wannacry | hxxps://hypeddit[.]com/extremest/extremestdeadlyvirus

Analysis

max time kernel
348s
max time network
460s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2024 05:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://hypeddit.com/extremest/extremestdeadlyvirus

Score

10^/10

wannacry bootkit defense_evasion discovery execution impact persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDFD61.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDFD78.tmp	WannaCry.exe

Executes dropped EXE 12 IoCs

pid	Process
1544	MEMZ.exe
4168	MEMZ.exe
3636	MEMZ.exe
3852	MEMZ.exe
3428	MEMZ.exe
1968	MEMZ.exe
1064	MEMZ.exe
1984	WannaCry.exe
4992	!WannaDecryptor!.exe
2728	!WannaDecryptor!.exe
1176	!WannaDecryptor!.exe
6100	!WannaDecryptor!.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r"	WannaCry.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
240	raw.githubusercontent.com
241	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe
File opened for modification	\??\PhysicalDrive0	salinewin.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wordpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
5972	taskkill.exe
5964	taskkill.exe
6072	taskkill.exe
5988	taskkill.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-786284298-625481688-3210388970-1000\{D85E3BD4-13E6-4BDD-A705-71BC7D341ED6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2064	reg.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 289959.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 795843.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 202509.crdownload:SmartScreen	msedge.exe

Runs regedit.exe 2 IoCs

pid	Process
1204	regedit.exe
5348	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
2356	msedge.exe
2356	msedge.exe
4788	identity_helper.exe
4788	identity_helper.exe
680	msedge.exe
680	msedge.exe
4868	msedge.exe
4868	msedge.exe
4168	MEMZ.exe
4168	MEMZ.exe
3636	MEMZ.exe
3636	MEMZ.exe
4168	MEMZ.exe
4168	MEMZ.exe
1968	MEMZ.exe
1968	MEMZ.exe
3428	MEMZ.exe
3428	MEMZ.exe
3852	MEMZ.exe
3852	MEMZ.exe
3428	MEMZ.exe
3428	MEMZ.exe
1968	MEMZ.exe
1968	MEMZ.exe
4168	MEMZ.exe
3636	MEMZ.exe
3636	MEMZ.exe
4168	MEMZ.exe
3852	MEMZ.exe
3852	MEMZ.exe
4168	MEMZ.exe
4168	MEMZ.exe
3636	MEMZ.exe
1968	MEMZ.exe
3636	MEMZ.exe
1968	MEMZ.exe
3428	MEMZ.exe
3428	MEMZ.exe
3428	MEMZ.exe
3428	MEMZ.exe
1968	MEMZ.exe
1968	MEMZ.exe
3636	MEMZ.exe
3636	MEMZ.exe
4168	MEMZ.exe
4168	MEMZ.exe
3852	MEMZ.exe
3852	MEMZ.exe
4168	MEMZ.exe
4168	MEMZ.exe
3636	MEMZ.exe
3636	MEMZ.exe
1968	MEMZ.exe
1968	MEMZ.exe
3428	MEMZ.exe
3428	MEMZ.exe
3852	MEMZ.exe
3852	MEMZ.exe
1968	MEMZ.exe
1968	MEMZ.exe
3636	MEMZ.exe
3636	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 42 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: 33	3592	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3592	AUDIODG.EXE
Token: SeDebugPrivilege	5972	taskkill.exe
Token: SeDebugPrivilege	5964	taskkill.exe
Token: SeDebugPrivilege	6072	taskkill.exe
Token: SeDebugPrivilege	5988	taskkill.exe
Token: SeIncreaseQuotaPrivilege	5316	WMIC.exe
Token: SeSecurityPrivilege	5316	WMIC.exe
Token: SeTakeOwnershipPrivilege	5316	WMIC.exe
Token: SeLoadDriverPrivilege	5316	WMIC.exe
Token: SeSystemProfilePrivilege	5316	WMIC.exe
Token: SeSystemtimePrivilege	5316	WMIC.exe
Token: SeProfSingleProcessPrivilege	5316	WMIC.exe
Token: SeIncBasePriorityPrivilege	5316	WMIC.exe
Token: SeCreatePagefilePrivilege	5316	WMIC.exe
Token: SeBackupPrivilege	5316	WMIC.exe
Token: SeRestorePrivilege	5316	WMIC.exe
Token: SeShutdownPrivilege	5316	WMIC.exe
Token: SeDebugPrivilege	5316	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5316	WMIC.exe
Token: SeRemoteShutdownPrivilege	5316	WMIC.exe
Token: SeUndockPrivilege	5316	WMIC.exe
Token: SeManageVolumePrivilege	5316	WMIC.exe
Token: 33	5316	WMIC.exe
Token: 34	5316	WMIC.exe
Token: 35	5316	WMIC.exe
Token: 36	5316	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5316	WMIC.exe
Token: SeSecurityPrivilege	5316	WMIC.exe
Token: SeTakeOwnershipPrivilege	5316	WMIC.exe
Token: SeLoadDriverPrivilege	5316	WMIC.exe
Token: SeSystemProfilePrivilege	5316	WMIC.exe
Token: SeSystemtimePrivilege	5316	WMIC.exe
Token: SeProfSingleProcessPrivilege	5316	WMIC.exe
Token: SeIncBasePriorityPrivilege	5316	WMIC.exe
Token: SeCreatePagefilePrivilege	5316	WMIC.exe
Token: SeBackupPrivilege	5316	WMIC.exe
Token: SeRestorePrivilege	5316	WMIC.exe
Token: SeShutdownPrivilege	5316	WMIC.exe
Token: SeDebugPrivilege	5316	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5316	WMIC.exe
Token: SeRemoteShutdownPrivilege	5316	WMIC.exe
Token: SeUndockPrivilege	5316	WMIC.exe
Token: SeManageVolumePrivilege	5316	WMIC.exe
Token: 33	5316	WMIC.exe
Token: 34	5316	WMIC.exe
Token: 35	5316	WMIC.exe
Token: 36	5316	WMIC.exe
Token: SeBackupPrivilege	2588	vssvc.exe
Token: SeRestorePrivilege	2588	vssvc.exe
Token: SeAuditPrivilege	2588	vssvc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
6100	!WannaDecryptor!.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe

