hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/WinNuke[.]98[.]exe

max time kernel
960s
max time network
965s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
09-11-2024 16:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/WinNuke.98.exe

Score

8^/10

defense_evasion discovery macro macro_on_action

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\mbamtestfile.dat	MBSetup.exe
File created	C:\Windows\SysWOW64\drivers\mbamtestfile.dat	MBSetup.exe

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

resource	yara_rule
behavioral1/files/0x001b00000002ac92-289.dat	office_macro_on_action

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MBSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	MBSetup.exe

Executes dropped EXE 1 IoCs

pid	Process
5664	MBSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
11	raw.githubusercontent.com
13	raw.githubusercontent.com
30	raw.githubusercontent.com
2	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\mbamtestfile.dat	MBSetup.exe
File opened for modification	C:\Program Files (x86)\mbamtestfile.dat	MBSetup.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 8 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\rickroll.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\BossDaMajor.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\$uckyLocker.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\LoveYou.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\MBSetup.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\YouAreAnIdiot.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WindowsUpdate.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MBSetup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 19 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 411517.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 915308.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\LoveYou.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\YouAreAnIdiot.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 870869.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 290070.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\MBSetup.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\BossDaMajor.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\$uckyLocker.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\metrofax.doc:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 904460.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 670844.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 298250.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WindowsUpdate.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\rickroll.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 340533.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\MrsMajor2.0.7z:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Malum.apk:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
4516	msedge.exe
4516	msedge.exe
6128	identity_helper.exe
6128	identity_helper.exe
5360	msedge.exe
5360	msedge.exe
2072	msedge.exe
2072	msedge.exe
1456	msedge.exe
1456	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
4036	msedge.exe
4036	msedge.exe
2084	msedge.exe
2084	msedge.exe
4876	msedge.exe
4876	msedge.exe
6136	msedge.exe
6136	msedge.exe
5664	MBSetup.exe
5664	MBSetup.exe
5632	msedge.exe
5632	msedge.exe
6124	msedge.exe
6124	msedge.exe
2776	msedge.exe
2776	msedge.exe
5592	msedge.exe
5592	msedge.exe
5972	msedge.exe
5972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5664	MBSetup.exe
1408	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 6068	4516	msedge.exe	79
PID 4516 wrote to memory of 6068	4516	msedge.exe	79
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 3684	4516	msedge.exe	80
PID 4516 wrote to memory of 2880	4516	msedge.exe	81
PID 4516 wrote to memory of 2880	4516	msedge.exe	81
PID 4516 wrote to memory of 2000	4516	msedge.exe	82
PID 4516 wrote to memory of 2000	4516	msedge.exe	82
PID 4516 wrote to memory of 2000	4516	msedge.exe	82
PID 4516 wrote to memory of 2000	4516	msedge.exe	82
PID 4516 wrote to memory of 2000	4516	msedge.exe	82
PID 4516 wrote to memory of 2000	4516	msedge.exe	82
PID 4516 wrote to memory of 2000	4516	msedge.exe	82
PID 4516 wrote to memory of 2000	4516	msedge.exe	82
PID 4516 wrote to memory of 2000	4516	msedge.exe	82
PID 4516 wrote to memory of 2000	4516	msedge.exe	82
PID 4516 wrote to memory of 2000	4516	msedge.exe	82
PID 4516 wrote to memory of 2000	4516	msedge.exe	82
PID 4516 wrote to memory of 2000	4516	msedge.exe	82
PID 4516 wrote to memory of 2000	4516	msedge.exe	82
PID 4516 wrote to memory of 2000	4516	msedge.exe	82
PID 4516 wrote to memory of 2000	4516	msedge.exe	82
PID 4516 wrote to memory of 2000	4516	msedge.exe	82
PID 4516 wrote to memory of 2000	4516	msedge.exe	82
PID 4516 wrote to memory of 2000	4516	msedge.exe	82
PID 4516 wrote to memory of 2000	4516	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/WinNuke.98.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffca2cf3cb8,0x7ffca2cf3cc8,0x7ffca2cf3cd8
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4128 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6940 /prefetch:8
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2752 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6820 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6724 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6840 /prefetch:8
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1692 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6908 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=984 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7148 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:6136
- C:\Users\Admin\Downloads\MBSetup.exe
  "C:\Users\Admin\Downloads\MBSetup.exe"
  2⤵
  - Drops file in Drivers directory
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3828 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,18281122313772542756,7572412555664295761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:792

