\Local\Temp\python-3.12.5-amd64.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Windows\Temp\{A611869F-153D-4428-9107-8B5B8891EF1E}\.cr\python-3.12.5-amd64.exe
      "C:\Windows\Temp\{A611869F-153D-4428-9107-8B5B8891EF1E}\.cr\python-3.12.5-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python-3.12.5-amd64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=572
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2924
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8d5d63cb8,0x7ff8d5d63cc8,0x7ff8d5d63cd8
      2⤵
        PID:1032
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
        2⤵
          PID:2932
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2304
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
          2⤵
            PID:4444
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
            2⤵
              PID:4460
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
              2⤵
                PID:3176
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
                2⤵
                  PID:1520
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
                  2⤵
                    PID:3316
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
                    2⤵
                      PID:3984
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4536
                    • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2980
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
                      2⤵
                        PID:3020
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
                        2⤵
                          PID:1988
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5484 /prefetch:8
                          2⤵
                            PID:2468
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4728 /prefetch:8
                            2⤵
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            PID:492
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
                            2⤵
                              PID:1232
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
                              2⤵
                                PID:1476
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
                                2⤵
                                  PID:1200
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
                                  2⤵
                                    PID:3736
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
                                    2⤵
                                      PID:5052
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1240 /prefetch:1
                                      2⤵
                                        PID:3348
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
                                        2⤵
                                          PID:2160
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
                                          2⤵
                                            PID:5176
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:8
                                            2⤵
                                            • NTFS ADS
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5268
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3880 /prefetch:2
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3636
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
                                            2⤵
                                              PID:5604
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:8
                                              2⤵
                                              • NTFS ADS
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5624
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
                                              2⤵
                                                PID:6064
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6420 /prefetch:8
                                                2⤵
                                                • NTFS ADS
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:6080
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
                                                2⤵
                                                  PID:3184
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 /prefetch:8
                                                  2⤵
                                                  • NTFS ADS
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4896
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
                                                  2⤵
                                                    PID:2368
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6336 /prefetch:8
                                                    2⤵
                                                    • NTFS ADS
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:1512
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:1
                                                    2⤵
                                                      PID:5244
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1548 /prefetch:8
                                                      2⤵
                                                      • NTFS ADS
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5900
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
                                                      2⤵
                                                        PID:5344
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6460 /prefetch:8
                                                        2⤵
                                                        • NTFS ADS
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2980
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
                                                        2⤵
                                                          PID:3160
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6272 /prefetch:8
                                                          2⤵
                                                          • NTFS ADS
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:3164
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
                                                          2⤵
                                                            PID:472
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7108 /prefetch:8
                                                            2⤵
                                                            • NTFS ADS
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:6084
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1
                                                            2⤵
                                                              PID:2444
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6376 /prefetch:8
                                                              2⤵
                                                              • NTFS ADS
                                                              PID:5212
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
                                                              2⤵
                                                                PID:5632
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6976 /prefetch:8
                                                                2⤵
                                                                • NTFS ADS
                                                                PID:5460
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
                                                                2⤵
                                                                  PID:2020
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3752 /prefetch:8
                                                                  2⤵
                                                                  • NTFS ADS
                                                                  PID:2196
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
                                                                  2⤵
                                                                    PID:2696
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 /prefetch:8
                                                                    2⤵
                                                                    • NTFS ADS
                                                                    PID:5148
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:1
                                                                    2⤵
                                                                      PID:3952
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2672 /prefetch:8
                                                                      2⤵
                                                                      • NTFS ADS
                                                                      PID:5200
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
                                                                      2⤵
                                                                        PID:2524
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4052 /prefetch:8
                                                                        2⤵
                                                                        • NTFS ADS
                                                                        PID:1052
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
                                                                        2⤵
                                                                          PID:948
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1852,16631889122562497733,13463064500333173763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1248 /prefetch:8
                                                                          2⤵
                                                                          • NTFS ADS
                                                                          PID:5724
                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                        1⤵
                                                                          PID:720
                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                          1⤵
                                                                            PID:2420
                                                                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe
                                                                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe" -ServerName:WebExperienceHost.AppXpahb3h9jz84zbzgmz4ndmjv3nas4ah73.mca
                                                                            1⤵
                                                                            • Modifies Internet Explorer settings
                                                                            • Modifies data under HKEY_USERS
                                                                            • Modifies registry class
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:2192
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                                            1⤵
                                                                              PID:1300
                                                                            • C:\Windows\system32\BackgroundTransferHost.exe
                                                                              "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
                                                                              1⤵
                                                                              • Modifies registry class
                                                                              PID:3184
                                                                            • C:\Windows\system32\AUDIODG.EXE
                                                                              C:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004C8
                                                                              1⤵
                                                                                PID:5168
                                                                              • C:\Windows\System32\rundll32.exe
                                                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                1⤵
                                                                                  PID:5184
                                                                                • C:\Users\Admin\Downloads\Ransomware.Mamba\131.exe
                                                                                  "C:\Users\Admin\Downloads\Ransomware.Mamba\131.exe"
                                                                                  1⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:4176
                                                                                • C:\Users\Admin\Downloads\Ransomware.Cerber\cerber.exe
                                                                                  "C:\Users\Admin\Downloads\Ransomware.Cerber\cerber.exe"
                                                                                  1⤵
                                                                                  • Drops startup file
                                                                                  • Drops file in System32 directory
                                                                                  • Sets desktop wallpaper using registry
                                                                                  • Drops file in Program Files directory
                                                                                  • Drops file in Windows directory
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:3536
                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                    C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
                                                                                    2⤵
                                                                                    • Modifies Windows Firewall
                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:724
                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                    C:\Windows\system32\netsh.exe advfirewall reset
                                                                                    2⤵
                                                                                    • Modifies Windows Firewall
                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:5792
                                                                                  • C:\Windows\SysWOW64\mshta.exe
                                                                                    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___NRL6OOC_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                                                                                    2⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:2068
                                                                                  • C:\Windows\SysWOW64\NOTEPAD.EXE
                                                                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___NTAHNPS_.txt
                                                                                    2⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Opens file in notepad (likely ransom note)
                                                                                    PID:1368
                                                                                    • C:\Windows\notepad.exe
                                                                                      "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                      3⤵
                                                                                        PID:4724
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1096
                                                                                        3⤵
                                                                                        • Program crash
                                                                                        PID:2160
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\system32\cmd.exe"
                                                                                      2⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1200
                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                        taskkill /f /im "cerber.exe"
                                                                                        3⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Kills process with taskkill
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2424
                                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                                        ping -n 1 127.0.0.1
                                                                                        3⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                        • Runs ping.exe
                                                                                        PID:5200
                                                                                  • C:\Users\Admin\Downloads\Ransomware.Petrwrap\svchost.exe
                                                                                    "C:\Users\Admin\Downloads\Ransomware.Petrwrap\svchost.exe"
                                                                                    1⤵
                                                                                    • Drops startup file
                                                                                    • Drops desktop.ini file(s)
                                                                                    • Drops file in Windows directory
                                                                                    • NTFS ADS
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:1172
                                                                                  • C:\Windows\SysWOW64\werfault.exe
                                                                                    werfault.exe /h /shared Global\e0b574337c6b46e3a3f6b856ddf5a297 /t 5712 /p 2068
                                                                                    1⤵
                                                                                      PID:6088
                                                                                    • C:\Users\Admin\Downloads\Ransomware.Unnamed_0\Ransomware.Unnamed_0.exe
                                                                                      "C:\Users\Admin\Downloads\Ransomware.Unnamed_0\Ransomware.Unnamed_0.exe"
                                                                                      1⤵
                                                                                      • Drops startup file
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • NTFS ADS
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:5132
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\23dgkr5k\23dgkr5k.cmdline"
                                                                                        2⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:3980
                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF5B.tmp" "c:\Users\Admin\AppData\Local\Temp\23dgkr5k\CSC560B78A8BA1B450782D63698A62F6573.TMP"
                                                                                          3⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:4936
                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
                                                                                        2⤵
                                                                                        • Adds Run key to start application
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:3920
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1368 -ip 1368
                                                                                      1⤵
                                                                                        PID:2176
                                                                                      • C:\Users\Admin\Downloads\Ransomware.WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                                                                        "C:\Users\Admin\Downloads\Ransomware.WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
                                                                                        1⤵
                                                                                        • Drops startup file
                                                                                        • Sets desktop wallpaper using registry
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:3400
                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                          attrib +h .
                                                                                          2⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Views/modifies file attributes
                                                                                          PID:5020
                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                          icacls . /grant Everyone:F /T /C /Q
                                                                                          2⤵
                                                                                          • Modifies file permissions
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:1052
                                                                                        • C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
                                                                                          taskdl.exe
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:3068
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c 293541724809462.bat
                                                                                          2⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:1512
                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                            cscript.exe //nologo m.vbs
                                                                                            3⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:412
                                                                                            • C:\Windows\notepad.exe
                                                                                              "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                              4⤵
                                                                                                PID:3580
                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                            attrib +h +s F:\$RECYCLE
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Views/modifies file attributes
                                                                                            PID:828
                                                                                          • C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
                                                                                            @[email protected] co
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:7156
                                                                                            • C:\Users\Admin\Downloads\Ransomware.WannaCry\TaskData\Tor\taskhsvc.exe
                                                                                              TaskData\Tor\taskhsvc.exe
                                                                                              3⤵
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:4456
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            cmd.exe /c start /b @[email protected] vs
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:3976
                                                                                            • C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
                                                                                              @[email protected] vs
                                                                                              3⤵
                                                                                              • Executes dropped EXE
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:4856
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                                                                                4⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:5508
                                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                  wmic shadowcopy delete
                                                                                                  5⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:6556
                                                                                          • C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
                                                                                            taskdl.exe
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:6896
                                                                                          • C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
                                                                                            taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:6940
                                                                                          • C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
                                                                                            @[email protected]
                                                                                            2⤵
                                                                                            • Sets desktop wallpaper using registry
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:6948
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "zlhkxyme508" /t REG_SZ /d "\"C:\Users\Admin\Downloads\Ransomware.WannaCry\tasksche.exe\"" /f
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:6952
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "zlhkxyme508" /t REG_SZ /d "\"C:\Users\Admin\Downloads\Ransomware.WannaCry\tasksche.exe\"" /f
                                                                                              3⤵
                                                                                              • Adds Run key to start application
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Modifies registry key
                                                                                              PID:7040
                                                                                          • C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
                                                                                            taskdl.exe
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:5756
                                                                                          • C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
                                                                                            taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2852
                                                                                          • C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
                                                                                            @[email protected]
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:1664
                                                                                          • C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
                                                                                            taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:6720
                                                                                          • C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
                                                                                            taskdl.exe
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:6668
                                                                                          • C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
                                                                                            @[email protected]
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:6532
                                                                                          • C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
                                                                                            taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:5304
                                                                                          • C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
                                                                                            @[email protected]
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:1928
                                                                                          • C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
                                                                                            taskdl.exe
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2900
                                                                                          • C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
                                                                                            taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2496
                                                                                          • C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
                                                                                            @[email protected]
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:6244
                                                                                          • C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
                                                                                            taskdl.exe
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:4332
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 412 -ip 412
                                                                                          1⤵
                                                                                            PID:4264
                                                                                          • C:\Users\Admin\Downloads\Ransomware.WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                                                                            "C:\Users\Admin\Downloads\Ransomware.WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
                                                                                            1⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:5608
                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                              attrib +h .
                                                                                              2⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Views/modifies file attributes
                                                                                              PID:6288
                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                              icacls . /grant Everyone:F /T /C /Q
                                                                                              2⤵
                                                                                              • Modifies file permissions
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:6296
                                                                                          • C:\Windows\sysWOW64\wbem\wmiprvse.exe
                                                                                            C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
                                                                                            1⤵
                                                                                              PID:6640
                                                                                            • C:\Windows\system32\vssvc.exe
                                                                                              C:\Windows\system32\vssvc.exe
                                                                                              1⤵
                                                                                                PID:6728
                                                                                              • C:\Users\Admin\Downloads\Ransomware.WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                                                                                "C:\Users\Admin\Downloads\Ransomware.WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
                                                                                                1⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:6996
                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                  attrib +h .
                                                                                                  2⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Views/modifies file attributes
                                                                                                  PID:5912
                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                  icacls . /grant Everyone:F /T /C /Q
                                                                                                  2⤵
                                                                                                  • Modifies file permissions
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:5484
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
                                                                                                1⤵
                                                                                                • Enumerates system info in registry
                                                                                                • NTFS ADS
                                                                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                PID:7036
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8d5d63cb8,0x7ff8d5d63cc8,0x7ff8d5d63cd8
                                                                                                  2⤵
                                                                                                    PID:1348
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
                                                                                                    2⤵
                                                                                                      PID:1056
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
                                                                                                      2⤵
                                                                                                        PID:5876
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
                                                                                                        2⤵
                                                                                                          PID:6564
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:5112
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:1948
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:2524
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:5868
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3556 /prefetch:8
                                                                                                                  2⤵
                                                                                                                    PID:6796
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:3684
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4848 /prefetch:8
                                                                                                                      2⤵
                                                                                                                        PID:4864
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4944 /prefetch:8
                                                                                                                        2⤵
                                                                                                                        • Modifies registry class
                                                                                                                        PID:5936
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:5768
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:5512
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
                                                                                                                            2⤵
                                                                                                                              PID:6896
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:5940
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
                                                                                                                                2⤵
                                                                                                                                  PID:6520
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
                                                                                                                                  2⤵
                                                                                                                                    PID:6048
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6460 /prefetch:8
                                                                                                                                    2⤵
                                                                                                                                      PID:4652
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
                                                                                                                                      2⤵
                                                                                                                                        PID:4676
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
                                                                                                                                        2⤵
                                                                                                                                          PID:6420
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
                                                                                                                                          2⤵
                                                                                                                                          • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                                                                          • NTFS ADS
                                                                                                                                          PID:4664
                                                                                                                                        • C:\Users\Admin\Downloads\TotalAV.exe
                                                                                                                                          "C:\Users\Admin\Downloads\TotalAV.exe"
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:5264
                                                                                                                                          • C:\Windows\notepad.exe
                                                                                                                                            "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                            3⤵