Suspicious use of SetWindowsHookEx 27 IoCs

pid	Process
1544	MEMZ.exe
4168	MEMZ.exe
3636	MEMZ.exe
3852	MEMZ.exe
3428	MEMZ.exe
1968	MEMZ.exe
1064	MEMZ.exe
4992	!WannaDecryptor!.exe
4992	!WannaDecryptor!.exe
2728	!WannaDecryptor!.exe
2728	!WannaDecryptor!.exe
1176	!WannaDecryptor!.exe
1176	!WannaDecryptor!.exe
6100	!WannaDecryptor!.exe
6100	!WannaDecryptor!.exe
5876	OpenWith.exe
1064	MEMZ.exe
1064	MEMZ.exe
1064	MEMZ.exe
4428	wordpad.exe
4428	wordpad.exe
4428	wordpad.exe
4428	wordpad.exe
4428	wordpad.exe
4428	wordpad.exe
1064	MEMZ.exe
4644	salinewin.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 3332	2356	msedge.exe	82
PID 2356 wrote to memory of 3332	2356	msedge.exe	82
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 4580	2356	msedge.exe	83
PID 2356 wrote to memory of 3840	2356	msedge.exe	84
PID 2356 wrote to memory of 3840	2356	msedge.exe	84
PID 2356 wrote to memory of 4588	2356	msedge.exe	85
PID 2356 wrote to memory of 4588	2356	msedge.exe	85
PID 2356 wrote to memory of 4588	2356	msedge.exe	85
PID 2356 wrote to memory of 4588	2356	msedge.exe	85
PID 2356 wrote to memory of 4588	2356	msedge.exe	85
PID 2356 wrote to memory of 4588	2356	msedge.exe	85
PID 2356 wrote to memory of 4588	2356	msedge.exe	85
PID 2356 wrote to memory of 4588	2356	msedge.exe	85
PID 2356 wrote to memory of 4588	2356	msedge.exe	85
PID 2356 wrote to memory of 4588	2356	msedge.exe	85
PID 2356 wrote to memory of 4588	2356	msedge.exe	85
PID 2356 wrote to memory of 4588	2356	msedge.exe	85
PID 2356 wrote to memory of 4588	2356	msedge.exe	85
PID 2356 wrote to memory of 4588	2356	msedge.exe	85
PID 2356 wrote to memory of 4588	2356	msedge.exe	85
PID 2356 wrote to memory of 4588	2356	msedge.exe	85
PID 2356 wrote to memory of 4588	2356	msedge.exe	85
PID 2356 wrote to memory of 4588	2356	msedge.exe	85
PID 2356 wrote to memory of 4588	2356	msedge.exe	85
PID 2356 wrote to memory of 4588	2356	msedge.exe	85

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://hypeddit.com/extremest/extremestdeadlyvirus
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1f1946f8,0x7ffa1f194708,0x7ffa1f194718
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2108 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2172 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1544
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4168
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3636
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3852
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3428
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1968
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /main
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1064
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=internet+explorer+is+the+best+browser
      4⤵
      PID:5544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x104,0x128,0x7ffa1f1946f8,0x7ffa1f194708,0x7ffa1f194718
        5⤵
        
        PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz
      4⤵
      PID:6076
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa1f1946f8,0x7ffa1f194708,0x7ffa1f194718
        5⤵
        
        PID:4332
  - - C:\Windows\SysWOW64\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
      4⤵
      PID:5960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa1f1946f8,0x7ffa1f194708,0x7ffa1f194718
        5⤵
        
        PID:372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
      4⤵
      PID:5800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa1f1946f8,0x7ffa1f194708,0x7ffa1f194718
        5⤵
        
        PID:3716
  - - C:\Windows\SysWOW64\regedit.exe
      "C:\Windows\System32\regedit.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Runs regedit.exe
      PID:1204
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3020
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/
      4⤵
      PID:3284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa1f1946f8,0x7ffa1f194708,0x7ffa1f194718
        5⤵
        
        PID:2976
  - - C:\Windows\SysWOW64\regedit.exe
      "C:\Windows\System32\regedit.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Runs regedit.exe
      PID:5348
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4428
    - - C:\Windows\splwow64.exe
        
        C:\Windows\splwow64.exe 12288
        5⤵
        
        PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=internet+explorer+is+the+best+browser
      4⤵
      PID:5196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa1f1946f8,0x7ffa1f194708,0x7ffa1f194718
        5⤵
        
        PID:2712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+download+memz
      4⤵
      PID:3620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa1f1946f8,0x7ffa1f194708,0x7ffa1f194718
        5⤵
        
        PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=stanky+danky+maymays
      4⤵
      PID:3044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa1f1946f8,0x7ffa1f194708,0x7ffa1f194718
        5⤵
        
        PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+buy+weed
      4⤵
      PID:1620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa1f1946f8,0x7ffa1f194708,0x7ffa1f194718
        5⤵
        
        PID:5792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=mcafee+vs+norton
      4⤵
      PID:4536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x11c,0x100,0x7ffa1f1946f8,0x7ffa1f194708,0x7ffa1f194718
        5⤵
        
        PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself
      4⤵
      PID:3680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0xf8,0x134,0x7ffa1f1946f8,0x7ffa1f194708,0x7ffa1f194718
        5⤵
        
        PID:2728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
      4⤵
      PID:2020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa1f1946f8,0x7ffa1f194708,0x7ffa1f194718
        5⤵
        
        PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free
      4⤵
      PID:3520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa1f1946f8,0x7ffa1f194708,0x7ffa1f194718
        5⤵
        
        PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:6128
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 110211726896358.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4432
  - - C:\Windows\SysWOW64\cscript.exe
      cscript //nologo c.vbs
      4⤵
      System Location Discovery: System Language Discovery
      PID:5184
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe f
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MSExchange*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Microsoft.Exchange.*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlserver.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlwriter.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6072
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe c
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2728
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b !WannaDecryptor!.exe v
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4812
  - - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
      !WannaDecryptor!.exe v
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1176
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2308
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5316
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4964 /prefetch:2
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1996 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7360 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1856 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7468 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7792 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7596 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1696 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8164 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7584 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8084 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8476 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7516 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6741380840666128936,2408299173469521082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8232 /prefetch:1
  2⤵
  PID:2416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2420

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508 0x2d4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3592

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2588

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2588

C:\Users\Admin\Downloads\salinewin\salinewin.exe
"C:\Users\Admin\Downloads\salinewin\salinewin.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
  2⤵
  PID:4160
- - C:\Windows\SysWOW64\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
    3⤵
    - Modifies registry key
    PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
41KB

MD5
3fa3fda65e1e29312e0a0eb8a939d0e8

SHA1
8d98d28790074ad68d2715d0c323e985b9f3240e

SHA256
ee5d25df51e5903841b499f56845b2860e848f9551bb1e9499d71b2719312c1b

SHA512
4e63a0659d891b55952b427444c243cb2cb6339de91e60eb133ca783499261e333eaf3d04fb24886c718b1a15b79e52f50ef9e3920d6cfa0b9e6185693372cac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
67KB