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2bfd05f445a26f7371d14ff2a0e05d63

SHA1
bdf1f7f6f5f691273250e44b8aec33e8740b5957

SHA256
5bd457a10a2d83e67e2a2e6a4f10302006c17b94a26301aa9b029402fb8ca4d7

SHA512
e1a79c3e0a73a09f71a7e2547dfb45da1bfe02a190d523c4f0935ffefd1b7de016312b1788198ba4b737b440bfef75cdded778500e488ab50e40b4a62c154825

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
24bd185613ddf436c8af2b7e7ad8c22c

SHA1
6b88d72e840f695565974cb4054795c5827bb574

SHA256
1f3b7554fcabb16906163f9f434ed4f6d8f039fd867538e08f67d759a5cbb3b6

SHA512
f89392741db419b37af7e21962e120c4cd8aea8ac92e4c1b91e3e9e7e64e1630eaf50cf9ab40e84b412730059e2afadb7172cbeed1003d9d90445c6ce2b8c36c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
97137ffa409c122c2b8484584744402c

SHA1
e45478dc103b7d8fdfd0203d15bd7552c1042db8

SHA256
d339d7f2d9399752339d39342e7d5a630aa37ed4ee10081b176ad1af0ec003f1

SHA512
4fc5fce210defca1491be121ef5e5b0b46db3ebabb7dc8587b60f807ba551a248f4bc5384ce92704076f96ed1873b5a09811d679665946610b330315e94d2a67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1585d75ee292e4598d457f8a5b93447d

SHA1
d3a3b17cdcc1a65ca06810cc6b8608e696ab840d

SHA256
9fd18751c88a9989aff93707458bfc04e9cff71526af2ecb7b647a095bad7311

SHA512
7213f1c354eadb5db219c796ebcc96941594f9a1613e3a7f8c7b3043f72c19946534f033c9045a5eeb46efc73be6403758e2cdc708efd0a9492fcabe6820fe80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
2ebbd61422b78463e73114c90d111185

SHA1
96a2a4824b034c487ccfcc08f3d7defa75601565

SHA256
164f96175f640e1c88954414f0d6bd4b866e8bc4004221585211df95aaeacaab

SHA512
a707e87fa44ddc0f804778e849698b4b9b1a110342a9eb8abcc1a9178019d6424077d6293940adf1b3db80872e42fb70347fb927e7a6cadb2490381fb2f1b926

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d96ccc74bf5103ce1ae0087bd53038ca

SHA1
dde6d14f5ffa35522090e0e62fa54059647a11b1

SHA256
679edf5cb643af79f5dbd6b2de7e22b9cd5ea387bb6957438d8d554eeb117d47

SHA512
8a7e638c0b396461503f1c45f5ea9b76c2980f1078bec89e69bfbfe41364fc8ff436b7c1cd7555c20f65e387691a9046ac9d9f29f7f5a4e0624d0d65e4e6bf27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a56d82f70d621ebdf6829b1adc9c0f59

SHA1
a3a7f2527860b3b3b08e7e19c6471ff1bd3612ff

SHA256
25391688c6d56f0150777d893b921ba2f73ae4e65d19a82cca3fb3c544e78ec1

SHA512
25df635ff1eb195c67091f729900944c25d70cfa6d265c1d33dc88e0f61cc685f325dd93ed83f8491c769eb8b89ea45abf35f54f92e977fa0e6e4780a51dd749

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
45f4be81f8554745d80cc51af9e785b3

SHA1
a1b6f472c6d3c64d7a003b359d9d622c661b8eb4

SHA256
85008359afe61cfebc5194cd905eb2f01ec54b0308b36c023b22aaad0d18f7d6

SHA512
24d599c67910ed43219c47a3eb183e3018b14198ad0285b11478c86d4dceb0873ddafc56d4454a2de4c206c8f9cf9451a4c482f84e183e51538b9407df69f0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
439e3ff8cc23ddfe486d663ec24e995c