                                                                                                                                              PID:4792
                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5264 -s 916
                                                                                                                                              3⤵
                                                                                                                                              • Program crash
                                                                                                                                              PID:6408
                                                                                                                                          • C:\Users\Admin\Downloads\TotalAV.exe
                                                                                                                                            "C:\Users\Admin\Downloads\TotalAV.exe"
                                                                                                                                            2⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:6256
                                                                                                                                            • C:\Windows\notepad.exe
                                                                                                                                              "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                              3⤵
                                                                                                                                                PID:5624
                                                                                                                                              • C:\Windows\notepad.exe
                                                                                                                                                "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                3⤵
                                                                                                                                                  PID:5724
                                                                                                                                                • C:\Windows\notepad.exe
                                                                                                                                                  "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:4772
                                                                                                                                                  • C:\Windows\notepad.exe
                                                                                                                                                    "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                    3⤵
                                                                                                                                                      PID:5388
                                                                                                                                                    • C:\Windows\notepad.exe
                                                                                                                                                      "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:6484
                                                                                                                                                      • C:\Windows\notepad.exe
                                                                                                                                                        "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:5288
                                                                                                                                                        • C:\Windows\notepad.exe
                                                                                                                                                          "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                          3⤵
                                                                                                                                                            PID:6048
                                                                                                                                                          • C:\Windows\notepad.exe
                                                                                                                                                            "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:4460
                                                                                                                                                            • C:\Windows\notepad.exe
                                                                                                                                                              "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:4856
                                                                                                                                                              • C:\Windows\notepad.exe
                                                                                                                                                                "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:6944
                                                                                                                                                                • C:\Windows\notepad.exe
                                                                                                                                                                  "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:6968
                                                                                                                                                                  • C:\Windows\notepad.exe
                                                                                                                                                                    "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:6996
                                                                                                                                                                    • C:\Windows\notepad.exe
                                                                                                                                                                      "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:4960
                                                                                                                                                                      • C:\Windows\notepad.exe
                                                                                                                                                                        "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:6576
                                                                                                                                                                        • C:\Windows\notepad.exe
                                                                                                                                                                          "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:1876
                                                                                                                                                                          • C:\Windows\notepad.exe
                                                                                                                                                                            "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:4772
                                                                                                                                                                            • C:\Windows\notepad.exe
                                                                                                                                                                              "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:5612
                                                                                                                                                                              • C:\Windows\notepad.exe
                                                                                                                                                                                "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:5616
                                                                                                                                                                                • C:\Windows\notepad.exe
                                                                                                                                                                                  "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:5144
                                                                                                                                                                                  • C:\Windows\notepad.exe
                                                                                                                                                                                    "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:6004
                                                                                                                                                                                    • C:\Windows\notepad.exe
                                                                                                                                                                                      "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:6716
                                                                                                                                                                                      • C:\Windows\notepad.exe
                                                                                                                                                                                        "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:6572
                                                                                                                                                                                        • C:\Windows\notepad.exe
                                                                                                                                                                                          "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:6936
                                                                                                                                                                                          • C:\Windows\notepad.exe
                                                                                                                                                                                            "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:7044
                                                                                                                                                                                            • C:\Windows\notepad.exe
                                                                                                                                                                                              "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:4664
                                                                                                                                                                                              • C:\Windows\notepad.exe
                                                                                                                                                                                                "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:6664
                                                                                                                                                                                                • C:\Windows\notepad.exe
                                                                                                                                                                                                  "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:3500
                                                                                                                                                                                                  • C:\Windows\notepad.exe
                                                                                                                                                                                                    "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:4268
                                                                                                                                                                                                    • C:\Windows\notepad.exe
                                                                                                                                                                                                      "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:5900
                                                                                                                                                                                                      • C:\Windows\notepad.exe
                                                                                                                                                                                                        "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:5280
                                                                                                                                                                                                        • C:\Windows\notepad.exe
                                                                                                                                                                                                          "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:5288
                                                                                                                                                                                                          • C:\Windows\notepad.exe
                                                                                                                                                                                                            "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:6692
                                                                                                                                                                                                            • C:\Windows\notepad.exe
                                                                                                                                                                                                              "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:6716
                                                                                                                                                                                                              • C:\Windows\notepad.exe
                                                                                                                                                                                                                "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:2368
                                                                                                                                                                                                                • C:\Windows\notepad.exe
                                                                                                                                                                                                                  "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:6808
                                                                                                                                                                                                                  • C:\Windows\notepad.exe
                                                                                                                                                                                                                    "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:6960
                                                                                                                                                                                                                    • C:\Windows\notepad.exe
                                                                                                                                                                                                                      "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:7164
                                                                                                                                                                                                                      • C:\Windows\notepad.exe
                                                                                                                                                                                                                        "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:2608
                                                                                                                                                                                                                        • C:\Windows\notepad.exe
                                                                                                                                                                                                                          "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:5224
                                                                                                                                                                                                                          • C:\Windows\notepad.exe
                                                                                                                                                                                                                            "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:2372
                                                                                                                                                                                                                            • C:\Windows\notepad.exe
                                                                                                                                                                                                                              "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:2340
                                                                                                                                                                                                                              • C:\Windows\notepad.exe
                                                                                                                                                                                                                                "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:3984
                                                                                                                                                                                                                                • C:\Windows\notepad.exe
                                                                                                                                                                                                                                  "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:6752
                                                                                                                                                                                                                                  • C:\Windows\notepad.exe
                                                                                                                                                                                                                                    "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:7028
                                                                                                                                                                                                                                    • C:\Windows\notepad.exe
                                                                                                                                                                                                                                      "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:4064
                                                                                                                                                                                                                                      • C:\Windows\notepad.exe
                                                                                                                                                                                                                                        "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:3192
                                                                                                                                                                                                                                        • C:\Windows\notepad.exe
                                                                                                                                                                                                                                          "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:6544
                                                                                                                                                                                                                                          • C:\Windows\notepad.exe
                                                                                                                                                                                                                                            "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:6800
                                                                                                                                                                                                                                            • C:\Windows\notepad.exe
                                                                                                                                                                                                                                              "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:7048
                                                                                                                                                                                                                                              • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:1464
                                                                                                                                                                                                                                                • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                  "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:2312
                                                                                                                                                                                                                                                  • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                    "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:3352
                                                                                                                                                                                                                                                    • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                      "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:5940
                                                                                                                                                                                                                                                      • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                        "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:2340
                                                                                                                                                                                                                                                        • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                          "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:6780
                                                                                                                                                                                                                                                          • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                            "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:4204
                                                                                                                                                                                                                                                            • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                              "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:6476
                                                                                                                                                                                                                                                              • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:2424
                                                                                                                                                                                                                                                                • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                  "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:1340
                                                                                                                                                                                                                                                                  • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                    "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:6012
                                                                                                                                                                                                                                                                    • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                      "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:1904
                                                                                                                                                                                                                                                                      • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                        "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:3892
                                                                                                                                                                                                                                                                        • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                          "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:472
                                                                                                                                                                                                                                                                          • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                            "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:3364
                                                                                                                                                                                                                                                                            • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                              "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:2112
                                                                                                                                                                                                                                                                              • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                                "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:5752
                                                                                                                                                                                                                                                                                • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:5464
                                                                                                                                                                                                                                                                                  • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:6868
                                                                                                                                                                                                                                                                                    • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:7164
                                                                                                                                                                                                                                                                                      • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:3028
                                                                                                                                                                                                                                                                                        • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:6840
                                                                                                                                                                                                                                                                                          • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:5160
                                                                                                                                                                                                                                                                                            • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:5432
                                                                                                                                                                                                                                                                                              • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:1504
                                                                                                                                                                                                                                                                                                • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:3332
                                                                                                                                                                                                                                                                                                  • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:2352
                                                                                                                                                                                                                                                                                                    • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:2592
                                                                                                                                                                                                                                                                                                      • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:5528
                                                                                                                                                                                                                                                                                                        • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:2656
                                                                                                                                                                                                                                                                                                          • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:6536
                                                                                                                                                                                                                                                                                                            • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:4696
                                                                                                                                                                                                                                                                                                              • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:3192
                                                                                                                                                                                                                                                                                                                • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:4288
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TotalAV.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TotalAV.exe" --installer="C:\Users\Admin\Downloads\TotalAV.exe" --skip-welcome=true
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                    PID:5444
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Wbem\wmic.exe
                                                                                                                                                                                                                                                                                                                      wmic.exe path Win32_Process where executablepath="C:\\Program Files (x86)\\TotalAV\\TotalAV.exe" delete
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:7016
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Wbem\wmic.exe
                                                                                                                                                                                                                                                                                                                      wmic.exe path Win32_Process where executablepath="C:\\Program Files (x86)\\TotalAV\\TotalAV.exe" delete
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:6664
                                                                                                                                                                                                                                                                                                                    • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                        PID:5712
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 916
                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                                                        PID:6312
                                                                                                                                                                                                                                                                                                                    • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:6612
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 6256 -s 1020
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                                                        PID:6748
                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2524 /prefetch:1
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:4164
                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:4288
                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:6976
                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:6940
                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,11067581082173765634,2895509066455639350,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6064 /prefetch:2
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:5040
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\TotalAV.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Downloads\TotalAV.exe"
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                PID:6788
                                                                                                                                                                                                                                                                                                                                • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:1168
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\notepad.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:3204
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 6788 -s 876
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                                                      PID:2592
                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:5464
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:6380
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5264 -ip 5264
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:4776
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004C8
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:976
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 6256 -ip 6256
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:5464
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5444 -ip 5444
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:5632
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 6788 -ip 6788
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:4484