MD5
929b1f88aa0b766609e4ca5b9770dc24

SHA1
c1f16f77e4f4aecc80dadd25ea15ed10936cc901

SHA256
965eaf004d31e79f7849b404d0b8827323f9fe75b05fe73b1226ccc4deea4074

SHA512
fe8d6b94d537ee9cae30de946886bf7893d3755c37dd1662baf1f61e04f47fa66e070210c990c4a956bde70380b7ce11c05ad39f9cbd3ea55b129bb1f573fa07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
1.2MB

MD5
2f425af469ace46598b858bf74c06efa

SHA1
81c7b579e072b467e19641347b296866c1703324

SHA256
91c39739d7c5ace7bc641c6a1a7b04327b8e7bdc384250f72d110b8a2d9c1a9d

SHA512
f02b67cc73a1a0602d2582e20711de46b3c3318afb264b9fb7a66ebd7b8fb6c54d29c802e5f4a036ba166fd76c69f95bd7a1e355f923276af5d52e2f94e6a4bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039

Filesize
18KB

MD5
2e23d6e099f830cf0b14356b3c3443ce

SHA1
027db4ff48118566db039d6b5f574a8ac73002bc

SHA256
7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

SHA512
165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000046

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2813201257d0f2db_0

Filesize
19KB

MD5
fa1a8bef17a017058d8934a4843a6009

SHA1
f2bae949b2083b6facdab300d186df6f272875fd

SHA256
e1705f799faf88e1ec097af460df5a6dd06d3bb2222e15afe99abd2f014ac466

SHA512
6ba79dd3dd17a81f631cf75c6f903bfe7603a329fb84331fc95ebc866c9fada55d22d28d4f5e154bcf630cfb252344ad8150109d3297ac73d19c23c478d2572d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bff8bb9f4c37e826_0

Filesize
434KB

MD5
bc1521f964c6c6c3233232fb4d9012dd

SHA1
598863b2abbb8ae2b88b6e8ef8fb3d692db0b3af

SHA256
b525a745bc2816ebcbd0bbbcfcd04d964e76f23350bdafe0f5c2a6d372b6d962

SHA512
a7f46ac361f42b741010cb9657d85dabc2e4dc862516ca1a1d28de8fe3412b05176a539c5c8a1d1086fc50916ab35cd6a3dc6f3b485e8c5ba5de795e096c53fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e49febadf8ab02c8_0

Filesize
288B

MD5
f5216a3cd76e2b0c062b0f1de4c390a6

SHA1
bb52a63eb3b23c5a5e541719cd2e4d05286e050f

SHA256
fdb4efd7403bbe6fa8ddebd898092905a9e58e31e150762379d011f9890080cd

SHA512
68f1f5d9a6db5a30afb73c8affa83e96b737e7e162cea5798b32567e5e660df5564405b19b4d0afc68f23fc1290876b81a93a74cb66c40ade9221cccdd0177a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
fc202072d69fafc87c5636298a51c5ae

SHA1
b7d55b646639607f11157bff326397492d07802e

SHA256
22d8e029d79f7b75aae1d96dd5155a6eebf79b58d761691dcbeb29a3ef592372

SHA512
081996bfaa48ff186a1b130b8c657d547ac08818f3487df12f05a803037d6fe9108c7228ed4d15a0c3c4cabf08f1527dea63ef68bb455d99a9ee2e5c6b23ae87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
3c7be022e585058e87f106a6ad6808e8

SHA1
761f7e0a46fc1c7c9f2d09fd2c7b9758c68ccced

SHA256
9f32056119c2b00b05cdfe8514685c162819f22bc6a8eafa8751bf3f09e66c1f

SHA512
c5b1b8900f9df080ee428e1c26ea338122c49e46f6a5f1678fc4638a0f4dad6d8cac40b67dc3372c133beedf1f8b09ee5745ccfd6189994a3cf3774dcc6db455

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
29dfbac9793220c8e4a73474199364fb

SHA1
a0e1d79d5fa908e561b70bf0bfa28fb304cc96ec

SHA256
486ed6e4179262f1aa69095b370c51aa6335869d69ae0660b80290a9ecfe9c99

SHA512
cfef00fffb34cf7ac42594924a2408b8b54fcaed614bc1370180136da540dc08a00823118fd7e9b5892fb0121dc7a9ed23faa027749be7d520d7cf50fb4983b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
604390d4f4c720eb2068709d3d9de6a0

SHA1
43126610e582e6ccb976f3ba3b1a60135ff0ee91

SHA256
668d40cd1c2e62a47c4babc7b10aa8ff892337a02d7791841d6774586e80294e

SHA512
6e40c5ae422f5d7a4162ee9d14a962bfad679a6aaba9f8c705c813b9424cef84bce9a3317fc62089dc607c6ef47239a60eadf8b636586c83a4f93f9e4fc96669

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
9e6ccbde9bc4016a365e5d8a858b6a24

SHA1
475d16203bd88383bcd7480b8f60ffef25a7a601

SHA256
c0d43bd3071c4ef0b0c2af75f9e1d85343d3ef0ff8b84d095f543eee4120f40f

SHA512
a93e01c4935344dd1d50dd5d280998c6a1aa6f6dde1678b5ac9bb8d0284c480bedd70e84a33f631ae9a43e3f4b060e73edfe2e2872567ab4d09192c9bd5e1ce2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
0ae4e9dc1d55b737a5d560af11169589

SHA1
86fd6741e28672db79b65e813b77f42c2e92f925

SHA256
a778e19dc39b5309cc20100b796aadb1f274b47dabfe6a944799f9edf19947dd

SHA512
92a9c39f3be0765a0c18bd60a63f2cc36bab3ddc7d6cd1f66e2e120ca3fa6f124c0231bd7ecfdf744fe01898d01a890dd826e75cc47b15aba7ab111d20631544

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
08d5393440d9edfa1da7d4838a2e718c

SHA1
6093cec5aaa634c01b455bae2060885718630639

SHA256
c6949b626bbc527ad9585e700b5a327782554664330e34d4e96e0face904d359

SHA512
2d2508c8d1276e4ac7c5d758bc764b937623433563cc47bc84a1c514cf755afda395a30bde7b82ad60a0d7322a3b807759de936498bac766a166884441efb1ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
0850037fe16def98cfa6d9fcb26792e9

SHA1
affd1499e1ff0c4dba5f798b0ec4344bef7b10e2

SHA256
c49ad6765d75b948aded3766d282353d33e8c60daf9b3270650d61d345e03fc9

SHA512
1e7caed437914fa493e9029dce26a5229b2c95252ebacdf376b9888b92b81cf81be4993106a7a4053e96866a4644829eb9e252877999beb0fd0534f50bb33137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
963006b7fe03d5fcc3e7908de42e6c03

