Overview

overview

10

Static

static

3

Main.exe

windows10-1703-x64

10

Main.exe

windows11-21h2-x64

Analysis

  • max time kernel
    1357s
  • max time network
    1367s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05-10-2024 01:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Main.exe

  • Size

    7.5MB

  • MD5

    3eb46bea293af2205928a34ddb51b8ec

  • SHA1

    7d63680f3d927990eac32daa58d2bfabb1aacb7e

  • SHA256

    6bfc6829a6c86f6ba652b97df5a9772e5d4c3f08a011f0553f229a2e7467f500

  • SHA512

    89a5d7d2e066c7b46827272720a3f5cbe20a9fbee0cf6ee0780c1f09594e6a3b6f8b805b2411381e142321dca12170d51939d4a3b490b46a7ebd940c8bfb1a15

  • SSDEEP

    196608:SgjXSqrf6UkWhJxe6YsdQL/neQ+gKeC3bc1I05O:ljFrfiWxtYsdQL/ejLe5

Score
10/10
wannacrybootkitdefense_evasiondiscoveryexecutionimpactpersistenceransomwareworm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 9 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Sets desktop wallpaper using registry 2 TTPs 6 IoCs
    ransomware
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs regedit.exe 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: MapViewOfSection 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Main.exe
    "C:\Users\Admin\AppData\Local\Temp\Main.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:4192
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:96
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb6cae9758,0x7ffb6cae9768,0x7ffb6cae9778
      2⤵
        PID:1176
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:2
        2⤵
          PID:2668
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1832 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:8
          2⤵
            PID:2172
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:8
            2⤵
              PID:3016
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2960 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:1
              2⤵
                PID:1896
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:1
                2⤵
                  PID:816
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4508 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:1
                  2⤵
                    PID:2532
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4644 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:8
                    2⤵
                      PID:2992
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4604 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:8
                      2⤵
                        PID:3368
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:8
                        2⤵
                          PID:2496
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4748 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:8
                          2⤵
                            PID:2720
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4972 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:8
                            2⤵
                              PID:2428
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5428 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:1
                              2⤵
                                PID:2068
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3004 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:1
                                2⤵
                                  PID:4568
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5680 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:1
                                  2⤵
                                    PID:4800
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:8
                                    2⤵
                                      PID:4488
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3800 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:8
                                      2⤵
                                        PID:4856
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:8
                                        2⤵
                                          PID:4492
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3204 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:2
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4608
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5220 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:1
                                          2⤵
                                            PID:6132
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=2252 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:1
                                            2⤵
                                              PID:5476
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5668 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:8
                                              2⤵
                                                PID:5536
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5060 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:8
                                                2⤵
                                                  PID:5540
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=6184 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:1
                                                  2⤵
                                                    PID:5320
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5844 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:1
                                                    2⤵
                                                      PID:6068
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5012 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:1
                                                      2⤵
                                                        PID:5180
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1744 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:8
                                                        2⤵
                                                          PID:5652
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4836 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:8
                                                          2⤵
                                                            PID:3516
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:8
                                                            2⤵
                                                              PID:5488
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2528 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:8
                                                              2⤵
                                                                PID:4068
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2248 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:8
                                                                2⤵
                                                                  PID:3844
                                                                • C:\Users\Admin\Downloads\MEMZ.exe
                                                                  "C:\Users\Admin\Downloads\MEMZ.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:5276
                                                                  • C:\Users\Admin\Downloads\MEMZ.exe
                                                                    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:6104
                                                                  • C:\Users\Admin\Downloads\MEMZ.exe
                                                                    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:6124
                                                                  • C:\Users\Admin\Downloads\MEMZ.exe
                                                                    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:5152
                                                                  • C:\Users\Admin\Downloads\MEMZ.exe
                                                                    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:5256
                                                                  • C:\Users\Admin\Downloads\MEMZ.exe
                                                                    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:5352
                                                                  • C:\Users\Admin\Downloads\MEMZ.exe
                                                                    "C:\Users\Admin\Downloads\MEMZ.exe" /main
                                                                    3⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Writes to the Master Boot Record (MBR)
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    • Suspicious use of SendNotifyMessage
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:5564
                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                      "C:\Windows\System32\notepad.exe" \note.txt
                                                                      4⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      PID:4076
                                                                    • C:\Windows\SysWOW64\calc.exe
                                                                      "C:\Windows\System32\calc.exe"
                                                                      4⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:6044
                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                      "C:\Windows\System32\explorer.exe"
                                                                      4⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:6760
                                                                    • C:\Windows\SysWOW64\control.exe
                                                                      "C:\Windows\System32\control.exe"
                                                                      4⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:8692
                                                                    • C:\Windows\SysWOW64\regedit.exe
                                                                      "C:\Windows\System32\regedit.exe"
                                                                      4⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Runs regedit.exe
                                                                      PID:7984
                                                                    • C:\Windows\SysWOW64\control.exe
                                                                      "C:\Windows\System32\control.exe"
                                                                      4⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:7112
                                                                    • C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
                                                                      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
                                                                      4⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:6384
                                                                      • C:\Windows\splwow64.exe
                                                                        C:\Windows\splwow64.exe 12288
                                                                        5⤵
                                                                          PID:9300
                                                                      • C:\Windows\SysWOW64\mspaint.exe
                                                                        "C:\Windows\System32\mspaint.exe"
                                                                        4⤵
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:10672
                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                        "C:\Windows\System32\explorer.exe"
                                                                        4⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:11400
                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                        "C:\Windows\System32\explorer.exe"
                                                                        4⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:11600
                                                                      • C:\Windows\SysWOW64\regedit.exe
                                                                        "C:\Windows\System32\regedit.exe"
                                                                        4⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Runs regedit.exe
                                                                        PID:11960
                                                                      • C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
                                                                        "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
                                                                        4⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:12056
                                                                      • C:\Windows\SysWOW64\regedit.exe
                                                                        "C:\Windows\System32\regedit.exe"
                                                                        4⤵
                                                                        • Runs regedit.exe
                                                                        PID:14908
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6428 --field-trial-handle=1840,i,757839502524546770,16879961185573717169,131072 /prefetch:8
                                                                    2⤵
                                                                      PID:1800
                                                                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                    1⤵
                                                                      PID:1476
                                                                    • C:\Windows\System32\rundll32.exe
                                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                      1⤵
                                                                        PID:4300
                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
                                                                        1⤵
                                                                        • Drops startup file
                                                                        • Sets desktop wallpaper using registry
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:660
                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                          attrib +h .
                                                                          2⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Views/modifies file attributes
                                                                          PID:4644
                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                          icacls . /grant Everyone:F /T /C /Q
                                                                          2⤵
                                                                          • Modifies file permissions
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:816
                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                          taskdl.exe
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:168
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c 161551728090946.bat
                                                                          2⤵
                                                                            PID:1104
                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                              cscript.exe //nologo m.vbs
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2428
                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                            attrib +h +s F:\$RECYCLE
                                                                            2⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Views/modifies file attributes
                                                                            PID:1144
                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                            @[email protected] co
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:996
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exe
                                                                              TaskData\Tor\taskhsvc.exe
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:4996
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            cmd.exe /c start /b @[email protected] vs
                                                                            2⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:2420
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              @[email protected] vs
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:3336
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                                                                4⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:3460
                                                                                • C:\Windows\SysWOW64\vssadmin.exe
                                                                                  vssadmin delete shadows /all /quiet
                                                                                  5⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Interacts with shadow copies
                                                                                  PID:2524
                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                  wmic shadowcopy delete
                                                                                  5⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:2932
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 180
                                                                                4⤵
                                                                                • Program crash
                                                                                PID:4432
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 180
                                                                                4⤵
                                                                                • Program crash
                                                                                PID:1828
                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                            taskdl.exe
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            PID:3488
                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                            taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:4240
                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                            @[email protected]
                                                                            2⤵
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Sets desktop wallpaper using registry
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of FindShellTrayWindow
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:428
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "guaqpnihl896" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f
                                                                            2⤵
                                                                              PID:816
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "guaqpnihl896" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f
                                                                                3⤵
                                                                                • Adds Run key to start application
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry key
                                                                                PID:64
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:2692
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:5072
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:3216
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:4000
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:1144
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:5668
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:5676
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:1144
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:3520
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:1768
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:1740
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:4116
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:2472
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:5624
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:5636
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:5648
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:1768
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:2544
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:756
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:5704
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:5372
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:4776
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:3672
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:5692
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:4680
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:2084
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:4588
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:5584
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:5796
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:7580
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:7432
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:6852
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:8940
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:8948
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:9008
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:6760
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:5052
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:7264
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:7348
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:6648
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:7796
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:7884
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:7292
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:7264
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:7016
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                              @[email protected]
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • Sets desktop wallpaper using registry
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:5880
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                              taskdl.exe
                                                                              2⤵
                                                                                PID:8284
                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                2⤵
                                                                                  PID:2988
                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                  taskdl.exe
                                                                                  2⤵
                                                                                    PID:6436
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                    taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                    2⤵
                                                                                      PID:8564
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                      taskdl.exe
                                                                                      2⤵
                                                                                        PID:8252
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                        2⤵
                                                                                          PID:1948
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                          taskdl.exe
                                                                                          2⤵
                                                                                            PID:6516
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                            taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                            2⤵
                                                                                              PID:6636
                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                              taskdl.exe
                                                                                              2⤵
                                                                                                PID:8784
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                2⤵
                                                                                                  PID:5704
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                                  taskdl.exe
                                                                                                  2⤵
                                                                                                    PID:1000
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                                    taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                    2⤵
                                                                                                      PID:8292
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                                      taskdl.exe
                                                                                                      2⤵
                                                                                                        PID:9024
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                        2⤵
                                                                                                          PID:6680
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                                          taskdl.exe
                                                                                                          2⤵
                                                                                                            PID:8464
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                                            taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                            2⤵
                                                                                                              PID:9236
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                                              taskdl.exe
                                                                                                              2⤵
                                                                                                                PID:9308