                                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                              Reconnaissance

                                                                                                                                                                                                                                                                                                                                              Resource Development

                                                                                                                                                                                                                                                                                                                                              Initial Access

                                                                                                                                                                                                                                                                                                                                              Execution

                                                                                                                                                                                                                                                                                                                                              Scripting

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1064

                                                                                                                                                                                                                                                                                                                                              Windows Management Instrumentation

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1047

                                                                                                                                                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1543

                                                                                                                                                                                                                                                                                                                                              Windows Service

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1543.003

                                                                                                                                                                                                                                                                                                                                              Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1546

                                                                                                                                                                                                                                                                                                                                              Netsh Helper DLL

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1546.007

                                                                                                                                                                                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1543

                                                                                                                                                                                                                                                                                                                                              Windows Service

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1543.003

                                                                                                                                                                                                                                                                                                                                              Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1546

                                                                                                                                                                                                                                                                                                                                              Netsh Helper DLL

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1546.007

                                                                                                                                                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                                                                                                                                                              File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                                                              T1222

                                                                                                                                                                                                                                                                                                                                              Windows File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1222.001

                                                                                                                                                                                                                                                                                                                                              Hide Artifacts

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1564

                                                                                                                                                                                                                                                                                                                                              Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1564.001

                                                                                                                                                                                                                                                                                                                                              Impair Defenses

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1562

                                                                                                                                                                                                                                                                                                                                              Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1562.004

                                                                                                                                                                                                                                                                                                                                              Indicator Removal

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1070

                                                                                                                                                                                                                                                                                                                                              File Deletion

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1070.004

                                                                                                                                                                                                                                                                                                                                              Modify Registry

                                                                                                                                                                                                                                                                                                                                              4
                                                                                                                                                                                                                                                                                                                                              T1112

                                                                                                                                                                                                                                                                                                                                              Scripting

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1064

                                                                                                                                                                                                                                                                                                                                              Subvert Trust Controls

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1553

                                                                                                                                                                                                                                                                                                                                              SIP and Trust Provider Hijacking

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1553.003

                                                                                                                                                                                                                                                                                                                                              Credential Access

                                                                                                                                                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                                                                                                                                                              Browser Information Discovery

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1217

                                                                                                                                                                                                                                                                                                                                              Network Service Discovery

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1046

                                                                                                                                                                                                                                                                                                                                              Query Registry

                                                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                                                              T1012

                                                                                                                                                                                                                                                                                                                                              Remote System Discovery

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1018

                                                                                                                                                                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                                                              T1082

                                                                                                                                                                                                                                                                                                                                              System Location Discovery

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1614

                                                                                                                                                                                                                                                                                                                                              System Language Discovery

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1614.001

                                                                                                                                                                                                                                                                                                                                              System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1016

                                                                                                                                                                                                                                                                                                                                              Internet Connection Discovery

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1016.001

                                                                                                                                                                                                                                                                                                                                              Lateral Movement

                                                                                                                                                                                                                                                                                                                                              Collection

                                                                                                                                                                                                                                                                                                                                              Command and Control

                                                                                                                                                                                                                                                                                                                                              Web Service

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1102

                                                                                                                                                                                                                                                                                                                                              Exfiltration

                                                                                                                                                                                                                                                                                                                                              Impact

                                                                                                                                                                                                                                                                                                                                              Defacement

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1491

                                                                                                                                                                                                                                                                                                                                              Inhibit System Recovery

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1490

                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                152B

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                451cd139bce77c7fbbf158ca1f3d1059

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                27cd37f157b2075b075ac0f3231e6f355abe9233

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                ade70d3f22e4174670951ed028318b754dff05a738b657da42ef49332fff12d1

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                d192881273d623721ba0a73bc2ad504b3fe6376281d8216b4a381b83967ddff828b1354685f502d36277ebfc70a398e7fa009f1361e6e81311cbdf80ebf91a5b

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                152B

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                058032c530b52781582253cb245aa731

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                7ca26280e1bfefe40e53e64345a0d795b5303fab

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                1c3a7192c514ef0d2a8cf9115cfb44137ca98ec6daa4f68595e2be695c7ed67e

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                77fa3cdcd53255e7213bb99980049e11d6a2160f8130c84bd16b35ba9e821a4e51716371526ec799a5b4927234af99e0958283d78c0799777ab4dfda031f874f

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                152B

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                a8276eab0f8f0c0bb325b5b8c329f64f

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                8ce681e4056936ca8ccd6f487e7cd7cccbae538b

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                847f60e288d327496b72dbe1e7aa1470a99bf27c0a07548b6a386a6188cd72da