SHA1
d7e4459c27dc0d9310c75eb0d6fbc111ddde6146

SHA256
538a8a8ee5b9e8130a886fdf5123e4300577bb31a225f8d2218b1638cf012933

SHA512
e62e3bf60933d23429cce862a0b5afdec5d9b81be20d6a802a89024d8e8c764c4c6895cdcf860a21487554782383ef3fe345e3c14bf5dc47285acf985a466a5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
4f8b5d5a19a83d6ab22f1fea89f2b529

SHA1
47396a8984bb03c49cdafb507134ad7720afd2a8

SHA256
c14d6f02b6ccb29b6df13e61c8dfec9f06fd13f942a6086878df5a47e44079e7

SHA512
729d9be72b54b772057d7d01b4ce2c58d900e1ab5c65b9227ff473953a910e86dfe927b1fa73249bd628a13e8e0d78e3dc0c02538dafb389a79478fe8d9fee20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
c45dc847a046df2cdef7c2a9229b6581

SHA1
155d06613cb6ddc70a899d79e1995acd75c8adb9

SHA256
666a1c29c4c2a1f125e70304f59abf3e4e8d55a7f4149b618ffc50f6cb03eb1f

SHA512
8ae650c2e8ef985c0cbc1cd308cecfadb5872b60cdbf710e371ad2450a8684d3aaab42b3dccb2ba5543accb0f9ae5a8fc939666eccfd332ba40df1b130bd00d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
24b53cc9c3e7111c27e1034731602a52

SHA1
80e7b124fd602ff469ef2e220ab57b3e21103224

SHA256
640403e91149714fbf7b9654b107baa4c21af03fdc8068cd3547c3c86b84fc64

SHA512
a99d79bc573a43cdd4913ba243860d8d21c9ab83467587707dbf103a7720825c91a992af3d6529bc0034f86934262de48f59f29f999ee21d46c01464b064af14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
b6b86f60f8e6a53efdbc7d41640c0f78

SHA1
e76aa44b3e9556f5a42fe74bd60282616bf59d1b

SHA256
a381a0174beb03e72b040bca5369f5b69bb470afc5e54c39f880c70530f2e5ba

SHA512
c84e86fe9eb79fa02dba0c590fa06dcd75a305686527b960e31f7fa94f297e8399411753547eb7f42ae4fc45a449144ae5bc8361cf4741ae3f2b133437009887

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
9a57856460cecc53c81e5a001376b1a0

SHA1
f1829e963c0d80f4831c3ddc80714f78bb7349ad

SHA256
375c860f115ce325250b3a9c5a8860618cfb789589dd2167c6ed1730c35480a0

SHA512
d6ff62e81b542a9459408a59da8c708fafd14cd0f2b4ff56fe14f3057d2ee761f90590a527979550c98a3a53bdc831926c7ffffebe0c2e2fd75a4d40a1865773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e3211546845dd20f027e497d54a7cc3d

SHA1
5a202c4715be55f96d46988f38a4dcdabe9132c1

SHA256
4e089e9a9a97f818714c43816466a90eb41084063949e0ca6aefdfc5cff19b91

SHA512
6710d4db4e8fee91ebc97fdb774a5e85bcf65fc891ff0a5fd19fdc0f1ab272f904b7cbfeb053d1e0dfe712a02e895437898bcf95d5afd81cc2b0b69b890f2a24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8bc84d9d95766db4b153e49e32101cb7

SHA1
22f2e02555499f9bc3d7a18166c33f76801614df

SHA256
4e7507e064a387746d962386a0d968ff65ef4387ba72f13376394b9c81bd1a9e

SHA512
71101f1f3f0d7a750741b982cc5c423029f55a56f94ea7e51284378366980ea519bd862e4b91e8a9d186de92326a6f4476b1f9acd8525e1255eeefce2a21048a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
3b6e3341d3e2a0ab293fe5577ec6682b

SHA1
d8dfd796bc9d4fa60e1487d1f4709c381112d912

SHA256
93d70fe4c939f40b9f18f0ad659803b57a464e75d6471f11d1b16b94889a9b31

SHA512
4147c9b05b1786f85257b898224490effd8c2f0c001c8c106850f8f4cecab56b7980f7d7745c06d5d0e8eea61904b466277672c946f07935d19daf677a9737e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
e3b5ebad2b355aaafc097e5900b0b357

SHA1
d18e9349c4d36c7d6d69c32965ec57c0d339ba36

SHA256
890b0f304226a4927646c7aa99035d0093f2b60a800a992cd913ff31cec34b8e

SHA512
12c9ce53c57a42427a50defe6daf99458bbdbd079cd47c6b7970fab8677681205c5e5ff82ceff075cd2dba56217aa5ae25c1391c0ce221409c7d2ad1749df6bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
42ac5865560ed2dff424349d7a1210bd

SHA1
555c559e6d1b5a46d645aadea2f1ecaf5aebeedd

SHA256
53f5e10b03c304f9f5dc1c5dfebfabff6a4511f90de03d93e6274e362d22894c

SHA512
459ffce7ac2821e2ed50f9ab39602c83e960460d88c5a0175f265d8234640ee4944e1dd52ac5dc72cf3536057f59c743467505af7a898caa9ec5530643b56c2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
b264e22372a479427d632293f1df062f

SHA1
36403731cdc6c83ca291725b362b5a50c497ba53

SHA256
726512eb12a7b24b26ae641f9323f6dfe9d519258f2cc57006682385bd94534d

SHA512
dcedf6442206e6f0f68c13d60a4c8dfb07758d9227383bda0bf7fc963a911de04bae5e7259a34e79a87fbf156781997dc11feea80f6415631793973178b8628d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
6f8033ae890458ffbd077aab0e28cd88

SHA1
2b434ee1a3aed38330f41b8a733738ee2955bdda

SHA256
910b3f382c3f8fd1fcf7fee3d6060ecfc685082e0e678614c645362caf1649a0

SHA512
e7048885a5a3b262d6a0c3a1d27ac89182167fe640f44b9c589feb5bb929cd881cbdac0aa674a54b3e3f91fecbbd106bf98952cd397d9718d15672d5f1a290ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
1b31a92f801111ad9f96a0cb6120792f