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                                2⤵
                                                                                                                  PID:8380
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                                  @[email protected]
                                                                                                                  2⤵
                                                                                                                  • Sets desktop wallpaper using registry
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:6680
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                                                  taskdl.exe
                                                                                                                  2⤵
                                                                                                                    PID:9028
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                                                    taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                                    2⤵
                                                                                                                      PID:10760
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                                                      taskdl.exe
                                                                                                                      2⤵
                                                                                                                        PID:10884
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                                        2⤵
                                                                                                                          PID:2692
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                                                          taskdl.exe
                                                                                                                          2⤵
                                                                                                                            PID:9256
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                                                            taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                                            2⤵
                                                                                                                              PID:9744
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                                                              taskdl.exe
                                                                                                                              2⤵
                                                                                                                                PID:3360
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                                                2⤵
                                                                                                                                  PID:9864
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                                                                  taskdl.exe
                                                                                                                                  2⤵
                                                                                                                                    PID:9796
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                                                                    taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                                                    2⤵
                                                                                                                                      PID:10312
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                                                                      taskdl.exe
                                                                                                                                      2⤵
                                                                                                                                        PID:8500
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                                                        2⤵
                                                                                                                                          PID:2972
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                                                                          taskdl.exe
                                                                                                                                          2⤵
                                                                                                                                            PID:10460
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                                                                            taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                                                            2⤵
                                                                                                                                              PID:11864
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                                                                              taskdl.exe
                                                                                                                                              2⤵
                                                                                                                                                PID:6852
                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                attrib +h +s F:\$RECYCLE
                                                                                                                                                2⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                PID:9800
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                                                                2⤵
                                                                                                                                                  PID:11900
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                                                                  @[email protected]
                                                                                                                                                  2⤵
                                                                                                                                                  • Sets desktop wallpaper using registry
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:9616
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                                                                                  taskdl.exe
                                                                                                                                                  2⤵
                                                                                                                                                    PID:11892
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                                                                                    taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                                                                    2⤵
                                                                                                                                                      PID:12304
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                                                                                      taskdl.exe
                                                                                                                                                      2⤵
                                                                                                                                                        PID:12492
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                                                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                                                                        2⤵
                                                                                                                                                          PID:12564
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                                                                                          taskdl.exe
                                                                                                                                                          2⤵
                                                                                                                                                            PID:12952
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                                                                                            taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                                                                            2⤵
                                                                                                                                                              PID:11772
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                                                                              @[email protected]
                                                                                                                                                              2⤵
                                                                                                                                                              • Sets desktop wallpaper using registry
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:13084
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                                                                                              taskdl.exe
                                                                                                                                                              2⤵
                                                                                                                                                                PID:13364
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                                                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:13364
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                                                                                                  taskdl.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:13644
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                                                                                                    taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:14592
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                                                                                                      taskdl.exe
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:14832
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                                                                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:6688
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                                                                                                          taskdl.exe
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:12064
                                                                                                                                                                        • C:\Windows\system32\vssvc.exe
                                                                                                                                                                          C:\Windows\system32\vssvc.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:1896
                                                                                                                                                                          • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
                                                                                                                                                                            "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\JoinInvoke.doc" /o ""
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                            • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                            PID:2248
                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                            PID:4236
                                                                                                                                                                          • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                            C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                            PID:356
                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                            PID:3196
                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                            PID:1768
                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:2376
                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                            PID:5800
                                                                                                                                                                          • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                            C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                            PID:5976
                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                            PID:5124
                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:5196
                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:1016
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:5900
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb6cae9758,0x7ffb6cae9768,0x7ffb6cae9778
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:5912
                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                    PID:4836
                                                                                                                                                                                  • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                    C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                    PID:5976
                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                    PID:1924
                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                    PID:5096
                                                                                                                                                                                  • C:\Windows\System32\DataExchangeHost.exe
                                                                                                                                                                                    C:\Windows\System32\DataExchangeHost.exe -Embedding
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:5296
                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                      PID:5140
                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                      PID:2424
                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                      PID:3612
                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:4576
                                                                                                                                                                                    • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                      C:\Windows\system32\AUDIODG.EXE 0x32c
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:2280
                                                                                                                                                                                      • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                        C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        PID:5508
                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        PID:7532
                                                                                                                                                                                      • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                        C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                        PID:7648
                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        PID:4852
                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        PID:7988
                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        PID:5068
                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:9132
                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                          PID:6764
                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:2596
                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                          PID:3520
                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                          PID:8148
                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:7436
                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:9056
                                                                                                                                                                                        • C:\Windows\System32\DataExchangeHost.exe
                                                                                                                                                                                          C:\Windows\System32\DataExchangeHost.exe -Embedding
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:7404
                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                            1⤵
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:7996
                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                            1⤵
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:5892
                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                            1⤵
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                            PID:8736
                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                            1⤵
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                            PID:4800
                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:6968
                                                                                                                                                                                            • C:\Windows\SysWOW64\DllHost.exe
                                                                                                                                                                                              C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                                                                                                                                                                                              1⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:2932
                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                              1⤵
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:8032
                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                              1⤵
                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                              PID:8004
                                                                                                                                                                                            • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                              "C:\Windows\system32\taskmgr.exe" /7
                                                                                                                                                                                              1⤵
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                              PID:8616
                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                              1⤵
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                              PID:8780
                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                              1⤵
                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                              PID:6056
                                                                                                                                                                                            • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                              C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:7296
                                                                                                                                                                                              • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                "C:\Windows\system32\taskmgr.exe" /7
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:1272
                                                                                                                                                                                                • C:\Windows\System32\DataExchangeHost.exe
                                                                                                                                                                                                  C:\Windows\System32\DataExchangeHost.exe -Embedding
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:3820
                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:7292
                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:2544
                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                      PID:11024
                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:9396
                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:9908
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:8456
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:10316
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:10428
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:10920
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:9360
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:4300
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:11100
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:10644
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:10216
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:10356
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:9628
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:9432
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:6860
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:7152
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:10776
                                                                                                                                                                                                      • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                        c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:10028
                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                          PID:7416
                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:11636
                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:12220
                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:11360
                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            PID:11796
                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:11780
                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:12044
                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:12628
                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:13304
                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:12988
                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:12512
                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                PID:12468
                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:12568
                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:12540
                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:13396
                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:13796
                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                PID:14312
                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:524
                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:13536
                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                  PID:13616
                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:13756
                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:11504
                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                  PID:14676
                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                  PID:15052
                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:14476
                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                    PID:7772
                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:2932
                                                                                                                                                                                                                    • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                                      "LogonUI.exe" /flags:0x0 /state0:0xa38f3855 /state1:0x41c64e6d
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:10680
                                                                                                                                                                                                                      • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                        C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:7316
                                                                                                                                                                                                                        • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                          C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:3980