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                42f91bf90e92220d0731fa4279cc5773d5e9057a9587f311bee0b3f7f266ddceca367bd0ee7f1438c3606598553a2372316258c05e506315e4e11760c8f13918

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                67KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                ed124bdf39bbd5902bd2529a0a4114ea

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                b7dd9d364099ccd4e09fd45f4180d38df6590524

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                48232550940208c572ebe487aa64ddee26e304ba3e310407e1fc31a5c9deed44

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                c4d180292afa484ef9556d15db1d3850416a85ad581f6f4d5eb66654991fa90f414029b4ce13ed142271a585b46b3e53701735ee3e0f45a78b67baa9122ba532

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                d6b36c7d4b06f140f860ddc91a4c659c

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                ccf16571637b8d3e4c9423688c5bd06167bfb9e9

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                41KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                892667ceef6d330214d98079380ce506

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                04f4c9b0cf3ed644809c8f712540f772dae52fb8

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                a66b51f452a1739d2cfe2199b617533ee3688ccaead484dce30a984cd71530d6

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                0d399fd83216fee684f480ae3c907e3bd4d7bd09a8b3d4f79f5a7ab096675e3c098b2efc8e7b9901847d49d55185e23145705f617b0c6a8afc5542cb94d428e4

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                19KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                2e86a72f4e82614cd4842950d2e0a716

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                d7b4ee0c9af735d098bff474632fc2c0113e0b9c

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                65KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                56d57bc655526551f217536f19195495

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                28b430886d1220855a805d78dc5d6414aeee6995

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                88KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                b38fbbd0b5c8e8b4452b33d6f85df7dc

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                386ba241790252df01a6a028b3238de2f995a559

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1.2MB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                8ab35848768f30a7eb81d525d18ce96d

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                7833667f5d08d58837c0a9d01ea0a15c6b3759e6

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                4135303df903224b2d6bc416bac09060665f6b35ae845571c6442326b921f18f

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                6877caaf873bfab09ddd31dd86aa557ac8e0066fcee7843d68258933c31051a589f3c4943189b22a42795f2d975b66ab8c641187ee6ee4b4e48d552a7cda8487

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004f
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                18KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                4d8f6219fd1819f07d9ee690922c4ced

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                df9d86eb54636660ae887e252ca2cd74441fbed6

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                93a1116d4b601721febee71ccd8eec19b192b7b5cc6207b099e84941f58dbfe1

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                abbf2039d1e6becd2b51ada7ba621f7211275505fa0efcfbf5d4ca3b6b86b040a9145e842c8581665098de3bc49ed0ea6fd613b8a88a26a28d3c9595846722cf

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                f65033ef250e22a9b66df43bef296f5f

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                2d75694c97bbd7eb619deae80bde9072eda926c7

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                b03887b0e69033173d6d9256e050e31898178a3f73b97235ede6698728814487

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                fd2d6b806c9fb64156578f82b611dfa45020f1a324a67c50727cd5906ce668d02ac616baa508727c832c7e6c7dbd99d91ce325a3ffc5d0a62b756b4cca9ec57b

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                118d0cefb171650972c7f2edc1899386

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                f21786dd49171a447a7d550d6bfbb4abe74ac780

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                fbeb0bd2eb6dd2a0fc89cd954feab9afecda2bf03a154833deda38a1c50bb139

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                0fc5a76f8c33cbdd3ed9dce976d0014723e64479dc7208481c85303dee4978d0af44f0247f7446554ff83dd6a3949f6e1ffa02c70f5cc29ec875f993bebf685d

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                5KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                c5e429e27a8c47b8a7f42ef5605c59b1

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                fb33599425fbfdb0f6d0eec2ef0007c0023b6a97

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                de23ae709ec5c33c6e18ed87ee78caed1f5a65a1cec06c5d333431384aff5b24

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                a433e40a7d14a09708e13685bd68c779877ee38ea18da077fe86f2d3fc9308bd071be23e2d62d1e8172f1a508e86f07a0a6641ee1686671c3d6e4961bffb0d02

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                99224371bbaf2cd1e7baccba7187713c

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                c77501280f85b4ceb45239d9c42ce5d27943d5ac

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                845cdc362c1afeef446f0027bf856824ce194cf5b98efd12e9545601fc54aae7

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                bfd9d7c66965b022a59e8ced91855a444231d05812f43d1baa326531cba1fdfa07b78b5873367e0a482a57058b5490c15b839e2de80e4af31f171fc85a23a135

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe686f90.TMP
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                8ccd757da99012ccd557242f359f2535

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                980280370589fc0e96a28c3ed09e19ca1a624125

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                3acdb1167da05b3bfaee24bb89ac1d431a43940952d2c82d5be29e060f9fefdc

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                cb1d56191627f82025010a5951bc8bd4e015fe9e7d6a646f70bc35c77c9d9f8918b6ee18e554b508e9b0ced5dfd4dbdf8ff1e23e6ac7ea36ea85b3454ff21b20

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                b3e4fe590ce37849f5d6e962bc69f011

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                4c9b8e589ec9d8fd2af765380287aa637ba0692e

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                454ff2807e94b846ab290133d00142dffd16743ac62cdb82889214381d3ca30a

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                212181849cd0f29fee05a29ca3b2ba96113751d90e4f48e63b3200c3fe819cb2f1ef1de9dcebfe451ebfa5fb8e77dfd717226554bb6a26a3563b9ea89ed9fb3b

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1005B

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                4bbee512218eb24e448f28a55077852d

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                ced1309e963be4df31205ef68a18b22cc509abbc

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                522ec37ca88850f6a29a4cab07a0139ae1581ac5bf2ab311a6251a5a3b3848be

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                51904df185f942ed04b252e3227ce94e15bd6550bfbb94b1b82068a6d78d771a7e9d44e84dd296574a863a2bb8830367f7c411e2928910152d50d303b79b487a

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1005B

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                0af57c5b0db9c9d5f073db2f57751dda

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                d901f785ab2d6d5fd23c58b94c7ea06a81e8ad14

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                21af59bef34996814d5cb6cfc1ce360b85c587794234de1312e9810734cfcde0

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                ee0b0455f06c8bdd2e6580bf92c638c3b4024f89fa115e01bf006df38e653bd7aa0f03876aa3b8869e681758c90c7ad2b4d8991d620ff63c7d7d10d7cc4e433a

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                37877537a1e612bbadc0875ffc53ca30

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                770f7068bb429d56ea6bd1183aa1a091c872e79b

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                44858de0324f2a21b2481ba196f3e2e850b8399cb01e4cd9676545561f51a80e

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                03c798bfdcfb90fe9e97f8f5ded27848d35c393323716408577d34b62496b8955cc2766ab934064034969785ae40b10e681073e199c2106ebe8038ffa5e84c38

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                7KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                359127007237a97aabfa8408f7fbf941

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                eb53402681afc010e436bc4369ea6590a9f7d274

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                27552e5c9f8a51d758f7e5d43c95499c58652880f88eae5279e52fe64e2aa6c6

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                6d55e0b4f36efd05cf23ab7e039118fdceac63218a59262ca6612416b668258870bd87d271ddc0e4b7d55079462b2c0bfcf1bf26e595c27ed65ef4fc194ae711

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                5KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                be67d829dadd4abf519688e9b9a1a1cf

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                a460df1a8d676423887be6e1fe2cd641694bdb2a

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                7c6cde39ebb6c5b809644c0341d5d184afe342559e9e8bbab938de3b70c1b170

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                e74c0f1d9f239d10aa543563d3078cd2e7513fedd0f5ec7a0b20acd6ea5e1da085d6ffffc3db60b5ec7685d399def04dd547ee10ffb0f4065fd76e3b46113acc

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                1f8c46fcab78cb7a6ba0b9d821a436ce

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                4319e0ad1ebb9b432b14e339b2dbc52ac005b973

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                18ed99b8ae2adbb303a1ae1f3ab59abdb6df287bf45cc95d610465c4f7918b0c

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                9f20a1474888bfdacc08b13a54dc97699c419c704b143b10b40b90438b40a629d35a7d91096fa034b361d11d33431a5d1fd2070eb97bbed084234d4fbc0ee7e2

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                7KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                2d1191a2a8f5f7a82fd1702d755023b7

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                91bacf7bff56459fa7797c3a956a2fbd194c08f4

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                f394b26c15bb7efe3ab3ac194762f702e7bf10ce47ae1a9ffec9d70dda8b8ff3

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                61a731a445cf38e1bceb263b0977d6598cc5ca8ee1e5a6ba9a7b97b3d17f4db975d127dd1493b5668fdc151b1af3ccaaf99b6de9ab497b08e7148bd24788cd72

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                5KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                fb0a2d6410c3730b3c2a49d2d558edd4

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                72c171f36b80bf736d1f92c0aeaa202dfa93e2ad

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                a85e31239bdf9d64f46d9db5a7f6bee91fc1f2fa34b3ee26b3eb5ce23e9c6fe3

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                30ba5538c3a6b70a38aad7a60e0156df7828a2c44ee411d1ee7faf28efcf9c68c2cf76087b706868749879f8acd262d32636adbb9c0d7d3e5ad787a1d4d23235

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                7KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                38e638e6063be8e3b78a580d28a66396

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                9d22f3e5a41358b03890bac5ba5f46cebcd0107d

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                4e55f530fb167e42b9c12e2670cf9119ccbb4123c8019d434982d734a4689340

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                0f17bc5bf657c13d2fadc8f5fc8d91f4efc52745ecb1cbb0ef09631b851bfec7b359a9b5b6bb3993b706eb6f117fe5de99679aa0623d18e8c05577612657a459