SHA1
cb554405cd9a65e8ff39493e3d7d7fe9fa949604

SHA256
159453f4e87c1263bb9048eae4d9a51e2379988042d10ad0168733f10515a1e0

SHA512
d7582aca8795d2b010d236355d683f4420b3faeb0f817ff52d85a4051a3a1e8cdb057dc5caad1c74ac36147854f6594d014ef6956fd5f9a36915fedd90779785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3448326f6804047d6c51e2be7ba4be50

SHA1
78262a6504b1436f1b5ccdb51a8e78bd02eb5c20

SHA256
5933dad0e5d7174a8d83d1a6836abcd7fb11d01b7d102a5e7aaf564004daa38f

SHA512
f812d23b47d6211ac891113094f724ec970413bba397bb8d26bbada8728400f39ef623579ae95a0fe928db6c5f928f85a2535091f43e68de6aaae70e9564fe4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
e5bf4197ea6b509fb6698a58372efbbd

SHA1
dd8f22147f1f813800a78e1f65857cf09fc01a4c

SHA256
c4f33293ce6452c9486f6ac4c7fe36688c7abca2a6c27c624e6a3582754ffa83

SHA512
6fe8bd2ade923c43aa26cc0ab7e1440f374d23516ef140993321669c327075de4145410ba54ec3e96b2d6c4248b808f645790b813c0d317aed7c49666efb1767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c0585ff32b518a449cbe4f2cae2e2563

SHA1
585a223a796ddb1820b1791244e34fa928870cb7

SHA256
07cef650907929e7b92cbbf47317118fc73fa9889a6dfa7e2df527309b391dfe

SHA512
dc4b15058905af76588b0408eed0cef8bfda76db56d2c3c69cba742721338a6b9ea48236eb3e0bd52127387e63d008bcf43346c7fd7356de21720f9cfab3db13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
26380556212848a78800683beb4f90b5

SHA1
e39caf9a310ab55872087d5d1d2aed24153619dd

SHA256
13a57e14c0bd57ab998d1f7adeb73cbb40ce063b9c38e587b9c4ff010ff7edf4

SHA512
01ac51f57b9846fbc17b2da42bf34022a537c7db11c9a0f00a8b3f03b6cc5d80769931efde6b9cd27398ebf6fe470128a7fbea4485269c42d6e030ffb6a126dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
fba0c77489fa90dba7af9cd5d3a7574a

SHA1
5eb266d03388f3f72dbb0dab064ce504aaf3d4c5

SHA256
e6b8686e45da2e138e2c2d936e4368c034d567be7f5895e8132f592744d4f190

SHA512
1df9ed76b09f230380d17c46ba61a5d8115e775b6091999034cca69e015f8f07c145376d0a663d3a6fb72dfe5493c73f5bc60a6b02036e61bf17da20d747ba75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
a2f1892556b3585d52efe781ce1db37a

SHA1
4fdd35bd3ea22340a7b650c83f855514cac6c843

SHA256
efd989c8cfcc68f33daa4ccea63e4b72653fff95206d3246a947316de34351db

SHA512
9aefabae425e3b089a983b215a463661561abad0da1ebeff813d7abad1176a2a01863fd7dfadd60c6837bf621dbeb91e345b6c0ef853a32981de95dbc3d6c4dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
34f129542ed461d10141f16bbf1c55bd

SHA1
f701fba845a6cabcc6001a8deb805d11859e5812

SHA256
b6c11c13d335c47681114987a93e231df01e5ea0e7a68e72be3e67b214f09f88

SHA512
b9373b6e5b04e152f5825e07295353c16f5e5b6c753cda7f3602a2f215018dbb82dbfb7ac903a4f5ad961a005aff1683de22599d2729f42ecc773703c5723a2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
8daf24a5d4a6a439086c7aab52eb4ebc

SHA1
66bd754c7ee9a89c0fa51187dcb2fb453d4402dc

SHA256
8e6c6e5389034aca2920f952afcc3d301689ee394686f13d7d6aa708c262110d

SHA512
49e8a3af46b0d949b508be12d70097be9c72cf14e325ed0b0ba4a72873c06402514acd7960f031f336431f7c4d803d86273abadda5f8f5551f1cdb6fdb6883f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
e5be91d18e8cd534f2f8e3da11193766

SHA1
bfedd12e037f56fb54e1c0f35a73080980e4bd7f

SHA256
98d68417bae97950bb01eb574bc35b5ff31640e25eda2ccaec9e4d88f29e7897

SHA512
46678704e852806a768b9e11c17a882edc2f1d1376165267cdf0ad4f513f35f75119bfb18af53645a2a3a5aa71a5aa26196b4d015538dd2d219d1975348daf28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
5de8347f7d7ce2f7e3a4ce5b2c87ab44

SHA1
d1e21f4c34b3f53930d63f7bc3c37720ddf1ff19

SHA256
d7f0d759660c006c7d93d92afb01326493bf6180bbe9c3f57c53b13ba6fe6dfe

SHA512
2217070044a11cc87b1f822bad72ea96f652933c92ef765a225007fe67347206f00ea07e318d5a6109778c4298254231469bc194d02ae9b9968c3833f8c85297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
baa79adc8c7dd2da042bed843e75f092

SHA1
be45ffef5b497d9593686ef8fc6f86d3b575271c

SHA256
04093fab1fc7f9b7dcb51d6e958c16ac22bc047315ae9a4178a4c51ad461e12c

SHA512
e47cc2286d2f8e281560254fc2e25ef88eac8b874b599dd647e0940bdc75062fc417a0159fdd5ab458e35c5936a4e557d40db19a4f7cf4066e276717d8e611ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
3770f12a19439db33666cd16952b1adf

SHA1
b986846adb6b5b1d6d6a13ab8b8ed7701e0ceb46

SHA256
cc3965b2a5aa3da8316bb2fd1d4d0af3a7dc726a8cc0250d933a4ff810b6b1be

SHA512
bd4c325d2d86e0b6503692139916e749a6399df6b5b64e1d5c74c59b1bcf1888311214660824e2d4c0a4790e4490ea48e7c4f5dfdbd0983dd8d4050666a797d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
bd05e14b4b22f3ca51f909b5c50ff5ee

SHA1
77dca3a2b03c0b77fab1e9c69574f4f4a4dc670e

SHA256
737c3d420e9ed558c48bb7e2e77fa25a76f287e0e1446adcd009c350809dcb48

SHA512
b9c4723bffaa1393f9a27c101ff51606431aa2f42b1ee719b986f677f875d1c2aa84a13b0607dcab51b02af366059ae773092ea40701a6c8d5d1f853d8780471

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
10804a174ed9a2046ded9f6f4ba018c2