                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                          Reconnaissance

                                                                                                                                                                                                                          Resource Development

                                                                                                                                                                                                                          Initial Access

                                                                                                                                                                                                                          Execution

                                                                                                                                                                                                                          Windows Management Instrumentation

                                                                                                                                                                                                                          1
                                                                                                                                                                                                                          T1047

                                                                                                                                                                                                                          Persistence

                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                          1
                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                          1
                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                          Pre-OS Boot

                                                                                                                                                                                                                          1
                                                                                                                                                                                                                          T1542

                                                                                                                                                                                                                          Bootkit

                                                                                                                                                                                                                          1
                                                                                                                                                                                                                          T1542.003

                                                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                          1
                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                          1
                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                                                          Direct Volume Access

                                                                                                                                                                                                                          1
                                                                                                                                                                                                                          T1006

                                                                                                                                                                                                                          File and Directory Permissions Modification

                                                                                                                                                                                                                          2
                                                                                                                                                                                                                          T1222

                                                                                                                                                                                                                          Windows File and Directory Permissions Modification

                                                                                                                                                                                                                          1
                                                                                                                                                                                                                          T1222.001

                                                                                                                                                                                                                          Hide Artifacts

                                                                                                                                                                                                                          1
                                                                                                                                                                                                                          T1564

                                                                                                                                                                                                                          Hidden Files and Directories

                                                                                                                                                                                                                          1
                                                                                                                                                                                                                          T1564.001

                                                                                                                                                                                                                          Indicator Removal

                                                                                                                                                                                                                          2
                                                                                                                                                                                                                          T1070

                                                                                                                                                                                                                          File Deletion

                                                                                                                                                                                                                          2
                                                                                                                                                                                                                          T1070.004

                                                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                                                          4
                                                                                                                                                                                                                          T1112

                                                                                                                                                                                                                          Pre-OS Boot

                                                                                                                                                                                                                          1
                                                                                                                                                                                                                          T1542

                                                                                                                                                                                                                          Bootkit

                                                                                                                                                                                                                          1
                                                                                                                                                                                                                          T1542.003

                                                                                                                                                                                                                          Credential Access

                                                                                                                                                                                                                          Discovery

                                                                                                                                                                                                                          Browser Information Discovery

                                                                                                                                                                                                                          1
                                                                                                                                                                                                                          T1217

                                                                                                                                                                                                                          Peripheral Device Discovery

                                                                                                                                                                                                                          1
                                                                                                                                                                                                                          T1120

                                                                                                                                                                                                                          Query Registry

                                                                                                                                                                                                                          4
                                                                                                                                                                                                                          T1012

                                                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                                                          5
                                                                                                                                                                                                                          T1082

                                                                                                                                                                                                                          System Location Discovery

                                                                                                                                                                                                                          1
                                                                                                                                                                                                                          T1614

                                                                                                                                                                                                                          System Language Discovery

                                                                                                                                                                                                                          1
                                                                                                                                                                                                                          T1614.001

                                                                                                                                                                                                                          Lateral Movement

                                                                                                                                                                                                                          Collection

                                                                                                                                                                                                                          Command and Control

                                                                                                                                                                                                                          Web Service

                                                                                                                                                                                                                          1
                                                                                                                                                                                                                          T1102

                                                                                                                                                                                                                          Exfiltration

                                                                                                                                                                                                                          Impact

                                                                                                                                                                                                                          Defacement

                                                                                                                                                                                                                          1
                                                                                                                                                                                                                          T1491

                                                                                                                                                                                                                          Inhibit System Recovery

                                                                                                                                                                                                                          2
                                                                                                                                                                                                                          T1490

                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            40B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            c86640aaa33658aa24db5a9e946108b5

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            42a8819c961a6db7e165a84bab0781ef72e71d81

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            bad1ea3662cf7bbc1c20e838088b1b20eb1cdc6060eff54f7513c67a6bfd0717

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            5fea5255ffee9a38d99ff112b0ccadccc5c08458ba90d91655a92bbfdb83d921188bd1952893c934467d211b10e6b9f89ae8b4a5fe1a3db1124641f86897fc83

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            213KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            f942900ff0a10f251d338c612c456948

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            4a283d3c8f3dc491e43c430d97c3489ee7a3d320

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            38b76a54655aff71271a9ad376ac17f20187abd581bf5aced69ccde0fe6e2fd6

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            9b393ce73598ed1997d28ceeddb23491a4d986c337984878ebb0ae06019e30ea77448d375d3d6563c774856d6bc98ee3ca0e0ba88ea5769a451a5e814f6ddb41

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            6KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            2624e91c45490bdb8f5cd7cc0b1d0b3e

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            3c7d47fda3a0ed83efd404675febf144df6dad7a

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            0effe2839526136aa78bf2ece6fae597092bc76344ccbb68f50836c7258290cb

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            ee01cd7868d41b82d5b9843aff9412fafafb72eb8568fe16c09b145a3b607e0f747901e83ffdca6c6cbc4a093ee7a9c466d87157ebf731c1e68a8543311954fb

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            6KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            b4598eba3d67384dd75fd87e4818cd09

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            13c6cca33e496bff046fcfcec30fdab3df30a4ac

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            aabbe5d503d1f0e0bb8ca90dc5fab3e1926d0e92c28bb533e97fb2710dcacef7

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            12fd7667f3d69e927e44b0aebb92fb6d2ed9612413f442a67c0ce0af849a042e3f2c7d23a8cd256cae83909f95fbb0ba59631ba0ae819ae7cc0ddab9927b6957

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.reddit.com_0.indexeddb.leveldb\CURRENT
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            16B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            46295cac801e5d4857d09837238a6394

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            23B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            3fd11ff447c1ee23538dc4d9724427a3

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            1335e6f71cc4e3cf7025233523b4760f8893e9c9

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            3KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            eb919d7b59d7a8adeb50b1a6bdd6bdca

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            51da904c90356324db90bbeb3255f95fd18668be

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            9b832c93b37c26b635b2b5689a85a030ae609b88140f4809255691c7c10aa075

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            e75f99e3fb6c3ffd5a3ebeba307d1ad7d0e75f556a8017fe6384fc2f7f2d1aa828f919a8f95ed7ec512f701545285580b5145d14caf06bc603a93ce3efae21b7

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            56b78c9783ce8bcfd9994c3478ef2e8e

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            4a0475ebbf6221a7b837f26bf4545e256a1a0ab9

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            ea486a122845f4b72f14fc1d2987241e2031dbb905a8c455e161987cc132dc03

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            c2172e342654639fbe31752c05fd1a37b8f3c51532ae8fbfe0f2065c7b295250a7ca078ef9bb5a74f2370a4aacece2a987556118b3ba9218ac9bd09d5cb315ac

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            5KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            1fae04d83b4da98fe8c0f44711bd3450

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            1b0bdc7628aa1e4784c61531e05b18482da5808f

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            6b9eb4ee609ef4dbddc0558b2ac1a53b8104540551ba8629d2c3524b4f69edde

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            1ab37abec3473fca2b012f0eee3e6f838efe4ae58b532b229af2f82e51f4b2e3166295a4b6f152f36d642920b88a7463847b800e0cc2ff29b05c94b5db611dbc

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            3KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            055eeb5296f0f2379a892e0359697727

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            64de4bb4d125d6424b3aff50a7edf2dec7be4873

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            f5556b5547f320fd828dca032a3be83c9d1e5531897c6caa86d7c6010fccdbb3

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            0ca93a30de5d2b656bacc306735f67184d43c1aa11370b85c31c4964bb25c1e512698718a12646bbde145232072e5838de2d258d975d4f0e1a143e02b45a9951

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            a6f0be73d172f5504d6c66a8a359626a

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            6be08ba668f332609b8566e9f1cc07ed778d2dab

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            a79dc32cb510fc55d8148cf4d13256ed5330a045644e585f4d2bc79361d92643

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            fed36b1b2de011034490108e35dd5e533500cc00e434e6121946708a461f2cf3fe35a7dc7d9c33d3a23b5ad87ac59300a42417eab769334a02733299c7d91696

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            66bcb020180d3c5830fea0a0074e6212

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            bafe4ebfbd4830e2139996847f8eb2c8ea7bb517

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            71f03c31071f48846199ca088a3d33cab20e61833c4e06254de56c6e9f138969

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            e01adf2aadf339cc7f5733949dcfa545fdb174f6be14431a07c711c951266c8dcc8977e41fb48611f1aa49c492e2c35108fc4524ae45f9d69096ac9e74965cf4

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            0af8d23e558127360d5a543484f88448

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            a297d22e3ab25b10a4aff6ccdd2d371cc06326b9

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            55aa9fe4357d16d5a9d5fa2d755489f96e15a726c403230d0878768462b2cd49

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            24275559ae73df70983ee906a51d2ac540951b833267c2b92f5b9c75e63e5bae2604a301bca245575d780b0c35660daf9c1be4da1a282f21ce7ce755ec81d34f

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            cfb512df9ea18b89e4006bad331438bb

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            66624336f2356d227322bc347cc384d59ae4757c

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            9bdb244921a91d066e8363aa86b3f2421211001cacb764d032d4cc83cb85b6e2

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            4770302d0a33bbd7e26b10e1a7444c4ae3bfd5502e00ae94deb2252e2e200589b1b6a2d9804d481764f79b410c75851269ec148acf3dae17abf356c5868ec43a

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            d4b62ee626ceced2279a91f79d73d0ef

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            0df0dd418533401d07b72948288c5646dd56be5f

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            79a0561043a92326748081da85053749021b57a16f8b9973c672ec34116987a0

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            79affba567c64e6efbf75e3b336fa58ca45723384ac17c79ef136e8f2433ae915412b81e27330b907d9245e2071920e4f5d5ec34d44b6c07d5f8677c7af2ed88

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            2ec07abd5dad63ebda80620eb7197f1c

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            31f612f781bfd4672f6c46900a6585854c666049

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            e91a7feb3ea0d1e76143e40ce5d18be832437fc2a0bfd118f049e033f88f0a4e