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                dc328527dcce4db3f60070db99454b59

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                95d8e7b3a54a640ea9f38f4e1dcd55ce5bca4064

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                2d00c56cc92761f1580950e08f726876d036674386b4224142c978ce8d359964

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                fbbd1a8f58983b7f672f8b28dcd5b164e418c4f875f79424b4b65b64c138bc867e96c628c0c60d6913dc19d772b0c843a302c263044f2530b297840cc1271159

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                7KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                c88072f57653ee46e3fbed2a5d20b6ca

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                3884ab280775f5f99153e287c3b04e73f0911820

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                777c518a7a01e41a26016d636f51ea687efe04aeff72532c0d38bb182530d4a3

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                f0d9a4cee3b254f426bf7062ca769b0d576ae0006b2e224de5bfb0cfdc6b4370b07bef1788c7df10f10cf9b2e8876e6605acb8d4f3d0f245b7c2cca6c95affad

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                7KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                e419f1d3986e3433a8c2c508b051c88f

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                c4cce71cc5d841141c835c4363885c375895028f

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                0a5fb14f45c5020776a3185d16d0f90fd0d80c9a0a8e86396deebbea76a75ea2

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                76db0dc4aea0800da0513d1dc26705925f18f4eea2a7131b2fc1d1d90abac49b2d60bf2950eea7f64db10c6c45c824d9714c047b16746811763f311ac4c9df33

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                128984d6bc943bd3444c309b07c960ae

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                1322f07abc5e9cba842d53f98461a625cdacdf2a

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                4a6a8d72408c874561a261cc2d0f232885d25306605e79277b19563c8836e524

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                38cbb61000d929fd3f118b057cacba995122e81ba021be7a08705bafe7b92969176ec2351e55309fd26babb6145096ddd53bf7f0c595faeff259cb1b71201a8c

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                ddb4ef22366bd9def7ec0385c4baeefe

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                8dc63d7c2199df1f70ebf91260700c3fbeb17815

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                96eb889df7d04e303b880bd6b738b2d4ab0bedfab3906f19da4ce47df77b0a54

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                2c7659c42e0a96441535f406c0fdf168167f4f1af71b7f2a6a75a4c38ac26a4bfa7ed8fce6ae41f3a9da6407911e38cb253c7b7323e9bcecf2273ea96c24b24e

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                10e38831494770fe147d159e8c5545c4

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                ed2a99b357df7701ed9176463f64153312963e73

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                8a11d9137de1ef616a435ccf80795565b09962a00f7bbe1b2fa323d504288d77

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                504d67370e74c5c109bd3b8f662932dac84f6ded01190a45066765da9244a99c378feba93f01869d456bdf42d4251d42534572331e28eb506e39f73eca213580

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                440467700e072e3eee427e3fcbb111f6

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                2eeb76071984d5b141c2305ee909c1830b246b3e

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                02c50d193fb3582822c441ede968db320cf7d52b9e6a007a7b08e800b99ab6a7

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                0583904e71019b952536628075e44ad14e69dc76ef86625f210c8f0f5e12236036b6e94762925f9689ddf94b45ee9c68e30043562c444731badcc0199d73a9bb

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                c0168cf23a8e52cf02250950f223fd3d

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                ec71fa2108056181140ca5b2f481e42782c905fa

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                49f24bcfe222bbf0de62f23c4cf47e937a8b3619f19d30857681f2a7a2146096

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                2b2922a8a04679b7a62222dc4c8b47cc0122d267d3d4782c003cdc5e2ec45d6fe610be305b2293c83064e6f222b94f27cabbe09dcb108d4b26a4592ac85b9bd8

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                b9da992debb7d429664c46b84283fcf6

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                7d4f2a81c636e0c19130d6d03dbd31a9f6bbaf03

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                cefd49018c121c664ebd405538b9b1171ce776b943a59f5ce6fccf93a65d1b39

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                31e240824b33b25aea6446cef50d8fed94c22ef0341b7e23192b6855b1fb7ad7db644dbb9e56837f7acd0c516314da04f055e57b38dd37bc18d4d129419b66f9

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                c31ee4135c2a72fabaa8c604e8183cd9

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                c2fbd2a1620d75ec8eaaa24cf68dfcfd02a142bd

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                b2a0663a04e47ff15b7cc55cfe4af64bffaf86e0b5efebe6dbaa1cccc3c48f95

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                487d572544c0789fbf646fff970e55634333e326cc511950656ee9375326d8dd64fe56b2d6a014dff5b602060a43d62987b9d2ebd334e2817edb022ea0bb2be1

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                647f4eae99623c388660db2356d95bad

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                dbaf464f8d5a897fc08611c94314a2e7f6083094

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                44861f3af3abff267b82db33aec203e4a4b48bf107bcabad9cd9781b4f27102a

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                4683708a634dcab0bc81631640478e2ce1b7f23c2d55ffcb236760b9c4005c8636b0dcb4499defde3cf86871c515a302cde04b1cd40f84dfbdb491fa19fa0507

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                7b6965003b9150b178ac526e1c78f0aa

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                4268ae7807df488064eebfa140dacebd5948e028

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                599a9df2479f0fb56a2932fc28354d1bb333e62802bdb25fbf41afbe99747fa9

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                a236fa08d26c0dfe7b1b563e31518decf56070b9c317d3532b793cfe907785a03fe3b873b78a4c01e06d5324f0c641bba47dbd658b4a69d98f6cea82c2120c0d

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                9e803e6c073b51bf771168465ad6f814

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                2c49c052ff4356c05e263a2d528cd08fbc8c2b3c

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                8f78e56bd88276506602dd6bb6af3a3499504c9ef2e558e1388658dd4615185a

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                21d223946847b3e90992c8bfc4b70f126c8243c7e6280c17b86e74950c406403beabfe0fa165e412c1cd4f786f91ec35683eff30ff106ae232c5ab66c7a6b3f0

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                d3c87a14f8c4ef4f57c9ef9d60b3df3c

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                256c9b0c4fb9d42cd090d9509e7aa50cfffb263b

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                3ac8b104874c84f74c54bbc3405744ac8d794524c810d33378116fa8938ae0a9

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                5b46150978c94e34019b58355126a7bcec614a297dcfb19a126dc27655abbba65ee48743f93fe3154c7711c527be55629a2a338e80bab6e538186493c8f40344

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                1b547874c065703ebd9db9de17e19483

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                432e9af21215b36aec7d1e26344c2715c45e27cb

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                dfafd89b2a80e0a14b517143fbe28e48d89b9b4e5b857a71c3b662e7cf07d8bd

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                e06b5098be84a5873399d1c2d67baaf990ba4e16666f88d60a0d219ed34f0e93eafcb571845ded8483ec427cfa673e5a4cd72c91e023e9ea3c45053bf6fd4d5c

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                538B

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                c903308bce9be156c80b24c60b6d3eb3

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                ad359b926e3031a9e9938148ea5c05b69710b967

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                896dadeb209ba34858035444007e8e4922685228ed232717ee10baaf5f9061d1

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                34b0c7a356a9a883fc6f7b72cb76d2f7b08f2b0a7990cf1d52b979e9e2d0237142f953578f7925629611389088de44ba7796829b91532d9fe8c3d556b1b598d5

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                0514f019b8ff06125a03a638551e013c

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                7b107fe0943423fb6e5d845a3ed1db8799b2fb55

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                16e5dbd4180a75d922071b8fe99068fdb60619d5910ce3efaec9ad935f853cbe

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                13063fef125e1d1569837717810103b9b80ef139a451c9bca900f041ce18c6c13e158e0dd8f60029f0b1ab60034aca373d2c23444b0cb8277af21965d3e5165e

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                c9f524bf09c7a00c0411895624bc2d66

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                45b374a8b13edc7acd473af90ff3abd0f1d95373

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                2b21fbbb7262ae7b861fc0590cfb8561cde93f5a11ba17873a700d58e0128989

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                e78c8d962e7f289461a984b185bf245641f67117aaf53e73c078a71b9e3ea400d8ce49c19bab1e1ec629d300ef6ee2160b243eec1da357ef8bb7ae018f214a97

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                00cb64bd639c1c7501863962c9385e37

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                0745dc17f0666487ab88f2024e912ff663a43a62

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                e118bec84f4c9e752341df3c8d6b97025964da2aab7d0572e538e4c6936db499

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                b1c8b5b10bc35bb4fa93320b62ba862694d0f7af889ea7662262f805a1ff7bb544bc925e2c2aa6116597c2ea8425a253a49c936d13185a534ab07c9cdb3bdc05

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                a6bcf15d77d83fab782c7c762915f610

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                7be2eda0c9305d30ae7e95f1cdfca329513aeb4a

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                825bb8f54ffb0f7ac3b9e3dfe007c027c017773d0d2a8cd3299e4ecba1a7cc71

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                36f5c566c576df3b0a9df1917758b3ef7f89dda989d2976c45170cc1b0bb0983308157f3f0cff1199c133c87d11f5c896113c3a38ef27570a60fa233afcd5f08

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                ca3d4d62a7263ee540fcf3e5e6100225

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                c06cb68925f9dd66f4e3f3178a207fa9476f568e

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                175e07d4e635c67ea3f5b6c5d0a3c2c4998fe514c4031c3f3602f40f73d8828f

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                03556b0fb62f37ec0a32ae7791a1b90b6f366e4263a1073c9af4637d7d571a1b121522631cd9132ea104714dd1d0e0b221ecf09da2e7002cd3bd3f0aeb458389