SHA1
c109960272118ea8f5404dfc361dd48ebccbda0c

SHA256
8347955f1c7032810946a5853f716f6a3cff224b47cee7ec8f1990bb3cd9d95a

SHA512
da4e5138cc841686e28e9acd8a99e94ed0993019d46877c1c1f8690c85a5b3cfd5d81057685c64945d76aab953d57cdc78b0efc0903d240925b01aa29f69c7ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
7ddd170aa7166879af05c879baf2f4f8

SHA1
55b39f4681b62624e8402c2ef4b11763e9990811

SHA256
e5f88903be36e4cd4d92a39347f9d40c8ff1009fad2499a5864b070048320b45

SHA512
54f0fe40b289925738d35838c7839a448de6a809901eb5afd581ee943165d7186dd4bee90a1eb24f54cb85ec941c7cf26bd7ad7743e5810409766b6462ffaa0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
51e0498f586d579c129975ef7204d8b6

SHA1
c5b9658739163d0f96ee215af370d32ef68fe743

SHA256
d39b8e59c90a7eb16731024fd49575a41359864a2ef468fc7d59091b72618b02

SHA512
12d3ba888030db436817e06f46a3c7b159afb461a9422a03bec87a252817cc4e2c3e2931dbfe33c679855e77b6f8a004e24eedb0dd49303ca1753fae14200ef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
5a4d7442a7bd211c9e411699867e1c9a

SHA1
b3eeca6aec2ae625941a6645d34c78d9ea87e864

SHA256
ee3955a3fb26628f586968b400c0725d4983a0758adbe3c7601ce23ab9e1b1b2

SHA512
b0a7497ab13667f5fcdae756645b67291ab00a70a296943fc921dcd9ff89e2e8ec62d1ec0cb01cfe566225e1767073aaca137474ebdd43a10f7116d8af6b4213

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
1a34918f6b24caad34f6f9365e592ea5

SHA1
12167670a5b90b8b916c7906874725519336ad0a

SHA256
b2c3f9f6e094b9a291cc4cbb5e1deb3c4e74d37cae8e9d7959d51427bd590fff

SHA512
050c2b358cf4af32f24d7279a4d2aeb134b28e9366b7c55228f8425ad931237030f7fd93020310cef6e8d8f8e6474987a1fccaa167ed9965a19de55c736230c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
af97e54fb002120137b84d48d9f9198d

SHA1
81b5ae85ec7d7f4180928f01fa37a7bf3b7d4e08

SHA256
216755c5818671484be0bc90a66c032a43ebff10d2a4273b50e1dc13078dd6bc

SHA512
b6c59c5bfcf276fb8de3e380ff01cbacb706a7fe1579d7ffec6697ac8a2aaa3dc42b7088e32d7e98ceb3769ad6c09280be27155c36fae38c8c3cbeff32b397d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
faf15a8e256493a93ab846925f4f82bd

SHA1
b4fae799bbddda339cf83b8389a64f4444d1a87a

SHA256
704918f8416b36474a3bcf913d9b1717c398b70e240b30e84aa12ceb3faf094f

SHA512
223b64e9abf2dd7da9b9ba5625b8960404718101b3c6000130dacfc553374ee19e37e94eb5ccaff41bd0fb1c480f8b14733a7006dddb2b711b2d3f2f2b6a64f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
e7f9035be7080ff9ecbc8b24e44c067e

SHA1
e55189f6c2af5396cd5e2ced989098ad6c172dce

SHA256
09316d6e3ad45ed603b362cb02ac38c975e69083ba05164cfef55f27ef2ee475

SHA512
5ebc60bf7b82ca8767758503e8da232cf5d9916694d57ebb0b1a926cac25f3a508806a3c02b416b695f052e91c262280eef053ec5626426cdcf992b01d9ce110

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c7998f864f24ec1b38af70a34cfa056f

SHA1
0f6da75ecd3eaab0edf9538454b01f09bc656fd2

SHA256
8fcfa96ee62af3455c40924f1263a11bb87243be6e4cd4d42c95d1eb759729bd

SHA512
33cf450ac42e38fb483a243b38c747d1c9dad286d695085333cfab0d01688328d639e0b981d18d9e5c62661a05b3aa65e9abcf3270f7ec9c368ccb1f925a036e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6ed020b0a92ee9374af2421d47d9ecdf

SHA1
175880798d4295af49c8a497e67e8a5f9a660a25

SHA256
6585149ed53c4a357443d38fc5fca043c8d9f5f2e3f8126dd1d0f6a1e83ae007

SHA512
8ffcba383dc37c1b2a62257bbe2d388cc9a3491ab3f5bca011099dbccc0d8774df35933b80b01bc04222e0bd936987c079fe2c4de9d78e931f4d52ff275b297b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
ce95ee901845768eb1e9a8bfeea53606

SHA1
56e7e2fcbedf64af240cc59db1de0bab660a4f8c

SHA256
12b544c2cc97a6759e94bf485031b4469e68392c683ce30715d8da961e034af3

SHA512
703fd90f98e4eaca666abca91bcf6589ab02744a83c9567fd0af77a850be154138d4b3c083659f5546a7065be0664e61467fa701f3bfea1f4ecc0be401f6d8d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
ee5a8572dd2336df4c25b15056181005

SHA1
5db70b0e456089076db1df689a4cae9ffe257e06

SHA256
787078e0955e356caa14da7c35b37dc91478064351a7e82cf9cb475803b46d80

SHA512
22eabd6ac9a8627cc2185769c5e3069ec4def9c640a2eb642f20e9f756edc29f7fe62390036fb517e6d2c744da4d3d166477f70e0addb106c82d7620ee6e027b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
dabbf09f60bbd252638dddea3011b304

SHA1
9a5d5f97dba3bb3d0f5cae058500df4782946f1f

SHA256
4daa4d309127597e0c20509816e8e06fd631df21fdc29282bdd6d724d1ac4ccc

SHA512
44787611642b6251eeffc5a58dd367b563292dda100748d6e6392fa7b113f1d63d8e9ea566442599a4cd6daf4dc993699278e0b5f5d62ffa66afbe9741d4cf53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
230eb537db4be87ed755b40c252cd11a

SHA1
660ff74c6137efe2600e7258a833a8460eeaaa8a

SHA256
3ab73287e2c91047e3522b81e9ad0366ca99f10aade6d5d07de66ef62d390f6a

SHA512
ebd539d634588ab1df6f8bbf8281d59865e52b14f6456a6e3688cc5e855e9f08b79f8aa33ec64d9f3a2349c17f438f7663c6d6cae91e42dd11c2c75fba18823b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
4dc077a2dde3b0f8ba4a4ae87fe472e4