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            e051c822498e76d8f52754228718086fa6d2c9a920a991b7d569a88fda61f0cb0d6eb8ec73be6552c1a6a405bcac8fdf41a1671ce8bf6e25fa5b06233483bece

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            15e25aaaa73abb4283993f72185fac4c

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            ef92b7e9bd338e2b7ded5df201cc377e7efd318b

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            62c8db2194a7bc2803ac9263bc7aca92a6b8c10eb47b7bb4c05a7616e94d2cd6

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            a9fceebd3c0cb932584f78b409fe6c4cf5b4598c985c1b92d6d2949089b7a09ede3afa8dd5ea08442305bd16d1c4d5daa6f07a6bb920ab2e8e7be202253a70bc

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            d907e40f5cd078079b73adf9c781aaa3

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            5bf80aa84f6f895553d63de70c583bb338bca858

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            8e06ad176184060be9af95fb06ea7f53a7250654fa7e5af63b2fa0e3a8224c7a

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            c42441a6ef37c094a2c9353f47bc537c9c4651f0e04d66231b6f9dca33ad14ebe2a667aa6f53df9eaeff2ffb90b2e936a8cf0e17dc1740ed537c1dcb118da85f

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            369B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            6a1b9723eb6f5380f7af4c013c9a1d14

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            671ddc0ecdb0ac81dc3d15fb33636c6a78278899

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            c8dbf64540fb8c72d35fc2215d35d5d15b7f80b72ab3fa05e3b6ae99d6716726

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            dc4fb28e0f8bb04d2669fdfa223e7b08fa755e40ffb07369779f0d73815903b2cb0215f20c2b78f1314bb78874fb28401245b9b37f408efc676a71138d9e7f1a

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            6KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            22b5577ca2a0f7641e94e7056c3b6621

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            9c8395a008e91ace5fcf74f6f6376b8b61dfedb3

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            af581e114a12b3bc57f3f94cf71602a5617c9835d2f01e0cb3e78e5ca8fa0cb0

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            3d42fe1140c28fa14e91b0aaa3701540dd3275be85d4d66582aad29e3d26373b48933829a97763b41c6d026257950c29a6fbdf602fb7fc6c93cacf78b70ce719

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            7KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            fd71ad05bcaae340c4eb355e59d4921b

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            bfe8f2ad726674aeed52633997ee6a50595cfe2d

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            3d20a96195c382f4092050d0970956c10c4222a3d1489288fd829e9f33b48950

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            2b61c2421fd9526d600a482f9b3058a76794fa79537d0cca27113c9310894e845a7da7c533da55e265adb1c564f34590fdf3dd3827efe316f8c6da1abb2adc3e

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            5KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            843f3e1eb52153f810af931efc4a95d9

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            44c73c5d0098580f87249bf22594dfc2c1c98edb

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            1cdd311e723f0414b013f39a16f73b249a0c30595442c33c179ebb95e076456a

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            afa14f20c7255bc6d0f876a80d5ab7a5ac4ce8469c7b9471edb77372d57709de7319b85edaf17e07924e89f5101aa604c9889bd8bafc2873529b9d03dee9d6bf

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            6KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            8b82208ea39b692076cd6c1cf7e9fb3c

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            c118fab2ef59a29813e33db336103d1d97cfa6b2

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            fc1bd2ee2ba2a63946deb7d8699813248316199ec4ed5e1b290c17dceccdd1c3

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            aab88a948e0698aa5f121c308e81b97e397ff063599840ffb693b78633961e93ce561a5d8882b789c146f0821170e00f6eba565c030fd156e4d1cd24dba88215

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            6KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            d1a150962824bdd0acf770745824665c

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            39fde0788ad3f15150f0f5e9a1c2aa84652cd057

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            92fe26a569d4e1777a2b0bb5d41812d53e947b25cfb950f5a6da9a3981fb53fd

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            a690e5e317294d7193d621760f827d6a5dca9be34242b1f78b5d8abf4e12b85dec4ca00ac0f0961fb4f3f421eb35bfaa0b679b1b623a7797660442cff4c6a916

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            6KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            98a57be51ec546a1ea18de62293255de

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            680fc56b909294397d416be1e307d25e1fd95d9f

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            29d60da393d742334fb307fda247e66494809c74487c5f24e5d07b20cc5a56e4

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            f7cce9a7d5ac79a1f4d57ff6d80175a1716642d8da59bd24b2b9a6fc3b6980e81096096ae737b993715ef6ed3d85d2400532872e5aabdab2c19df467e8e87261

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            6KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            074e72e1784d29b324c0c8dfa5834880

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            f7d46e0028bf228cd1927df190203e8ff6377a0e

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            93c77d91197766ffbbb103597db15e73ce2db34ba3db439f61357a2c831526a7

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            ffbc23cbbadaae88b211c8f575e5667dfe89f4b46381b6597eec3e4c7709a83651e5aa562207b9a876b2c17b4c35732b4c1b4a6b77ddd57549ac994934ffe9cf

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            12KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            a27fd23b7d8d64ce5571074cc67213b5

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            494f13e1b3ce2865b2bb2f0b479509f69837663c

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            d33c54d406b0123e79e846837b0c967c6f8ad82384e5f08eb659162d91a6dbb2

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            7880e79645b78f0b7db70bcdb49309b36963553f8652136eac4a3c3472668abe436fbcdc45b31fe4cf37ec1f94b49f3b917ec02445a48a2104eb3da88e1fc526

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            56B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            94275bde03760c160b707ba8806ef545

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            aad8d87b0796de7baca00ab000b2b12a26427859

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            c58cb79fa4a9ade48ed821dd9f98957b0adfda7c2d267e3d07951c2d371aa968

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            2aabd49bc9f0ed3a5c690773f48a92dbbbd60264090a0db2fe0f166f8c20c767a74d1e1d7cc6a46c34cfbd1587ddb565e791d494cd0d2ca375ab8cc11cd8f930

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5ca2b0.TMP
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            120B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            74fc9de9bd5a59a642abfc47197a9581

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            b02e97c333e6284223e0b3d0a6cf564a1b8c4981

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            1c56b786b249f90d4062f5fbf25ae9dba79a58a8f2205e703b481ebd6ec2db5d

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            b6c861fdddfd47f60f7a8de9ac0585eac3aed60a6a4d638079112a048b3735510e4c8d0c56c1f2ca272ae014bfa246d39dfc0b0067d1b2588848e11a356b4dff

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            72B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            e22872cd78bbadbf2f9f6206f713e388

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            219c3c07a3048baac3ec4ca8af37fe493a117784

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            56f92738336dd625529a23ddf959746ba273f6ee3daf8c9556d2ec54e745ce7b

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            30d370e8ced12b80255aba7ab6a33ba19c5cf1a58bc6834e5251514dcdb837a661d310676b559f8281bd3673705f6425581f1337ce8d373e935a9414c8e2fe38

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590d45.TMP
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            48B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            ea05d666dec3f8fa19a31c1b33c70989

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            f4f0e8b74a25173c13318e7ff3bc13e56ce7b7c9

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            34aa3471efba372fb591fe8b2a34ee5442b0be868de7ab392c70ab271753d636

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            2bdae25dd069c44eb293f56cc1344c15488568690ae5fcb41033400074fed5cce95ca12d781a2fcb11fccfa1d2bb9556d2f53132b2ae5d0f4570dd5ac5c81f0f

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            28KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            89f95cba7df4701a8173efa00dd6b94c

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            673fbd9811b91813675b1f2a42cc8bd96450a0a2

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            7334dd817408a2ad18d3ffd643e1707504159d52daef7c280db4f14d9c719129

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            9cb34878f8fa559d0ee1ee637218df7763f33aaf44c7aa01f40709e0c7ec74a131dbd9b96c14c845ce29d665bb97c077e81a24bd6b8a797fd306678a15820deb

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            309KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            01c54410901218e6caf8821ad499bd61

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            30634b007df722dc202b859de2a0476cb5b620ac

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            7b88ac5e62060a855932e579f935e5b503de333e3642013a201999021260dacf

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            cd45e63b31905730727620e73279f59edbfefb6dac1f6e5c88a5f318e1c32cdb738da3193853955423a28cd295ec45b0e354effd74ad3ab59245d9097a42123d

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            309KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            6ff10086634a1dc074c072160810b86a

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            f18b64cf5b14fcdcfde8dbcb1dff712fb86ae5ba

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            57e73003320818d72c36f0dbd2016a64ac3c1731a2c3bacdbb014ff62beb9347

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            9313273abd21e48f19d9a315703e0f9bc0254a1267b5aad96c7f922519800fd3c34f14e604795ffd417cc4d256257e485ca8d3bd3d6086d8de73ff544d24f7b5

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            309KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            11ae9bb7f172c48dd1bb75e350be2e45

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            171df6de673f8c5f4a79a4e0cb22d95efb40476c

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            b0dcd3417b18640026d20087ffdc8f8835a9716db297717da242d96c6645590f

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            69f14c81e258581a6d893e54335a6f093df4aa3da585cb5f7e496ebf98767e6f7621eb967843e57c6a08d4587fd7c56d189baa7ca613b4f3eb3de5f2193ed87e