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                b039f5c584b4dc0afb9f4e20b868f684

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                fec15a06060b84030075b32ab8d43dcf6e688041

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                14d3222fa19e7542dbadd6eb24327896c87b45d16b85ded17dd72fbc7f298ab8

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                c0ea3a195b3f25ba3928031dbffa6144798ad2b947607205227c321e1d34628a5e9151d34e5aae6711a8591c6e90fc2782e208f33edebdb536103971ffd5d3a8

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                ecf14b4be7c4517863f28cb1efe6f23b

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                241ae724b26018ec74bee2c64bf4c76541ae938c

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                599353380cac980a4c6f7571063287b597748d912be383ae7e43f6aee32f1d06

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                121c2dbcec39a9d94ad2fef811bd3a38029b7978f28cc1f0fdb1fa445c534ecd1f460e9a95af7cc5972c73bf2437b5d6917563b13daad44e72008737dbe27ab0

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5f0dc4.TMP
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                538B

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                41e6f82763886abf312191929002eb31

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                64dcdb80aa27383cda2d1a2e9de362260ed94713

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                d94bb6e61b03be134207054ddc66ffc7e14357586b83f0a21fdb7be10ab7d8de

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                76f9516c61925a6da0d2400c5147bdbfdd146600783f2b34a0b8c6a55bb2f5c8e9ec66cfa5e810293b1ab02191d6229503356a305e6dc27ed6e8e8230f6f444d

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                16B

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                46295cac801e5d4857d09837238a6394

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                16B

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                206702161f94c5cd39fadd03f4014d98

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                16B

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                6752a1d65b201c13b62ea44016eb221f

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                1d6d54e5b3e92d029e53a6f5005b61d2

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                3c2952011c6b25d7b9d65607490c3cc83675cdc5

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                684e5104be7ffaff1faf03e2d2a40bf4a30d402e45526fdcee795e310da60963

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                4baf69df0eef34f85b2668d0b4eb69c544c70bccf698b401e7864c504269d4b0fc3b857b185af8d815a40cc1fcc33fc69736aaad639b4d13dd7b4d104506d769

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                31b73d308dd5b1bb5cd897d66fd88e95

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                8f41df18a55eae6360033d4a378065b93fd8129b

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                991c9fb938be2dec4c02934d28448a7a1e8b12cac868db9f964470b5a2f5e531

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                3101230bedf64cc0b210e635fea1ec5a634b6af1522e15def52fd64c0f6840bfc20a11ed3e4d177b85231e5642afce3145e7725b430f6ec68bf8ef1ee966197c

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                00fc0f024c8c9fd3de30bc10f4736b92

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                3e8294c2887d6c05cd0d995c75835363431b2be9

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                ee69e7b1d4497a45d122def1f07423e3f722c101c1b81c2633c5c01c9178bc7b

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                104dc8bc24e95e72f8d79d54bd7ea05cbd7d277ead4aeb02493e381bb3623008a0892aa30b4704f653111b3d8c0cec990009a761d623086ae53ef86bb28b2a00

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                a4a3b83db7c4554f29494178a066f965

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                7c243b489eee5356a340c63fb3beb4b55b98fc65

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                f24c9f7b79901cfeed2744042d9a09811be0a3a48a2e8d2f0a86b6bb1099cd45

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                57f9a1fd36e849e28a0d8390335990dff054a75c96fa8a0c444130059b6edf87234e7f45b67067ead12670dbd2e19f61dabe985f1b59a947051a3fd31902635b

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                baeea2fca53a49819fa5cc70f6d168f8

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                41d84557a678e9fb146aeb3d407acd2840e53f55

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                581658ab958a92672fdebe7294ce1461599d04f07a763e4743085351f299c19b

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                0958e1381cbf1838351814ce66ff219366510210a4c59415b912f2d3c673acdd1123fa522d73547306cd72630c009bf2227dec6a2f3897d1518db3ce9a6687b6

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                310db88bc71b47e9d30ec4658ea96e61

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                06939c960de2eeadad692178f63835ac58ad8886

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                e48c2c471286eefec622103cc460667eed29e2ab734afae1c67913a8bfb5bc09

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                c0de16f894e6a0953712164d17cf0a3de88f539a0d7dc8deaef89497d6d7f90973a148e2a44e4c20d2e421bc4a087f5d7c608b53b6e7c524e7f8e5d0c0dde415

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                b88c07d3655630d8517895de460cb600

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                1f54fe6f87bf3ea092fa1f2a45200ca404f7cc45

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                bf5d9c92ae663a6c895ce222b17b9a1be8c60b929792455913ea5319174f90c2

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                93c3968ff1d222e8932b3909bac40c0bff6f8b33b14cc4476f836af4e968ef94ce3dbce02f5868c003bb7c1418641d57dfe2c75361651e1612bb4cabd36f8839

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                1dda0bb3002ae4eb0d428e24430ad34c

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                54e79f268da05124c88d96187059cb8be66ca832

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                4f4490c57523c90f51a8afdee867b66974dd2f24c43c1ac478d1e5253cc617cc

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                0f40e01580f6aca52f82da5829052d4fe43b6366e1442f661300850971c2bbc543a11c4308dea9c42c8e76d3b432ac07bcbc1a8d2f8312a3c53ffc81d9c38d42

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                1a52fec4ee2ca1b61ae0ef0cad0137a6

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                19c533a04e05130b8f6b51aa3f0da1e20336d244

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                99e07422048f4258100980b98333e53fe2dcd328d0cc95a8732c7ffa7d848ba0

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                b8133df62fbcbe88395432051be2f2a22b58502bc22e334c5d271529987c4c2a83fb8a4930634acd90e16a7e97785e68caf9f7cfab8e9a1e6423236cddb50041

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                468c8555fac06d308755cac2acb95bb9

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                2c45ca0ae1faa581a6b1211c69f321df1b674f36

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                6e73bc0096616a601ca3820938fa2e49212deb9ed92ad9aa1c7c592197248bbc

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                3f05a505e42ba84afee44e2fe9721203d46ec45f6588052be21ef2af159a4be1143920e18fa3b475bd4ade37a2ceba328d8b3f41c5cd887af8ca86349364e292

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                7f593b581535ec4938eabea9e1a049df

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                4e8133e4f376ee45274fd8a663518d4493e78cdd

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                5bde5af875745f0cb61829c484bd2064d434c86fae7d268af445a338260f756e

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                c1548f746ee7fa16d39a04e61e091011d82afb157504afa1f903c8d1a8945aae1e387ab78c557bae0eb321b85cf54865512bc6d52f46e9c7f467dd4ddd62971f

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                34563bb5f38cf8b535d7114d6aa2de05

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                bbc679330518257f8851b21f80239c42325ffb7a

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                030667f03d0fe31c70a994531513b0984e167eda2fbb8fe205e4185469a87988

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                948c60d7a2b1bd0e6c3eda638cbcd2efdce46ffcb56793cd3f1bacad3a78d83cf668ba635704d8acf9f4cf29604d589128e02861fcaba345d96e053779c3ae10

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                604dd2b7ba19b9f6fa47a73fbc6a3ab9

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                484c4e2dd32fa98719f6d552fbb22c301050c8f2

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                39b5b59d686a665840a3f5f5bd275d1e4c296a970581f040614973488fa0029f

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                52c7879aa1921aaea2d8f8050b69491fea52b56f99c89f8fd40e312e725789c2ff462a20806ad9a0da3ce4531f1e264407fddbf620091b799823c7376c2e701d

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                85fad836c18d1301f01b816d26769a2a

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                c39b59f0131c312bdad6f9a76505fe44d9632011

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                698b123bbf53d63c38a1b1a0adc5809ff6ef02ac3569816e2f0b7787ea082cb4

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                9b535b6c5f545d8b77470621c31eed26a755bbe9070fa77ce3614d7e469ee537d4704905b8d5512181be9eb9545eefda25dbe84603a9a06d664525348f3ccc47

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                8272553ee7bd5c6bb407874f38e347d1

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                ef6e3025506740883bb2a62d567b8acb3c61592e

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                2aaf0bfdad63983982f61fa8967d0a1e6e7007a16299464cf48fd7fd4af5601d

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                f4cb00c0628ee350c020335b97b49e374915fc03c6bf07501cc075507d17467dfe78e4384fcc4eed9a6195820e98f3affb3fe2ac81a1d5f277b303c940887c20

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\_R_E_A_D___T_H_I_S___MUA3_.txt
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                023e8dd3c3d9bb1a697bd7685c25b623

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                3715d33f3b9a86b2a3273c6a6cb01a8447fd62fc

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                ac744df2f0c7c28b8531f69c078c09cf50d44e30d78b652a5ea601908beec7b8

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                670eb5dd7a7416560e104f9c3d4abaaf047ec496f6961c62dee6c32bee2f6634dad87a5a3f3bf1c66f4ca72bbea877d40ada7aa62fdde988d6799322c3833e58

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\cb54d7c8-453f-49ac-9112-bafc3aca46c9.down_data
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                555KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                5683c0028832cae4ef93ca39c8ac5029

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                248755e4e1db552e0b6f8651b04ca6d1b31a86fb

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\23dgkr5k\23dgkr5k.dll
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                15KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                a64d820d3a728361eb7f4bed8492cc6a

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                3ad9c1ec79ff5e46b8a068867cf95b82857aee99

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                7ba176d520d5cb3877c482b95b7110d4139ca7f44c00a3d4ff7b7d647b849780