SHA1
55c6f869f6862764989d31e6f15d1719ba6a0709

SHA256
a0eb128043739a27706ba871dbfe9f77273bdc9ddd212e29179b2e23417abcb0

SHA512
877bfcc7724b3b1e532bc8c3ac04f7077f1ce464654ffbbdad4784f0c9a5b757a9f8fadb9b95cb182f48a63b33bb649ff59d700aab71a707ebe51f78deb9aece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f4ecd56330b908d0ccea03a6b8e8bd77

SHA1
3f59c271c48e88e905b51d88d4ac5322df70e8bd

SHA256
9ff3d8a780a715b0ffce6a53c9b73180252c1e89809db1a902c97f72568de3ca

SHA512
f55a5950428bfa4cd632936aa70ed5123a2ea9014883a666b5c2df136c80d31e6bfe7794c4972ab894efff443aa5d8464901b591756af0f9cca3db40db3239ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ed91b8a4a2ea289ec5499452d3df1f93

SHA1
ee91a3c1af25c41e80ef2bb878585b584de6a978

SHA256
e72303d5ffef36a49959febd748c3a2a3aaed69d782090b6bdf3a7be99ad0c74

SHA512
a69162cec4fd384c55707340e55e5537dc2d0f01434df0cb448dd5175fb50543cd91e4fdb1a45e153698681fec5b3916697d3c52da462905ce41e9393b82cd59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2d1730df877872d9be6a22b75fb66e7b

SHA1
fcc0a63047755e7ea1009d6b1c8d566558731ba3

SHA256
dbf25ae5ad7c38337a0a531bcee3cd0f1ed1d858ce814fc6df00005a0dffb546

SHA512
f448ce29ef3303420f68f8f853236b4d7c1cbdf2570b1bef63e0d4717d32b143cf06f3d754cd74e8c8c0832583720e02cdb09dad4bd7869f0191db6da85e4041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d21ba75dd0dbae446adfcb776e8cf609

SHA1
ef08d62287252b7972e83dfae8e74223c6dc6c75

SHA256
e5076986cb4aad12b8a88901e7836197b1acb9aa003f546eb632f8ac67d754da

SHA512
f4b30b3fdc9241de84d9fa9c1386f5c9c1fe02d6003988a969b4630496da8f064c38d2e257b1debadf5ed7e6839ab78d4f23aa120d3bf1258dcbde8fb40cdc9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3e6967aebe5f2f4d41ba6d81c716f91f

SHA1
07bc1ef0c2ed212a4a91e7bb575aa3bb4038ec21

SHA256
e498aad0050df3684329df9b1241bedf47216fcf410e8be3b64015cd0a9ee8f6

SHA512
9abf7338eb3a033d75017654fdf5aedef55d2f1b4503833dff7043306c08231ee3c6a6c75442a9323efda0af23053e4d616c5bf5b57f1c13f566491427b99865

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
51fb180d6695b936beca2eed634c7038

SHA1
8fb68784222fb888a6f84b5d406c5eccd1ebfbde

SHA256
170c6315ea37812853c952b29d37dfe128e49b07e85ae114422b2a656a6332a2

SHA512
501744661929709d3a755f88956cc2cac96e16c66914437242d1810b47ac381dc79244ff80ab4ac989dd243fe8aa0fe1e36d21c906401966754561f4f9cc4bad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
14cea4ef3922dec41bb16e8c756f1983

SHA1
4e521e423170d2d835ae552694f9552722d7656e

SHA256
1342b3e7e114641af6e762d0b312217fa6afeb8db4a33de0b177aa40ea0ab71e

SHA512
24a9a5ba2d8a52261f8b16128676c4918283f535de942ca8e85dfdaa876e1357613c867c4cd06330f19b9d43a66d8d06c2a2450b2c9edcb1bf1970a5a0a9689f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2855acbbbacaec4e9a79a8f5fae8f06e

SHA1
5212be4a6dd4df569b9b9b28581cf1d39ec727c2

SHA256
aad2ce834cab60ba982ee9229ef937c553b46f9654cde8c6e8427d9333bd973e

SHA512
57f805469c9d3fd4edf4c06725aeedc07ec67bc2bd1f3b4fa59a7fa9226b30fa85e0cc069e7dd3679b448bbd6d09c913b6d69ab68a06c94c4cfb421695c04747