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            309KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            0bb9637b8ead66b667593c6dabddaf54

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            a025399d3ea93360fe003107a86229824626b5c2

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            fae04694231048d2550e7b579d508fb668376eaa422fb75e6d9b3725a2909d38

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            bf83b1ffc40c8fcba0863a07f6d2855a35ee4071ffc0025e817f5135ad6fdcea936d2470f3d9885893ec566400f79c51243fe676526f342c3d3aa245676cdc48

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            309KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            4824261868281c86c1250f0924dbe3dd

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            468547928a23a0ad63641aa67aeaee6a5964b856

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            cb967c083dea6fcd8fa9f4e4d6a5fef4146b04be5f61a8c9cc24324dec48ea69

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            67b0926b27198a879f54774383028500f85f5160c454c069572e3565f31b6d3c4daea4f33b8ac33a749dfd8b378a35730611c194d0a3ce7b09e763aa859738c8

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            111KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            c12a87aacaadd0fcd005447b3f357452

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            bd8f77daf8ecf839d8db7a83453e438d99bc445a

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            d2e134e7ec861cff70472f9fb9f7846a73a2545f09d33b4c0e2eeee8940fbcec

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            8341b1c82e0869dbbaeefac83df4d69b45de7eafaada3b50bc2eca732d84dbd35135b5ab5cb850d920c4bedc802e295e497372e7c16cac3b20aed6792bf8494d

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            97KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            829d061a5e512e2a07e97024f2a7c372

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            d4348ec417dfa317c3023b0516c75324bd33dbf9

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            c5579e8ad4dc807ec62b78551ba3a32f63968f4054d47115b56f039611fbc9ca

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            2b60646a087a9cb9516c3152b9bea8390e96a8e4beddded75d0c6eb6841c9235d4acfe940bb7d0a3052e86ad5ecd6b13118fd1bc6c9c62db5dd932ccf21e5d5d

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            108KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            156a2c93905bb8c145e4c57c1470b717

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            b84bdfdfb3b3b7182c9ecd5b66fa6f2bce96d62f

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            011b7e29660d18f8ce9a6b8bd96058ac79a2d85bb4aa87fc208dce1f6d01bae9

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            097de3d456e2e8750d25fa2f5c5d417d5d53fad79937eeda4a3f85fb158e97dbdd29bf716d875e0ab631e7ce22c66ce3efd0f60ce8ead3bfc991561fa00e0f5e

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58e7ac.TMP
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            92KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            da74f048e80ded0361f07aa4ca490761

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            edf107008dfec6baac1fb9ebe1e7959149d06e7f

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            c357e90b80aeb3bfff5245cf90ae0d2742fdc11700c27d7f37e819f4f1f7c2e4

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            4c7593d686aaa802ff5e3e30ed9bc8a7c71cc93a69cb03e9587047e8bbf8d4b21938c9698e13c77bbfd916c60e016d490a71b33a98b3c7ad6c93160dafeed2e8

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            99914b932bd37a50b983c5e7c90ae93b

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OHP8MVFQ\edgecompatviewlist[1].xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            74KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            d4fc49dc14f63895d997fa4940f24378

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            3efb1437a7c5e46034147cbbc8db017c69d02c31

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\2T053X7Q\OLU2Qs7L6j7GM-qga8AmcQGkif1_HTGLtucCbK--hhY[1].js
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            53KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            428b235509864aaa8e2ebe79431422ee

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            a8e28da93b5c19e95f26aa2d9887bce52aa8a9f9

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            38b53642cecbea3ec633eaa06bc0267101a489fd7f1d318bb6e7026cafbe8616

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            d39653918fabeee2d30bf0c274f6dd29854cc486c626938d21bb3f25bece069dcaeffe0837ab81541613903fa3660cf06bdc7ee41abde366cec901ac951355e3

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\2T053X7Q\india-bussid-tamilnadu-tnstc-logo[1]
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            80fd1651f118483ae57d305de33303e3

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            59ddf36d1979cdc427bd3673390ebd5404d8cb88

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            9a0de21eef45fdbd451222fa54ac6712f7713678804a151b6ac29d0c4723dfa2

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            dc436d5d48847b7a7d597ec8072d57dff88796dc03b3f78f90394fb447877a8d5efc81aa66598f01fb23aa7eab698196c162d0e0076f1a315e355a80500f52c8

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\2T053X7Q\recaptcha__en[1].js
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            538KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            33aff52b82a1df246136e75500d93220

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            4675754451af81f996eab925923c31ef5115a9f4

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            b5e8ec5d4dcc080657deb2d004f65d974bf4ec9e9aa5d621e10749182fff8731

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            2e1baae95052737bdb3613a6165589643516a1f4811d19c2f037d426265aa5adf3c70334c1106b1b0eef779244389f0d7c8c52b4cd55fce9bab2e4fcb0642720

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5FHAH0Y0\li789-fishing-logo[1]
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            21KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            32be9e2225af1bcddf4d5ab4458de712

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            89880eeffdc49bf8912e9a1b8f72071f9d538ac3

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            bb743a3e185dada827571b4a9dc1b0a36d4d3ba9533cd332d885e35b7221ffed

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            1425e22c32adaaa81fc4620bdcb217079035a2bb14173ea78f2ff1a42afd65ab81af57cd12892bffbb2b68d452e5e61f82407b5ad3f1d7ea5bfb761a9fd4b61e

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\84UH4MC0\SzbTPrPj0RZMh3sKke7Dm2R1EAOQaD1lrFJKAhnJ0tE[1].js
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            18KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            61721b9fc4880c88e14e0251d0ffc033

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            27a8a3835b9f801e3d9302631d0db87d7c5cd4e6

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            4b36d33eb3e3d1164c877b0a91eec39b6475100390683d65ac524a0219c9d2d1

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            f7c3a9572e54adc10991450521e16f89127965466e4500239e5a2b72646d212b2b8524e4bf0a761901f1a0232b1119c8ace823aeedd495a64a3ed812851e95e1

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\84UH4MC0\minecraft-logo[1]
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            68KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            fa23f6853d409269b1b4ce6b457d84c7

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            9d08b720513b68606c5f19af94ac4b7b0bc93390

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            621a14715030269fc50767b724eb44c8672b2adfe7b848eb7d5bb4353066fa64

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            4bb7cb66a8c22bc5529c7b11fdf59d33ba4558ec4d3b65c0aef87f113fe8aa69a123b0563be2e37988db17f778fe62a5e6be50925029ab3a916c92bfafd5a4d2

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\84UH4MC0\minecraft-logo[2]
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            22KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            5fc529e30fa4d695401e82d0d1fcd6a9

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            0ac4f0b8b6550b4ba641e1e1be669f66062c59ce

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            20763527cb7859140bf7c79778c621abba30bbb6574e3091a3f367042007cb54

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            c05695eba5ba9c09ac77c14b1ee56e72c0125fe2425799694c000e543a5a22450f8f188975f2e22903e57fb85c24d258d71022b0615d7441668ccee43754254a

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\XX7AM3Q6\56-y-0RG[1].js
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            88d2846441639b45d7262f32216a34a1

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            6da226356b80e0eebe3e531ef16b005f1c366b8e

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            e7afb2fb4446033c176bd9cdcd9af0557b28255505470a9e224034501675443b

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            c60f803a910fc8fa8cebefa2555bd91d70f3ea98d1f1b25d3afd922386d5f486711623aacf633c51200774748bd5700174adccc197f5551634aec6de1f567a5f

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\XX7AM3Q6\anchor[2].htm
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            48KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            56cec88c67c70040c681469751fcb452

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            a1530ca45d20f4c83c041df65484e8ae6cf9f3ce

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            76973b86e6f8607447e41d0c99ab1f184c7f672a57ceedd3b23c492860d20f23

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            376b24eba501e90e0e8eeb4db8c8015f481a2553082afeb4deea982f5432a79ac51176707538f63a5aed939ff393126a79d6396e1e3e329242c5cc3049094e8d

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\XX7AM3Q6\bframe[2].htm
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            7KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            30270c0492be805df5be948306e4e50b

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            0b8e01d73cdab88c9acb38a057456d965b4ff744

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            4a966a4abb0e1213a10d06c447099db1ed93665a116ba9d3ab9d2180711f8b9f

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            3824394b2fd4bd7fdc73b8bd5e2a7ac25c77a27d5aebace210c779abfb442bcaad10db3205ed554b4ebccaf403db9c0b5888df8fa99a9d0f6976c4150e17815b

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\XX7AM3Q6\styles__ltr[1].css
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            76KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            0ca290f7801b0434cfe66a0f300a324c

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            0891b431e5f2671a211ddd8f03acf1d07792f076

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            0c613dc5f9e10dff735c7a102433381c97b89c4a26ce26c78d9ffad1adddc528

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            af70c75f30b08d731042c45091681b55e398ea6e6d96189bc9935ce25584a57240c678ff44c0c0428f93bf1f6a504e0558bc63f233d66d1b9a5b477ba1ef1533