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                08c7fac1d35710696c106d80d2e9ec434e2366817157cf56c2cd45c89ec407aae26f2d0ae69f0509db74b0d2b2bedb573c05ed574ab641c42010871a3a91c422

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\23dgkr5k\23dgkr5k.pdb
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                49KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                0e06f55bfc4a546d3880ef3b6540f2f6

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                147450b2e70b00be1078e79ae2f862b4b0d3fd63

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                ed8b2fad0de8af92523df807dd750f45758181e2c9cba58a9536acd68d0557ef

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                1b205aca055878b45afbae6740f6ed6ec2ba4f7abad320260aae594c54bbd2cebd34ac93406e5baf4f889fe4ab37b9d5fcb0c2fb78ab3c04eab9256317290b86

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RESCF5B.tmp
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                904efa8f272fd687486c347c9cc944b7

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                cc4e89c9b92bdc5a9121701166edf757d3a5eaff

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                50528440256b95ace5249d227be856eefc20c59069074b8a482493e181a1d231

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                fa7e03adbf43173c31a67f08a64122b940ab0e77ecfdae3ec1e1c63615a1d07d46f0b72d1703a34b7ea6227d347632e05aa9a21db713ff231bde770d377c21f1

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\nsg7E85.tmp\System.dll
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                fccff8cb7a1067e23fd2e2b63971a8e1

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                30e2a9e137c1223a78a0f7b0bf96a1c361976d91

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\nsg7E85.tmp\nsDialogs.dll
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                9KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                1c8b2b40c642e8b5a5b3ff102796fb37

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                3245f55afac50f775eb53fd6d14abb7fe523393d

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\nsk7980.tmp\modern-header.bmp
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                86KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                c493cb5a2e37620ee28be3665a29e84b

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                c29d5d793953871935bc2a253bcedf44b9d7565f

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                123918b9bc59785fa8ff2142b20d537cd1b09848ba5d88e201e70510b74be295

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                21e09e6092bad24b7a049651a1874b7e7e4b12b3ee60d2199e6852f4540d7e5b1c46d64ab591460d58f3f2227d35de6991470795f7ecaeda662b8f03c7897c54

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\nsk7980.tmp\modern-wizard.bmp
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                150KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                d8d29ac4330a252c15fb48d9758aa378

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                21ced4f2220106e592b2edc6ef5756f26c12f588

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                42f0da3301c3739d99de30e1a58ff39baed543c3e0447bce9c15f8a95e8b3090

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                4f4ca9d3653a4587c6080a4e8827dbf274defade44cd9a7432c94828ee19dc89e3bec00eada5650db0b0f22bcb28bfe459378d2b19cc90d9fabce19a1a5b44a7

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\nsk7980.tmp\nsExec.dll
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                09c2e27c626d6f33018b8a34d3d98cb6

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                8d6bf50218c8f201f06ecf98ca73b74752a2e453

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                114c6941a8b489416c84563e94fd266ea5cad2b518db45cd977f1f9761e00cb1

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                883454bef7b6de86d53af790755ae624f756b48b23970f865558ba03a5aecfa8d15f14700e92b3c51546e738c93e53dc50b8a45f79ef3f00aa84382853440954

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___3UEEQ5V_.hta
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                75KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                528882293d61cd23bc7a763ffa538729

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                906f7424dd7b6059cec0516abdcf9c68c5774c4c

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                a7e7e8d269b53be73dab14d51e713a3a3aa5fffcae1493900553fa48ef9393d2

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                28343b7bf9d524c454978b369320009710903f0870aa5e0093deab9f08954023317b259bedb3801538ca048f55e86f9d185658c63bc942a4a9a82d7b9d6394e6

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                2B

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                f3b25701fe362ec84616a93a45ce9998

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                6.7MB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                1e82b8897008d2074d23837c59223b66

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                153898efce5be208436cd2c710952d0f03ee8846

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                ae214d6a486e1da32d794d2d5ca139be6b999b3fb3047ddf7c67fd86d12e24a9

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                e089f59f9befa1ab6465c9e6fd37cedb9b4a38b0d5459f1c53f28bea61480190b403cc6397e7fb4331fac743936435e601605ecc088b0e0a755795751c241dc1

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Ransomware.Cerber.zip
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                215KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                5c571c69dd75c30f95fe280ca6c624e9

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                b0610fc5d35478c4b95c450b66d2305155776b56

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                416774bf62d9612d11d561d7e13203a3cbc352382a8e382ade3332e3077e096c

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                8e7b9a4a514506d9b8e0f50cc521f82b5816d4d9c27da65e4245e925ec74ac8f93f8fe006acbab5fcfd4970573b11d7ea049cc79fb14ad12a3ab6383a1c200b2

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Ransomware.Jigsaw.zip
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                239KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                3ad6374a3558149d09d74e6af72344e3

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                e7be9f22578027fc0b6ddb94c09b245ee8ce1620

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                86a391fe7a237f4f17846c53d71e45820411d1a9a6e0c16f22a11ebc491ff9ff

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                21c21b36be200a195bfa648e228c64e52262b06d19d294446b8a544ff1d81f81eb2af74ddbdebc59915168db5dba76d0f0585e83471801d9ee37e59af0620720

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Ransomware.Locky.zip
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                125KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                b265305541dce2a140da7802442fbac4

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                63d0b780954a2bc96b3a77d9a2b3369d865bf1fd

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                0537fa38b88755f39df1cd774b907ec759dacab2388dc0109f4db9f0e9d191a0

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                af65384f814633fe1cde8bf4a3a1a8f083c7f5f0b7f105d47f3324cd2a8c9184ccf13cb3e43b47473d52f39f4151e7a9da1e9a16868da50abb74fcbc47724282

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Ransomware.Mamba.zip
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                f94d1f4e2ce6c7cc81961361aab8a144

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                88189db0691667653fe1522c6b5673bf75aa44aa

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                610a52c340ebaff31093c5ef0d76032ac2acdc81a3431e68b244bf42905fd70a

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                7b7cf9a782549e75f87b8c62d091369b47c1b22c9a10dcf4a5d9f2db9a879ed3969316292d3944f95aeb67f34ae6dc6bbe2ae5ca497be3a25741a2aa204e66ad

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Ransomware.Mamba.zip:Zone.Identifier
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                55B

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                0f98a5550abe0fb880568b1480c96a1c

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                d2ce9f7057b201d31f79f3aee2225d89f36be07d

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Ransomware.Matsnu.zip
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                62KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                0a3487070911228115f3a13e9da2cb89

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                c2d57c288bc9951dee4cc289d15e18158ef3f725

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                f73027dd665772cc94dbe22b15938260be61cbaad753efdccb61c4fa464645e0

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                996f839d347d8983e01e6e94d2feb48f2308ab7410c6743a72b7ecff15b34a30cd12a5764c0470c77138cf8724d5641d03dd81793e28d47fe597f315e116fa77

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Ransomware.Petrwrap.zip
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                6884a35803f2e795fa4b121f636332b4

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                527bfbf4436f9cce804152200c4808365e6ba8f9

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                cf01329c0463865422caa595de325e5fe3f7fba44aabebaae11a6adfeb78b91c

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                262732a9203e2f3593d45a9b26a1a03cc185a20cf28fad3505e257b960664983d2e4f2b19b9ff743015310bf593810bd049eb03d0fd8912a6d54de739742de60

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Ransomware.Petrwrap\@[email protected]
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                721B

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                a6801c06cec17aff3ea5d3d7a40e1c90

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                24c4b0ad296dc19ccca48074ffce93ad799dae96

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                8b30920d02dbcfd49f4479e1aa182b206be67ab0e0faabc980bb079d1a0333f2

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                28d58587ab7596ad0a80e2d24a60adb97985ac9a1af2da4791e68e7b358854511d59c63a2c89a6752473719cf01c076b2ec80a5a4a313ac02252af85b38bc309

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Ransomware.Radamant.zip
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                59KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                fce365d60e13df34a6843894ac9be499

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                5211ac4e7d8459f0db9aa19a03c55cb2063fee5f

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                3e1813da2d561157df7667cde0117fdddd883c5b1272f76d1ae85ad889c38220

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                9747c95c1a1314fd0fb462951feafa51a75c0794e56a6bbbd16d192e366907aa764bc9adbc7d8319e5d43a37b10889808ae5d619ae1202200d7dba34afa2bc1b

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Ransomware.RedBoot.zip
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1.2MB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                51250dabf7df7832640e4a680676cb46

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                74ba41bb17af6e5638171f7a6d9d49e978d8d3b3

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                7fa2bf61405ac573a21334e34bf713dcb5d1fc0c72674e6cebc48d33a4a14d44

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                43f898d7e5752312a79138dcce94c117a20fb6efd9e522fc1ed3cc2d407d13cacf5b6f810c7c1966c4c03217aeb51fce641feb31b26620ff239756132b17f57a

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Ransomware.Satana.zip
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                57KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                82f621944ee2639817400befabedffcf

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                c183ae5ab43b9b3d3fabdb29859876c507a8d273

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                4785c134b128df624760c02ad23c7e345a234a99828c3fecf58fbd6d5449897f

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                7a2257af32b265596e9f864767f2b86fb439b846f7bffa4b9f477f2e54bc3ff2bb56a39db88b72a0112972959570afc697c3202839a836a6d10409a10985031b

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Ransomware.TeslaCrypt.zip
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                479KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                f755a44bbb97e9ba70bf38f1bdc67722

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                f70331eb64fd893047f263623ffb1e74e6fe4187

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                3b246faa7e4b2a8550aa619f4da893db83721aacf62b46e5863644a5249aa87e