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6c5f2b8362f1b8dedc27064d8b7aa10c

SHA1
f65853eb8994e5dfb1c7d92b5a1754fe7f0cd3db

SHA256
0b424029d06ffb59fd414fd031d9b94c58a8da4c07be18cafb74c8fcd1186aa3

SHA512
57d9da891a9939700f94705d963983547b34ecdf9ef3164763e83b074c1f4bd538f6e4b6b8e48561d110e5776ab204fed02243c9192dd4b7906556fb9a1da40c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
e3c9cb209c03d42a5f66220a5fbb433c

SHA1
4a1351b8b9f253d7da957a849189c8c554ae73ef

SHA256
3086c348299b1cff33b26c7f3b799a6e053163c59cb5b13a1ea4d1784d8ec09f

SHA512
3b4973c0ef6fc9346a6e2280702dbc5043cbac8fb76ec07a7b3a3d538ba796ceb28c4035a4f8e770b168c516456e31b834abb23245278737b3e27b3362b0a782

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
15feaba36808553b9c06932ce7815f03

SHA1
f1616826e85e859834ecdde0f7a3a04ca51aadfd

SHA256
1553c7a0b997d24133e6827a890247097a767583263bad41878e337b96470643

SHA512
e52950be545c466c7342d88a7e9518ff471d8099a622712289dcbefbfbf673d0c334670223b27e5d0213838f1d72218eba05cf310d9e42f244a4979cfd2e121f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
471d8c614f627d4afab221366cee6781

SHA1
14231d6b8f8c2ef64bf4eba1120158c489c11588

SHA256
eee0ee39db5b3da32e05c5a6301f07113efbc1f380b6cc4c16c86064c011a65b

SHA512
b0d00db0be58633ad358655d703966bbde2cfd9005c8dfef17daf71304da7abd6c23d2b821b77124516fc112400c2e2d786d9bf999d889ae44a9bc8bb3dabfe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e167.TMP

Filesize
874B

MD5
60864fa03a86b0a27cd9ad798c4626ac

SHA1
0518241d8dc89a14ec1403a234bdbcc00a18e076

SHA256
7ccd26406f418aeb8cd399b6b33db8fb5b76d0c6a494d9b330338e1186af9279

SHA512
b3d63dba7a1393a1830ec3c427f5a2e9de1bc53212c9cba9695524082ecc4d561b0ca946b2f5833d784354cde9cd81217871c9c11f073ef08f75fa5466b439db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5946b057bd1e815b1254832e3a9e0238

SHA1
26b047bd5e969b2a8a89fd0f3f3c5e184cdfbd4f

SHA256
6274efce8168d5ce01143324b3d6891a36f39820ddff70e4cd0d60cce927f1ae

SHA512
7ccbf3c6007d7714fd8f90281117fa050f111d1044f3606c4231317212c3c6f6a03ae916d2bd2f6649bb800f129c6d164f1eb7b6ffba5b2edd383951e2daab02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6d05de8866aecd37e7d9e863424a9267

SHA1
0e8199ef1a2684f50469c6aa2c51bb26d20fc238

SHA256
51e416ebf10295b0adec1dcdc5635c30b54475ccee352f645b8d4c5dc5f5a0d9

SHA512
6de7eb3116c74d6c704d33b3247940b136bca5f2401ce788516f32005030c6700c2bf1d4a37cf0747e4b8bf924c9167b17bd5fef3ff171d63abd7e27fd84c44e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
9fafdff79db9fab77f47cf91f056bd0f

SHA1
f01cc8ffb257ba20253267f1e4449f964592e7d1

SHA256
007ab69f13d618ffa3bd99389bdb55a32a3468349e99ce85ee8e9db24cc27042

SHA512
1b76d00516e95fc0ab681d8aae108f51ed8d616783e84b29d90f3a05ca140dc3a9c99bdd65a4380f92057244050f910967a8ad7894d99d6363fee5fb994626c3