SHA1
e722511eec5815e5bd56a2aec0d6787eb7963ed6

SHA256
11a89404aecd05659fcef3c104cae3ae32eabfd8c52447b7731700a50062f472

SHA512
f905d5b5b9195a44e771dc33c550bade4df7e0b564d5fd3389bfd4a2195485612609e65b4fa309cb51bfb69fe74f7ff0bada301163ec9b6d3f0f274497b1ed7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e82d.TMP

Filesize
2KB

MD5
b3b2035f0e59dff8b30efc63d8a3d0ae

SHA1
fd5d1f7dbd04dcf71c4305ee80be6e992fad2923

SHA256
b7909ebb58da54cc65ac40427047778f1ab84dfde8b65e1048f5d46b7675207f

SHA512
adec9d38368b2bb0830d646d5d58c4bebda17911cc5b95322cd583a9a2b40feb643f81cb3679dd4042e1c7ff3cc62432c386046bfa08842735189fd24e73b279

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b67a0610-7c93-4763-9160-71d9a45c4638.tmp

Filesize
3KB

MD5
d3d6d0e0c55539b162c8d34943fd1605

SHA1
3b596c4736116d015c1700b338e536edb28c27db

SHA256
149e444622552861d08c1f7fd177b502b8b1936ddd55b9b1301608fd11b33248

SHA512
a4c80a06497a492436d65b6153f7b948d5383d421c5a09b65240c1c66da020f55a5f40671f4a82b5ac698f2e132f07e1cfb38c1c7f1758afb2eb444ee7ee0178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
88KB

MD5
b0b3d4b88cf799136f7d55282590c35e

SHA1
c9b352f1cfcdfd95e0974693d532f111971ba378

SHA256
f686c9d92b6b7af4c2c1283c776e194287a58bc5af892e3d32ca2dd660522bf8

SHA512
b18545a51b14fbe5d9e5da06fa692b7332ceb6bed507719ceb552f8d3e149353530b533d03e736a9ed84c3cb555db2ad4c6569a701ee2b45786424e9bf367a09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2b32df7c30936c6a39bf935e8285d0bd

SHA1
43c69b082a5839846e8463fc4edb532bdc12bbd8

SHA256
70d05ffbcc60f81162c152165c9f615541c911113f5522400a390994f7c93615

SHA512
37202103e4c4e8eb3a020822d379be788ebb08d838648cf28de7c940bf17b54b4978de10b5a0bc1d7d1062675279d800e715bda9ed474ebb07f62d01d0956edc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c71ad334d5aa8afadb650d4b0c533fa0

SHA1
1c4e047ee15fc966098929b095d50e70be2749c7

SHA256
0e87d31f7dfab31e6be8ddb2e9361d8356c111917012bf841309ec3fec826814

SHA512
0ddc02022190fdb50fe547f653d06a1c53ead43af753a2b91b3644bd24527efd83d3d845750301a02d56754e10e1e738e1a7fa94a26cc53419e01f58b1e57605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
01e3e8ebf04daa828946b2e1c25837ee

SHA1
0a54822dee830be6ccdcb8a6b2a2aa2499c48452

SHA256
fb0c8a7376fa87f6c113ad51ddd2e57f9031843429cb4e895757d9cfd72b3b21

SHA512
b29039a8d28d8b826ab81a8efcde07b40ddc91cfb316745c30a53c2458dd2aaf730973b824c0301f11ada4c0e1e08991e50009e8568e8f7f245ac9f2d9b4bd2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a0af45392d92bd3b9585b55d51e4ad4b

SHA1
227869b56e7911c8ff287b33f9696debc4f7956a

SHA256
992efbdfa80d7e427d1c3c595fb511f35cf8d84c3adceeb09b4ccfdabec57ed4

SHA512
843e526fb413c2531caa5160c63c2dce65adc36adeb69e6ec330959da4b9419b597862302fcc097243d37f7c02129d36cef4c4fc61b0d79c1430626845d2616f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
982f97f2ef44d114a711ab5271b2ec86

SHA1
6ce4b19dc0e22d9261036fee7c876a0e0ed807dd

SHA256
f11c4e3930c74ca709fdf2a2ceba9dcdbeaa36ce79f794683705b6d461e3c929

SHA512
24a43fb19e38b6154277f5fdeffe0075aa8d33c3f5871ec97e03d0ee99a920c1f45ddbb8f070d705260addbe9845fa279415538cec7b87963f0f50076569ccae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
697ae4ef4c2ed165cb1b4b91672250cb

SHA1
84ebcf81ae9aa5048cc7b39ac47eacf538d33703

SHA256
5a034cbfdc1f2405e4e728874b3bf758eb21a4c8537d5ae9c3969ab16286ce9e

SHA512
9fc9aeec1982e1daa06d321be6d04b9e7574c9f1c48cdeaf14c55238ee34c2b7bb18565d32e22c00976bdcac600f5989ded2f56dd86ce8182fc35f0f86074a7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5b9ab2bf3aacf9476dad0eae666e4cd1

SHA1
cabe993c70832c3663b5875c215785155d4d0de8

SHA256
efa8e0ac5141558974146cd387fa87126154869a47f542ef60d1b41b7bfc2593

SHA512
6e7bc5690618bf268a7ad282c3698af8f04ec4f27a9b4a7ce67821af65cc5ac7ac58154cc56e1f7173c7f7ac69e951694b4da6ccc860669b7ba7fb30d30dfa53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dfd68545f6fbc1108d2caa51d88f8655

SHA1
69419b6dc08d549088aaab3991f06161a3294e4b

SHA256
796c15ce26340e98bb31d957be49f1efbbc2e3bb49a4d191608e1f5b24202353

SHA512
3b6e80938161b1df9f4a6ed4cec4c26b7539124867eec1309a318fb4a06b597b96e5c45c5dd945284f37aaa5e7d372ec26e75761d503b7ef681f350af1bfe83c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
11KB

MD5
6ceec097ae2aaec4e9f5b4b93aed9129

SHA1
77deb9530f99ccfb2179566620bb8f51248ab030

SHA256
e7f894e8c0be6a0e066363990d9b1c59b85792dcb76c3c022a7f5ed5d1a7d663

SHA512
91055d3e9955fabc8712874d22272cf6804a68c4ade37c94e9de08e0b78e4f7f861d946f944d6efa364bcf81f1cc5066562e8bfdc02f754f659ff88a23bb7c6d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
11KB

MD5
bc19935914d721893c12d4001f4aca17

SHA1
f276048b67561a6a707c01c1a8811b4fb2443983

SHA256
85e9d6fd893a5ac66dd785fdee3083455d9d421b25d2063461cfb8293b84a2e5

SHA512
7b66de31582468fd23b9dccdfbefaaada323453693e1fb548793662e0f5615702786d7fd72e1886e68eb455ac314c6e3824465fdc60320c96b82f7981b2ab7c7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
11KB