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\XX7AM3Q6\variables[1].js
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            441B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            73ae6038641b6d983f4c50f713822200

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            e25cdb8d61a1439ca5800f0afa6fe606aef302fa

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            00ebfb8b1de6c094f65763ac0153e72a6d98045b01f67fcbcc0aa23b09bfe76a

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            9858cb51018c6dd899e974fcdfa42a7d9fb72e4aa26082e69d6c0ab74fd70d65786596b49ef2004a02204de6ab17914036fa45b4e83c0e33f77ae562d493982e

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\0XYZ8ND8\www.google[1].xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            195B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            3efe33a7e3c0e28ed5e6e94ea63317fa

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            daefb4ac77d9c94f7da40ee5e26cbcde5c630992

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            bd1e73dcc5e13f7ce2b5c4b11db3b70599aaf5362e7c85e68f7ca398c07e2a43

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            a1694f3a69d07175504287bbb6fee72c638c3b53aa4444b54fa2bed25afb4005d23ed173f5fe819729306cefc7f2c83dc0fbb1e5e1ead47f055cf47a80f14481

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\0XYZ8ND8\www.google[1].xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            95B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            8c4d5ddd87be13420f6726c5c6c532e5

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            7a2e4bba73d28e4e3028b8dc5e21a1659b5fa035

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            5880256d341d7e901c3406c53cf9bea4191b73f19745f781ca366f7b227feaf7

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            2596f881a921c0adf7c78d804235307d7e662594b2ed9b5ced3d57bb0600ce61c6d144b105889c51439d12932bedbe3408403a5ee38ddea4d74f1dd03fe9d54c

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\0XYZ8ND8\www.google[1].xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            234B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            4f56a1e143e965e013de9fb09f515033

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            dffd848e8e5d7928a0b52360d704a73df36c113c

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            15357ace2002fca904763e7fb56317b6814db006da26196a444e12164d0878e2

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            7e55b94718f8385342f21ed7c918008213bef2b367837d7100a8d930b2cfeb17712f97933952f6f66182e12d7f39825ec36cbb603f986d84c6cd441b58271e90

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\8INLVFAA\www.youtube[1].xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            228B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            861ea7b453803d72d1d9439f02ad4756

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            2812a964418455f1f00db164aa0c28a46231865c

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            e07180996f21d860e772f7ac269adb799a5d29e43cb5b399e2463cc7f9b130e6

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            8e15d7af54c198a400d5ce5123d44f9f496cc6d4f693cff308b4045ab872d7eb56b32c8a6f601af19a7a18b53cd1cfb5739161114f311fa235aaca86f9cde294

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\8INLVFAA\www.youtube[1].xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            446B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            42cc2a411202f32a3879090093c7e82e

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            5724d7f04329c5e5cd6f106177d6414e7ade4edc

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            3e2f33ff9fbe0b86b0b9f5f540460badade94143a4c0b2f1603389bd24e3e3b4

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            39193d9c8c7de40ff46cbe024f9899a27b6b1d094a6bd1be2e2050abb53c5582d93cdbb0a1d06e94b9ca95f53ba0664319f77e5cc8cd3913bcc468357f41d610

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\8INLVFAA\www.youtube[1].xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            19KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            d9e6745ed760ddedcd940965db12e6e5

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            f1f5cf841a67a57219542b1bc213dd9a2e35dc78

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            b8cde369401c9f42544527bc4504519d7ae08a7bfa3931c2bcb207fd1aa62bbc

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            917a64e9ae8f727a81328687154f55e0d82e7caf2d48ec18a49e75ac724162b5788597ba748bd2884c54097ab8bc21fd28ab3d2e75f315d53df870bfa5f98cae

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\8INLVFAA\www.youtube[1].xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            987B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            94d3c8eba72627d1883053209e39ad47

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            8032be349a76e37c7f096b08751c3a26feff6ada

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            d8d0c900b38a5545b1ea0fa08a52251c33da3167be2a379dbc321fdc0cdd94e2

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            b254d7b2633d8afdf109c420f59d2e99aaea8c05491b2cffbfc961bdf206cb0fad0546c66320a32b5dca41ad83cc1a14ccc87a8b644837edec73e0f6834ff6eb

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\8INLVFAA\www.youtube[1].xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            987B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            a45f57044ddcf6159e8649e500b3490d

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            ba5e8d1c8ed9067c4fc740febefc38d3d2763bca

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            b84646decbb3738703fe99b86baa612f488f41f88006dc5ac274b14754ba980c

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            52096ccf4fc533dffae947cd2b8647f31c64ec9acfde816c134f83159e0cca3b636a3fb44a015de2c09bbf8beb282b33f1e840670a9890dc9b9eb6c492b1a3f3

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\8INLVFAA\www.youtube[1].xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            987B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            e7d63e33534247b970c104aae5378f36

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            1a6f711bff8e0086972f9b3e2c9ca9981a06f4f6

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            d218d1a7da034641d9443fd45e0292e0c90c6aaa1581c1e8e3b637023ed1fae6

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            4f549f88f5a90d7065025f003615b08641b5e9c333384602dd7a4493ad6ccd614fd0f4a55bd03c3a72fa1062fe3b4d650edf21ee9b5b4f4fa1cce38281b59961

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\8INLVFAA\www.youtube[1].xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            f75a40c1aa9cce3a181b281b6d86efdf

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            7f434206f57986b605c45c44e8749ae3b6cc008f

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            28bc27d354136c1b74cd00d78181ec24c80a0a003606c48a0526f50319286059

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            7d177c1820df8595a453b1afa5eb35b42beb72b17dad7a51e90184c103da83dfdb952018f50c02b65894ea5f62b88f0c5b2db2d42addc21687add9bdd2be2afc

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\8INLVFAA\www.youtube[1].xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            1d7d25b071c8e1e3ff8e470015bc9d42

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            bb30701a513cd7a71418e5e3ac5e623ec08cfc50

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            ab92e351ab902e5c6a59c344a818a26c09e3c09861ef149137abb4517d2d587d

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            0768f3cce3199679e69e828299abce7462bdbe8df6550a66b938e5fac286ff4b51dcc19650c609376b38cda55261b7848ad60134f70f456b4e110346707473fd

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\8INLVFAA\www.youtube[1].xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            1a423bd7de99afd67f8a62dfd17ff346

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            454178a54023f2e8e0e827dde859d7a322a4d7f6

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            7767d16a9e0c8b835182b407017fd52d1fac2a1a2a5e0ab1b4e9936495c8d32b

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            72d34ff178f25fc004bdb1ca7af16498af08e1d13ab0fa6c09dbce4b6a7248ff19af07f6595305e229ddd24225591cf88c9887e1c306459db5578465ce4b4284

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\8INLVFAA\www.youtube[1].xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            d099f1cff159b91ea80cf077f24e5683

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            af768413bbbe80549b1ad1bb0f5107b764d9bbaa

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            be1401b2f5a77c10199b0f272ed932b58403609de2c6c4e7bfd2f0810f685db6

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            e9deacb906592851ed04907cb940bbddc88d6264a14c6a40f5d0f09516f272c20cd17d06aa99d3cd1e00ba69fdc1bcb54c796c46616ca266660dc5a1cb317b35

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\8INLVFAA\www.youtube[1].xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            0deab7fa5359ae15942d5986d1f62f59

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            c9c862cc7b920a8e0cc181351d05821a1541f1f5

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            fffa8192099fe019f44631f03133855373a48e29faf9f19caf435a516826b384

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            ee86d46a4a96d63eef99d77161083219572ed47215b0184530b7bf625d1e7f6fc848990d87ea20d5e9cc89c620935518e5a4f3d06aa75aa3a27fd0bdd888d5ac

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\8INLVFAA\www.youtube[1].xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            5c6c9c41a7398a7a10ee50c4a180d32b

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            300cd976289b0b5087a8642cecc09a1acdd989af

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            d3f79b07348ea3fa3bc1f474abc32d2508068926cb5cfa82977e63e4f9cfc021

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            15b47cf80357f357bc93c82808840974c1fc4fa7cde327ed99de476cdc816e66da8055bf6ce29fd7ca9e8bbf38d9518e2f072b81fadf4aef29589a96d5b1f665

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\8INLVFAA\www.youtube[1].xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            19KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            4560aa92065b4c076e4a6dc74a597205

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            c6f557e6fb02afebbc79c3bb7c39544fff58e8fe

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            b9c715291d4c1a6a66e2272edd096ec5b30033e4b37f27ce2e486aaf43833b00

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            a9158c1177efcf84520dc5ced8ef1df4222ef3d2c0d3467bce2ce083e76f3ea00de20637910dfa3f552468efa89c10817364a796f4c2322840fcb67ebbda0556

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\8INLVFAA\www.youtube[1].xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            077dce0db38c6c8e5c7ad9d40fc81538

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            bf63dcd077888f674ca6533f4cbf248959f966f8