Download Submit
C:\Users\Admin\Downloads\$uckyLocker.exe:Zone.Identifier

Filesize
241B

MD5
0a94106dade76dae718215a96c28376d

SHA1
5b5bfc14581bdd0092008d89aa03479982a2d04f

SHA256
ad5a54785202391f03273b5dbdc3efcbd43a06c98c69937f59e26e48eddcbd78

SHA512
75408906ee1b223d2dda79841cd26b73a224d45b470129083692f572de3dfcca539f3177f5ef304220d69750ae043b33011a83d158b4dab33f298b29b7dbf871

Download Submit
C:\Users\Admin\Downloads\BossDaMajor.exe:Zone.Identifier

Filesize
273B

MD5
33882215453b7e9085c6b6987bba1e16

SHA1
be43eabe7d9b069e9e3d48999bbd18429c11f1d3

SHA256
447bb0e545b03bf1288f9f5ef118207a91809ea2bd1639d85faa050a4ac3d683

SHA512
b633570c9039e1bc849d626524e313abdda364d8cdd02bd05543c8497ecce7cc9ceea09916e1a85c5444cb43b9d5b8d4fb8a3ce6a61edb894e7bbc0a7f88b15d

Download Submit
C:\Users\Admin\Downloads\LoveYou.exe:Zone.Identifier

Filesize
221B

MD5
af826f376e2abd103c28535d1207173d

SHA1
13eb7be666d8f047494837ee794dc98718365b4c

SHA256
a0b1843e9d31b5aeb5848139477d6897b5ba614998ec30bd49fc482b101be260

SHA512
7ff602b9f060e50c3b0e173284b3580a2fbdd3aae10e53a767275b6d06c76cee5ac9d713c5b9e67966e13b1f3b01f2ac2cd01ae92fae39e8d727c47120be878e

Download Submit
C:\Users\Admin\Downloads\Malum.apk

Filesize
2.8MB

MD5
28ac5460e68eb83737ae2d3cd4f1d49f

SHA1
97fc58ce2d7d952fe512856a0d3f52fa68329a9b

SHA256
b2f3fe699dc862eeb3f471c0ee3075f5edfa7aa9f9eb3815cf34802f24112397

SHA512
1ef7ed4de0157378e07380c6b493da7f53b3b7c5d419fb1d1a60d16a5403cdce38645d22bf0c0d9dc2e2ea2ceee5ccf1b9a8e8e34d88a033fa9ad1ec7a8d73b1

Download Submit
C:\Users\Admin\Downloads\Malum.apk:Zone.Identifier

Filesize
113B

MD5
ea9b49894715de4d30693584f8f39f71

SHA1
85dcca9fd55669fecefe3ea4155a2ff31f020625

SHA256
bcbba818c5e082ec74e5a3da6426255bc2b8ba18dfd9f0299085669d88579646

SHA512
eeda0359780bf8bbe29818434c1995728f05f5ea94f674d0b4c58d5c330ea8daa035f28404f737ccf502a68ce7fbc22001b1c7685dfbc37e9727fddd57ee6cd6

Download Submit
C:\Users\Admin\Downloads\MrsMajor2.0.7z:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 290070.crdownload

Filesize
424KB

MD5
e263c5b306480143855655233f76dc5a

SHA1
e7dcd6c23c72209ee5aa0890372de1ce52045815

SHA256
1f69810b8fe71e30a8738278adf09dd982f7de0ab9891d296ce7ea61b3fa4f69

SHA512
e95981eae02d0a8bf44493c64cca8b7e50023332e91d75164735a1d0e38138f358100c93633ff3a0652e1c12a5155cba77d81e01027422d7d5f71000eafb4113

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 298250.crdownload

Filesize
2.6MB

MD5
6b3b44639456a3230e3838d0d2202939

SHA1
6aa554f51497c21d684d80fdf363e23b8f1f28f2

SHA256
eedb91d5c57418231eaf086f3739353392fa83267075bc50de2cabd11db66c1f

SHA512
fab38b9b7d587aed6f2ab267cf9afa878213832b86cc00519e0cf5880072aa95516796131afe87d641fe113f2041eef52988845df15b716330de0080bf5ccfea