MD5
6596071dad378c3f60be1535e8ad7594

SHA1
0096988108035154967390e1aefd0b1e884db5d2

SHA256
0c814b04200678aeb882307b19d23063f00cf2abefcc834454be7f8f88bc3a8c

SHA512
1311f764b98d1d196a1dbf7de6e8cb15f98714b4e8c3ffdc249611d26d2b55967575ad7641f6127e50562dc8b3590e5422ba6349625ea6e1604afd4cd6d3a518

Download Submit
C:\Users\Admin\Downloads\!Please Read Me!.txt

Filesize
797B

MD5
afa18cf4aa2660392111763fb93a8c3d

SHA1
c219a3654a5f41ce535a09f2a188a464c3f5baf5

SHA256
227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

SHA512
4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

Download Submit
C:\Users\Admin\Downloads\!WannaDecryptor!.exe.lnk

Filesize
590B

MD5
3964e69a6c697cfbee8612b188bbb1a1

SHA1
468e938cc7758f770e8644d4816a6f2a43b6199a

SHA256
4b5f71b34ab56b11bc2a4c4ae3e16650b09bce4761ecc668f83a1d16adc06089

SHA512
b3590a5c8f5242d7793e793577873ba97fac3fcc190cb352304517868088cf7527900cd04731ba0867c133d43cebb6e83121b2093fb891b276032301b7652a15

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
802de675fb328926b438569f7180af3f

SHA1
6e8cb648359be895f2b732d02b8063665f2dbc85

SHA256
5172f830ad3c98063279e4dc4448d1c78cc3d2a02453cd25b2f010a1dd8b5f2b

SHA512
62a3d08a6ea6bc324deb87cad422b6fd74e9f422abcbef3d45eaf4f6700353aaf5892fbc32c3fe16a38d5a46fc7fd61e3e59f0ecf1f570a14cea525041eeba39

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
9f776a30ec28d02da1455ddd03c27a2a

SHA1
9c48830d0ba491cce10232547970647ad2a6b638

SHA256
3f5ffcff5544995f73aeedf0e0a5ee3b4b61d1db4d765dad0f6346d2cddb7379

SHA512
e7edf3e85870bf470f3b3dfe80b02af5b72d71c94a959eb6650eb248dcc0756a04597f6f4d108e36e8fb037eb1f3fe722fc7971f26e66e0039174330edca4074

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
c88ae9c9843f2082d59376eeeda5ccc0

SHA1
5ca973e391c2b752762ae4f784db93c839dc953d

SHA256
fdaf078f82712392fc0eee0d5eabd1be7f25d1f9309cae81d51e9cd55843efb0

SHA512
6fb25390787c318713e9940b5adf747a9f4f631c66ce9e051c841efa27bd1ecb5e73dc8520a089c810bcf0ded78e504fb8ee7086847fc4c9cb8a68a6f5f6d233

Download Submit
C:\Users\Admin\Downloads\110211726896358.bat

Filesize
318B

MD5
a261428b490a45438c0d55781a9c6e75

SHA1
e9eefce11cefcbb7e5168bfb8de8a3c3ac45c41e

SHA256
4288d655b7de7537d7ea13fdeb1ba19760bcaf04384cd68619d9e5edb5e31f44

SHA512
304887938520ffcc6966da83596ccc8688b7eace9572982c224f3fb9c59e6fb2dcaa021a19d2aae47346e954c0d0d8145c723b7143dece11ac7261dc41ba3d40

Download Submit
C:\Users\Admin\Downloads\MEMZ.exe

Filesize
14KB

MD5
19dbec50735b5f2a72d4199c4e184960

SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822

SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 289959.crdownload

Filesize
224KB

MD5
5c7fb0927db37372da25f270708103a2

SHA1
120ed9279d85cbfa56e5b7779ffa7162074f7a29

SHA256
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

SHA512
a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 795843.crdownload

Filesize
184KB

MD5
c9c341eaf04c89933ed28cbc2739d325

SHA1
c5b7d47aef3bd33a24293138fcba3a5ff286c2a8

SHA256
1a0a2fd546e3c05e15b2db3b531cb8e8755641f5f1c17910ce2fb7bbce2a05b7

SHA512
7cfa6ec0be0f5ae80404c6c709a6fd00ca10a18b6def5ca746611d0d32a9552f7961ab0ebf8a336b27f7058d700205be7fcc859a30d7d185aa9457267090f99b

Download Submit
C:\Users\Admin\Downloads\c.vbs

Filesize
201B

MD5
02b937ceef5da308c5689fcdb3fb12e9

SHA1
fa5490ea513c1b0ee01038c18cb641a51f459507

SHA256
5d57b86aeb52be824875008a6444daf919717408ec45aff4640b5e64610666f1

SHA512
843eeae13ac5fdc216b14e40534543c283ecb2b6c31503aba2d25ddd215df19105892e43cf618848742de9c13687d21e8c834eff3f2b69a26df2509a6f992653

Download Submit
C:\Users\Admin\Downloads\c.wry

Filesize
628B

MD5
80514b45c1456435dd392355bf63417c

SHA1
510914f0f4c681a17e828b3a52c4cdc7afe01730

SHA256
5a0d6b911c09bff210e1a131d87f243c57ed35e3a5abb9de392c3aac70280670

SHA512
b56e44b1e646bdaf4ff38b30bbcf983dbbe22152bbdd3881cb3249ba9a15a09a9eceb429e8c85b3d88e7ce05d92b22fadff3fb771d54c3c314de9f3582ca3352

Download Submit
C:\Users\Admin\Downloads\m.wry

Filesize
42KB

MD5
980b08bac152aff3f9b0136b616affa5

SHA1
2a9c9601ea038f790cc29379c79407356a3d25a3

SHA256
402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

SHA512
100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

Download Submit
C:\Users\Admin\Downloads\salinewin.zip

Filesize
203KB

MD5
19a966f0b86c67659b15364e89f3748b

SHA1
94075399f5f8c6f73258024bf442c0bf8600d52b

SHA256
b3020dd6c9ffceaba72c465c8d596cf04e2d7388b4fd58f10d78be6b91a7e99d

SHA512
60a926114d21e43c867187c6890dd1b4809c855a8011fcc921e6c20b6d1fb274c2e417747f1eef0d64919bc4f3a9b6a7725c87240c20b70e87a5ff6eba563427

Download Submit
C:\Users\Admin\Downloads\u.wry

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
memory/1984-725-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download