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            3c6f67292c2ffbe448cdb85145152da4c47bebfd7d7f0bcb4c8f9d683c988815

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            084e33a9c3528510d9a766958e627cffb984e8b15bc650c416d0bf330633e1abf53e470e7ddc0150250edb396020fd4e0e61da25cf7cc9ca4633e4988a2b4e4d

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\8INLVFAA\www.youtube[1].xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            4b4e03e126e75766bb51994e75ae998f

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            a2a10b1febbe4d79d39bca929a191bbeb9acfee9

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            afcd887663524fc09f4cb1c6e9d6726fbac0ff0b68d0e60627bcdc73c778b6ef

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            915bad1317ce41b69013a89e351e6502f9790a39ae427ae7034e903d7db6864703ce8fb3b950ad021c7f103381ce053ee93b59ccf8d3d6c906691e44d7cfd6d4

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\8INLVFAA\www.youtube[1].xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            76d8adbee66d97b1648fd975d3817bca

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            ee579de1cce6f43732c96083b4fc83c1d4427143

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            4f0bcdd4fe6bd6c7353468a7fbb4fc3655ad5d35db54197c704d5ef968999b60

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            e903e21a18ceb0033713feba19461d3cfa7891d5cbbc5ac10d174fc98ceab7812d1d0f9a8ced19392f08d89b3193a7104b6dc63d3b9c61cc629cfd8a55dac96b

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\RTQU8ENG\www.vice[1].xml
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            13B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            c1ddea3ef6bbef3e7060a1a9ad89e4c5

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\EDUAX9CL\b80692[1].ico
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            ac0cd867e03ed914827807d4715bdfe7

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            4051a8c23756c10d9cc00fcde6f7215c780fdf6f

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            b50546da121186fbffd2aec430249cb21c7c2e2c85e561a393a9df9abfc4477c

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            fa11d1d76c39719c218b4ffa34de8dd44d398bdcbb236a666f0be6eeee96bcbe4da9ac65a89441ad284c0de21788c135dc4fd21f6f82c7039f00c8a7c705c8e2

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\EDUAX9CL\suggestions[1].en-US
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            17KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            5a34cb996293fde2cb7a4ac89587393a

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            3c96c993500690d1a77873cd62bc639b3a10653f

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\GEU7PI22\favicon[1].ico
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            361KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            dd93641f8ed77493e86a01fca33558cd

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            a4aa666eae95568bc0c894b2bc6bdbd6a107e5fb

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            3f3798785c0eba47ca077ba4a8d3fe6f2d6f586c7314278e318b345cc5866abf

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            24566e9dfcae2b4988d4edf5857ebcb9853a5b89a67e3a7be525446563cd8b182979b435d596e4c8b4074a04b0aca0b868d6d2e7c55353a986ac6688988c62c0

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\GEU7PI22\wikipedia[1].ico
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            904ce6bd2ef5e1eaa6de1eb02164436b

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            b37ac89616b9e4c01a35991af59fe6b63e41a48e

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            3638de61226857e62cf5187d7d59cf902111ad4f792b5bdff1bfed3f5ed5e608

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            05044e298742b1520585ae3c029938036ebed50337608a600c4924a29e3624ce704f3b13fbe348d9e1b1e93b1e0abff9f53bbc9fd31929199f9a374f154f74c2

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\M2M1LSR8\cropped-site-icon-1[1].png
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            384B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            6d50702ca9855b57d6d1a21dd764e5cb

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            e23607df9dd152010df5afbdeb021014ecd4bbfe

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            37e6c9ad51b349ae4673c27554573809cbd80fdcb0029735de40053ce3e4c536

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            380e98230eb2eeacdfe4b6dee01400d5f82a6e2d7531b18c5f4e1cc62e7851f6e7b7cefc54b96cb6f3b4350b265d49d0331ed84e60e2ce38357759d4227b6f87

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\T7EL5T46\Site-favicon[1].png
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            746B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            2ca93899f2ae58666f834fdb8527a05e

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            ddacdf92c5c10fadaf30a5f023a8b827753498df

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            828aa5ab1e5f454847f137c9c9aa8b35751bfd4fb8db3830f31c31e37f23e607

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            c989503436410385d1c28a13295fe5e6610eeaf2b95b57d2b6c974d73d6e2421ca79f161235115b7362a899dbcec94d652ac279e54e0aab267a3b7b15561e9d7

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\T7EL5T46\favicon[1].ico
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            5KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            f3418a443e7d841097c714d69ec4bcb8

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            49263695f6b0cdd72f45cf1b775e660fdc36c606

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            512KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            d27041238d06c588f6e8c14c2e992bbd

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            22f338cba8497ebf7f52eacc4c2bf8eba982b2de

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            57cadffc4c2bf7b731f08438bd62599932eb624c444d3b6554065ca0fd96c1a0

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            28b7252278fc7b58e06e821d2f525681ec01376b19f797890295fd471a3112e0e7e0449d1a53355055e90f8f8bab179b48f2b1a8ddd5c35750c489571fb74028

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\276owue\imagestore.dat
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            15KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            10970207e32046d265d28f9c02f35dbb

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            561f1b3a9b4728d57abe55fc9fed64231f8ea872

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            0c7b0e7cb5ecec42509f438b963bec01bae844774413268f0969d9f95a26953c

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            441078202c59b8bd384a9d919d7058f44cc384431d397588c1c160330f639053b5a4bca1487805e372413392652f3a3ad10f34797db014fbf5c6795e6df3141d

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFC785551B09810D52.TMP
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            16KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            59cc758a90fb29da00a8dabd6fe024ce

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            28cc9a21d1486754e9b73076ecfa0b7ef12afdd8

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            0541b6e261c76c4c2303da6f90dd3a5873a2bcf1570a05beedf538d0230e6f7d

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            028dc6bfd179db60147a5437e223fa7cf5c78c99a08c64f04387df1cf10a8d49afab1885c8fc01eb9f6c2f3b6b9f509e06f8df4dc02f6706a3b0376225750418

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\00000000.res
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            136B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            60743e2f953cb745bd103575c90b6364

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            43c2e1d9e9097964de268faf152c76e833f97b8e

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            067a3ab80ffe037ef8fbbc4328b3ee1b39fb6f2f2dfdd7f9b63926f0a15b365b

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            253740b70e5aa2148f8751ebe395fc8a68f2b9d173658e1ea927500b8ed46e2613d6ce501eb79befaaade92bfaa73836aa1f2d390facffa4a2d384671b2e43e8

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\161551728090946.bat
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            400B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            ab68d3aceaca7f8bb94cdeabdcf54419

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            5a2523f89e9e6dde58082d4f9cf3da4ccc4aae26

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            3161fdccd23f68410f6d8b260d6c6b65e9dfb59ef44aef39ebb9d21e24f7c832

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            a5de5e903e492a6c9bcf9fbc90b5f88a031a14fca8ee210d98507560290d399f138b521d96e411385279f47e8de6a959234a094e084c2e7e6c92c0ea57778f64

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            933B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            7e6b6da7c61fcb66f3f30166871def5b

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            00f699cf9bbc0308f6e101283eca15a7c566d4f9

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            fdcbbb81d5c638b91a480fb8d3a47091

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            a093e6b11c40331c080892070e3474e4f982ede5

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            1fbd2e7b6fd02593b473b7822c9b9b8972aa03a06765312d2ae5a667885a7572

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            03f6673429bf41be4f735192dcf12d9cf44d49854b5033b9b39ffcce0f65072bb381cee30decf649814e06ce7d5c142f78ed7e1eac9f037f6c6d40f14cda7826

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\tor.exe
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            3.0MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            fe7eb54691ad6e6af77f8a9a0b6de26d

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            53912d33bec3375153b7e4e68b78d66dab62671a

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\b.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.4MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            c17170262312f3be7027bc2ca825bf0c

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            f19eceda82973239a1fdc5826bce7691e5dcb4fb

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\c.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            780B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            93f33b83f1f263e2419006d6026e7bc1

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            1a4b36c56430a56af2e0ecabd754bf00067ce488

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            ef0ed0b717d1b956eb6c42ba1f4fd2283cf7c8416bed0afd1e8805ee0502f2b4

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            45bdd1a9a3118ee4d3469ee65a7a8fdb0f9315ca417821db058028ffb0ed145209f975232a9e64aba1c02b9664c854232221eb041d09231c330ae510f638afac

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\m.vbs
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            279B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            e9c14ec69b88c31071e0d1f0ae3bf2ba

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            b0eaefa9ca72652aa177c1efdf1d22777e37ea84

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            99af07e8064d0a04d6b706c870f2a02c42f167ffe98fce549aabc450b305a1e6

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            fdd336b2c3217829a2eeffa6e2b116391b961542c53eb995d09ad346950b8c87507ad9891decd48f8f9286d36b2971417a636b86631a579e6591c843193c1981

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_bulgarian.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            46KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            95673b0f968c0f55b32204361940d184

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            81e427d15a1a826b93e91c3d2fa65221c8ca9cff