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                f8ce666ae273e6c5cd57447189a8cf0e53c7704cf269fa120068f21e6faf6c89e2e75f37aee43cac83f4534790c5c6f1827621684034ef3eb7e94d7ee1ac365e

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Ransomware.Thanos.zip
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                145KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                00184463f3b071369d60353c692be6f0

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                d3c1e90f39da2997ef4888b54d706b1a1fde642a

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                cd0f55dd00111251cd580c7e7cc1d17448faf27e4ef39818d75ce330628c7787

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                baa931a23ecbcb15dda6a1dc46d65fd74b46ccea8891c48f0822a8a10092b7d4f7ea1dc971946a161ac861f0aa8b99362d5bea960b47b10f8c91e33d1b018006

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Ransomware.Unnamed_0.zip
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                835KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                abc651b27b067fb13cb11e00d33e5226

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                1869459025fcf845b90912236af43a5d8d0f14dd

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                690339e6d19da0b5c63406d68484a4984736f6c7159235afd9eeb2ae00cafc36

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                4b85ae9001b9d1f11d57b6b2565ab0d468c3b8be469cad231e1203c4f6858af98d8e739b03fb849c2f3ec7b493781e88d32e7b7567c4b61cc1189daeea285bbf

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Ransomware.Vipasana.zip
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                638KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                8d2c4c192772985776bacfd77f7bc4d9

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                3b923b911d443e321e551f26c9588b16a994d52e

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                1733b199a7063443c167e3caeae7dda2315f590341ea2152a9b132e1ad8e94a8

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                6c24f2fe498cf38e3f3d66b62915e6fbc8c2746a1d4c3c3de270f994b02e1369b9540099c12d150712574ececbe63c8c9f28877d8aa4557fbbb7890d5a0de6c1

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Ransomware.WannaCry.zip
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                efe76bf09daba2c594d2bc173d9b5cf0

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                ba5de52939cb809eae10fdbb7fac47095a9599a7

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                4a1df71925cf2eb49c38f07c6a95bea17752b025f0114c6fd81bc0841c1d1f2965b5dda1469e454b9e8207c2e0dfd3df0959e57166620ccff86eeeb5cf855029

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                933B

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                7a2726bb6e6a79fb1d092b7f2b688af0

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                b3effadce8b76aee8cd6ce2eccbb8701797468a2

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                4e107f661e6be183659fdd265e131a64cce2112d842226305f6b111d00109a970fda0b5abfb1daa9f64428e445e3b472332392435707c9aebbfe94c480c72e54

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                240KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                7bf2b57f2a205768755c07f238fb32cc

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                45356a9dd616ed7161a3b9192e2f318d0ab5ad10

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Ransomware.WannaCry\TaskData\Tor\tor.exe
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                3.0MB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                fe7eb54691ad6e6af77f8a9a0b6de26d

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                53912d33bec3375153b7e4e68b78d66dab62671a

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_filipino.wnry
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                08b9e69b57e4c9b966664f8e1c27ab09

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                2da1025bbbfb3cd308070765fc0893a48e5a85fa

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_finnish.wnry
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                37KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                35c2f97eea8819b1caebd23fee732d8f

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                e354d1cc43d6a39d9732adea5d3b0f57284255d2

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Ransomware.WannaCry\t.wnry
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                5dcaac857e695a65f5c3ef1441a73a8f

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                7b10aaeee05e7a1efb43d9f837e9356ad55c07dd

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Unconfirmed 229780.crdownload
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                213KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                e71753acb1bab204cdf38c1e84adcf29

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                8aa4ec91141b10801a7b80c068a9a9710584716d

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                cb199f167efadbb3f07486983f334a087cf6368d192cef26ab0ec142fa8f061c

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                e2544a8daf34e43aa799f06193628b1e638bca0169261c901b5485a1f590b47a5663df19ee7db437aba5cd5a1fa5d37d18ea7b902fc568387f0c3d3a09b51737

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Users\Default\Desktop\@[email protected]
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1.4MB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                c17170262312f3be7027bc2ca825bf0c

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                f19eceda82973239a1fdc5826bce7691e5dcb4fb

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Temp\{316C71D9-D53D-49C9-9813-4BB5DBB6122B}\.ba\PythonBA.dll
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                675KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                de16adbe53c3cc500dd01a5ee9ebc813

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                f4b99bd3c79bfa5c3693e37a0d649bb595422dbd

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                e297b802136b33aa53b31b68183f01d421ece30dc5cc3519e45f0bcf4a47752f

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                1733e6fda19be026a062585e225f4b14017fea34589e3f3fe48b0e9f69aecff772c44f4d962096b3e0c295374e79692cbc711ef3b7e4c4c4a8544c56de49c2a7

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Temp\{316C71D9-D53D-49C9-9813-4BB5DBB6122B}\.ba\SideBar.png
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                50KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                888eb713a0095756252058c9727e088a

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Temp\{A611869F-153D-4428-9107-8B5B8891EF1E}\.cr\python-3.12.5-amd64.exe
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                858KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                7d3c4418445bbdc0b7c521a747ec014c

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                bff06746ba8d31cfc34637bac0b86158bc2de7ba

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                f268a252ca87e394a9b653a05a9ce715e1808ccf480fb84197ebf8fbc4482146

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                033ab1141c1edd39ae5b713b9b20bededf2cb9fef493d93d46c87e2f40b9f0cbe73cba7cb7c6b0f5613fa058bd67ad400aecc358bd4f544470aa8a1ca193e91a

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • \??\c:\Users\Admin\AppData\Local\Temp\23dgkr5k\23dgkr5k.0.cs
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                29KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                be0c48fc5057a467514eec58f1b1264b

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                6d656174c6c9ab1e4c3d75cc9270a2aa4079183b

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                8685fc1ef0ff239f59289b26d9aa7134998f4cc4a15b22c9a8922c071bb32639

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                157df2d4ef94906418ea32be5feedc28aac61787033e7473f0eab8e22d32a2a83ddbb5c43c16b0d5f83c8c27f167e1fcf2967df35bdbafca75327dc35ed443f1

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • \??\c:\Users\Admin\AppData\Local\Temp\23dgkr5k\23dgkr5k.cmdline
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                248B

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                02430e954e3e3a48b1859c50dccad638

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                0b7dcf28f938404bb00bc070377ebfc0d939958d

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                d9689125b150057f395474bbb286b943717f026e7db6e1db606df859268b4979

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                13cb0a558172cc63536c42e9791c5095d8e14a561e42a42788831eeec1871432b9356f96c78941e2c1193c7e2094045b0e9dcd9d3a35ab3d9fd40e46c848d317

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • \??\c:\Users\Admin\AppData\Local\Temp\23dgkr5k\CSC560B78A8BA1B450782D63698A62F6573.TMP
                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                23b36ef039b3d92b91787724c428ed2f

                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                4657e9aa0d687be968d55719f6064ffa48a64f7a

                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                fcae55fa1c020761fa034c01c24a638715d258f1f3d8d00ac4a381cf61ab8cc1

                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                fdc75b3b059ab3a16d27f156ed8799bdd1be8491802403ae3388338aeb1e0ca8312a2efe2edcefa7f121d9c33ea56328e838659fbf6d208c6f3a8ea7b1c17f71

                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                              • memory/1172-2001-0x000000001E260000-0x000000001E2B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                328KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/1172-1997-0x000000001D5D0000-0x000000001DA9E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                4.8MB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/1172-1998-0x000000001DAA0000-0x000000001DB3C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                624KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/1172-1999-0x000000001DBB0000-0x000000001DC12000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                392KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/1172-2000-0x00000000031F0000-0x00000000031F8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                32KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/1368-2167-0x0000000002B30000-0x0000000002BF9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                804KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/1368-2198-0x0000000002B30000-0x0000000002BF9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                804KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/1368-2168-0x0000000002B30000-0x0000000002BF9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                804KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/2192-420-0x0000019EC5460000-0x0000019EC5560000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1024KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/2192-546-0x0000019EC61B0000-0x0000019EC61D0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/2192-730-0x0000019EC5A90000-0x0000019EC5AB0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/2192-729-0x0000019EC5A90000-0x0000019EC5AB0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/2192-736-0x0000019EC7DE0000-0x0000019EC7EE0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                1024KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/2192-829-0x0000019EC47B0000-0x0000019EC4827000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                476KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/3536-1513-0x0000000000400000-0x0000000000435000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                212KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/3536-1521-0x0000000000400000-0x0000000000435000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                212KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/3536-1517-0x0000000000400000-0x0000000000435000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                212KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/3536-1859-0x0000000000400000-0x0000000000435000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                212KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/3536-1916-0x0000000000400000-0x0000000000435000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                212KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/3536-1917-0x0000000000440000-0x0000000000451000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                68KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/3920-2164-0x0000000000400000-0x00000000004C9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                804KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/3920-2162-0x0000000000400000-0x00000000004C9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                804KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/3920-2199-0x0000000000400000-0x00000000004C9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                804KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/5132-2155-0x0000000002800000-0x000000000280C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                48KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/5132-2153-0x0000000004C70000-0x0000000004D02000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                584KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/5132-2151-0x0000000002760000-0x000000000276A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                40KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/5132-2154-0x00000000052D0000-0x00000000053A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                856KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/5132-2161-0x00000000053A0000-0x000000000543C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                624KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/5132-2160-0x0000000004D20000-0x0000000004DE9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                804KB

                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                              • memory/5132-2136-0x0000000000110000-0x00000000001F8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                928KB

                                                                                                                                                                                                                                                                                                                                                Download