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_chinese (simplified).wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            53KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            0252d45ca21c8e43c9742285c48e91ad

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            5c14551d2736eef3a1c1970cc492206e531703c1

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_chinese (traditional).wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            77KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            2efc3690d67cd073a9406a25005f7cea

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            52c07f98870eabace6ec370b7eb562751e8067e9

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_croatian.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            38KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            17194003fa70ce477326ce2f6deeb270

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            e325988f68d327743926ea317abb9882f347fa73

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_czech.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            39KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            537efeecdfa94cc421e58fd82a58ba9e

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            3609456e16bc16ba447979f3aa69221290ec17d0

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_danish.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            2c5a3b81d5c4715b7bea01033367fcb5

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            b548b45da8463e17199daafd34c23591f94e82cd

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_dutch.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            7a8d499407c6a647c03c4471a67eaad7

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_english.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            fe68c2dc0d2419b38f44d83f2fcf232e

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            6c6e49949957215aa2f3dfb72207d249adf36283

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_filipino.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            08b9e69b57e4c9b966664f8e1c27ab09

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            2da1025bbbfb3cd308070765fc0893a48e5a85fa

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_finnish.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            37KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            35c2f97eea8819b1caebd23fee732d8f

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            e354d1cc43d6a39d9732adea5d3b0f57284255d2

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_french.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            37KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            4e57113a6bf6b88fdd32782a4a381274

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            0fccbc91f0f94453d91670c6794f71348711061d

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_german.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            3d59bbb5553fe03a89f817819540f469

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            26781d4b06ff704800b463d0f1fca3afd923a9fe

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_greek.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            47KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            fb4e8718fea95bb7479727fde80cb424

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            1088c7653cba385fe994e9ae34a6595898f20aeb

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_indonesian.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            3788f91c694dfc48e12417ce93356b0f

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_italian.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            30a200f78498990095b36f574b6e8690

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            c4b1b3c087bd12b063e98bca464cd05f3f7b7882

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_japanese.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            79KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            b77e1221f7ecd0b5d696cb66cda1609e

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            51eb7a254a33d05edf188ded653005dc82de8a46

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_korean.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            89KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            6735cb43fe44832b061eeb3f5956b099

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            d636daf64d524f81367ea92fdafa3726c909bee1

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_latvian.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            c33afb4ecc04ee1bcc6975bea49abe40

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            fbea4f170507cde02b839527ef50b7ec74b4821f

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_norwegian.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            ff70cc7c00951084175d12128ce02399

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            75ad3b1ad4fb14813882d88e952208c648f1fd18

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_polish.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            38KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            e79d7f2833a9c2e2553c7fe04a1b63f4

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_portuguese.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            37KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            fa948f7d8dfb21ceddd6794f2d56b44f

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            ca915fbe020caa88dd776d89632d7866f660fc7a

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_romanian.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            50KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            313e0ececd24f4fa1504118a11bc7986

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_russian.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            46KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            452615db2336d60af7e2057481e4cab5

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_slovak.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            c911aba4ab1da6c28cf86338ab2ab6cc

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            fee0fd58b8efe76077620d8abc7500dbfef7c5b0

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_spanish.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            8d61648d34cba8ae9d1e2a219019add1

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            2091e42fc17a0cc2f235650f7aad87abf8ba22c2

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_swedish.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            37KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            c7a19984eb9f37198652eaf2fd1ee25c

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_turkish.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            41KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            531ba6b1a5460fc9446946f91cc8c94b

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            cc56978681bd546fd82d87926b5d9905c92a5803

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\msg\m_vietnamese.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            91KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            8419be28a0dcec3f55823620922b00fa

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            2e4791f9cdfca8abf345d606f313d22b36c46b92

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\r.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            864B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            3e0020fc529b1c2a061016dd2469ba96

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\s.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2.9MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            ad4c9de7c8c40813f200ba1c2fa33083

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            d1af27518d455d432b62d73c6a1497d032f6120e

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\t.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            5dcaac857e695a65f5c3ef1441a73a8f

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            7b10aaeee05e7a1efb43d9f837e9356ad55c07dd

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exe
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            20KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            4fef5e34143e646dbf9907c4374276f5

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            47a9ad4125b6bd7c55e4e7da251e23f089407b8f

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exe
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            20KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            8495400f199ac77853c53b5a3f278f3e

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            be5d6279874da315e3080b06083757aad9b32c23

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\u.wnry
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            240KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            7bf2b57f2a205768755c07f238fb32cc

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            45356a9dd616ed7161a3b9192e2f318d0ab5ad10

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            257B

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            9a6892af5ca7b04f8e072828d03e4def

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            e363b8f93f22df8a11222cc7baffe8a476adde49

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            1ab50742d58c37f060f8a23c5c11186a70bd730822091f556e236a8660395561

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            ebe3c67c789de1d8004db70e5ce6da9106c1cfc9915cdcaf03c75ba67ea3d6785cdf9c9e08f71e0cc2793d771d572b1b1e1fad9d19ef24a0db0dbc9d19c21028

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            6.3MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            32267758cf7c347459327df742023f9b

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            f132ed8e325bab0e26bb5e001686bd8c71bc474b

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            c5ee1c7a5ccbce597068281e0f7dff19318cde8473824e1e2ec21c74e18831ed

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            7d7d1bdfd83f726953b971974dec174a282b0361d646d50cd002a1f5ecf332e055e5e58683962cb648c31054b20af12f9d6e83ac05b0bec2862a82d1b2f0d6b6

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\Downloads\MEMZ.exe
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            16KB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            1d5ad9c8d3fee874d0feb8bfac220a11

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            ca6d3f7e6c784155f664a9179ca64e4034df9595

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • C:\Users\Admin\Downloads\Ransomware.WannaCry.zip.crdownload
                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            3.3MB

                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                            efe76bf09daba2c594d2bc173d9b5cf0

                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                            ba5de52939cb809eae10fdbb7fac47095a9599a7

                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                            707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a

                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                            4a1df71925cf2eb49c38f07c6a95bea17752b025f0114c6fd81bc0841c1d1f2965b5dda1469e454b9e8207c2e0dfd3df0959e57166620ccff86eeeb5cf855029

                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                          • memory/660-629-0x0000000010000000-0x0000000010010000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2248-2085-0x00007FFB357A0000-0x00007FFB357B0000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2248-2086-0x00007FFB357A0000-0x00007FFB357B0000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2248-2079-0x00007FFB39210000-0x00007FFB39220000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2248-2346-0x00007FFB39210000-0x00007FFB39220000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2248-2347-0x00007FFB39210000-0x00007FFB39220000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2248-2348-0x00007FFB39210000-0x00007FFB39220000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2248-2349-0x00007FFB39210000-0x00007FFB39220000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2248-2080-0x00007FFB39210000-0x00007FFB39220000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2248-2082-0x00007FFB39210000-0x00007FFB39220000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2248-2081-0x00007FFB39210000-0x00007FFB39220000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4192-10-0x0000000002220000-0x0000000002345000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4192-1-0x00007FFB79225000-0x00007FFB79226000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4192-2-0x00007FFB79180000-0x00007FFB7935B000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.9MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4192-5-0x00007FFB79180000-0x00007FFB7935B000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.9MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4192-6-0x0000000003050000-0x0000000003E10000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            13.8MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4192-4-0x0000000003050000-0x0000000003E10000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            13.8MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4192-0-0x0000000140000000-0x0000000140785000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            7.5MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4192-3-0x0000000003050000-0x0000000003E10000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            13.8MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4192-7-0x0000000003050000-0x0000000003E10000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            13.8MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4192-12-0x00007FFB79180000-0x00007FFB7935B000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            1.9MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4192-11-0x0000000140000000-0x0000000140785000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            7.5MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4996-2069-0x0000000073580000-0x00000000735F7000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            476KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4996-2262-0x0000000000080000-0x000000000037E000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            3.0MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4996-2065-0x00000000738E0000-0x0000000073962000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            520KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4996-2064-0x0000000073970000-0x000000007398C000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            112KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4996-2366-0x0000000000080000-0x000000000037E000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            3.0MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4996-2371-0x0000000073600000-0x000000007381C000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2.1MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4996-2377-0x0000000000080000-0x000000000037E000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            3.0MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4996-2382-0x0000000073600000-0x000000007381C000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2.1MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4996-2066-0x0000000073820000-0x0000000073842000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4996-2063-0x0000000000080000-0x000000000037E000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            3.0MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4996-2067-0x0000000073850000-0x00000000738D2000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            520KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4996-2428-0x0000000000080000-0x000000000037E000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            3.0MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4996-2068-0x0000000073600000-0x000000007381C000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2.1MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4996-2024-0x0000000073850000-0x00000000738D2000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            520KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4996-2027-0x0000000073820000-0x0000000073842000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4996-2026-0x00000000738E0000-0x0000000073962000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            520KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4996-2028-0x0000000000080000-0x000000000037E000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            3.0MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/4996-2025-0x0000000073600000-0x000000007381C000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2.1MB

                                                                                                                                                                                                                            Download