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 340533.crdownload

Filesize
1.9MB

MD5
38ff71c1dee2a9add67f1edb1a30ff8c

SHA1
10f0defd98d4e5096fbeb321b28d6559e44d66db

SHA256
730a41a7656f606a22e9f0d68782612d6e00ab8cfe1260160b9e0b00bc2e442a

SHA512
8347782951f2647fe433482cb13186653afa32ee9f5be83a138c4ed47ff34d8de66a26e74b5a28ea21c1529b2078401922a9a26803772677b70489967c10f3e9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 411517.crdownload

Filesize
760KB

MD5
515198a8dfa7825f746d5921a4bc4db9

SHA1
e1da0b7f046886c1c4ff6993f7f98ee9a1bc90ae

SHA256
0fda176b199295f72fafc3bc25cefa27fa44ed7712c3a24ca2409217e430436d

SHA512
9e47037fe40b79ebf056a9c6279e318d85da9cd7e633230129d77a1b8637ecbafc60be38dd21ca9077ebfcb9260d87ff7fcc85b8699b3135148fe956972de3e8

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 670844.crdownload

Filesize
22KB

MD5
31420227141ade98a5a5228bf8e6a97d

SHA1
19329845635ebbc5c4026e111650d3ef42ab05ac

SHA256
1edc8771e2a1a70023fc9ddeb5a6bc950380224b75e8306eb70da8eb80cb5b71

SHA512
cbb18a6667b377eb68395cfd8df52b7d93c4554c3b5ab32c70e73b86e3dedb7949122fe8eea9530cd53944b45a1b699380bf1e9e5254af04d8409c594a52c0e7

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 702497.crdownload

Filesize
22.4MB

MD5
81041a562190fe49c0fac248638b2d04

SHA1
755d8426f18e3f0ad8e28d4655468d8cfdac67bf

SHA256
0d64e4fe519291c901b67944d9215f6254552c7ea5d12cc4fc930ab58c7ca268

SHA512
e482702b08e401de88c67a703cb1612831f0cbc9365eb2e634602712bed6ad6cfae30dd820d96001c49100420bc457af083e7c09d79d825e87fe231cc0646eb2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 870869.crdownload

Filesize
414KB

MD5
c850f942ccf6e45230169cc4bd9eb5c8

SHA1
51c647e2b150e781bd1910cac4061a2cee1daf89

SHA256
86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f

SHA512
2b3890241b8c8690aab0aed347daa778aba20f29f76e8b79b02953b6252324317520b91ea60d3ef73e42ad403f7a6e0e3f2a057799f21ed447dae7096b2f47d9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 904460.crdownload

Filesize
396KB

MD5
13f4b868603cf0dd6c32702d1bd858c9

SHA1
a595ab75e134f5616679be5f11deefdfaae1de15

SHA256
cae57a60c4d269cd1ca43ef143aedb8bfc4c09a7e4a689544883d05ce89406e7

SHA512
e0d7a81c9cdd15a4ef7c8a9492fffb2c520b28cebc54a139e1bffa5c523cf17dfb9ffe57188cf8843d74479df402306f4f0ce9fc09d87c7cca92aea287e5ff24

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 915308.crdownload

Filesize
129KB

MD5
0ec108e32c12ca7648254cf9718ad8d5

SHA1
78e07f54eeb6af5191c744ebb8da83dad895eca1

SHA256
48b08ea78124ca010784d9f0faae751fc4a0c72c0e7149ded81fc03819f5d723

SHA512
1129e685f5dd0cb2fa22ef4fe5da3f1e2632e890333ce17d3d06d04a4097b4d9f4ca7d242611ffc9e26079900945cf04ab6565a1c322e88e161f1929d18a2072

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 915308.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\WindowsUpdate.exe:Zone.Identifier

Filesize
229B

MD5
512b31afdd16c6d01b763a287b6c30aa

SHA1
f00c56a0285ad7ea8d5ab0ab7866d496df595e59

SHA256
d91d11542ca1d794a3ea08ef878e2604ea010890533ebeaf16b0a8773d32c824

SHA512
1a9422f8c15536fd5eaffeb2cc7769c0f0cfeb90faa6013d5249d52311839abe9db250d6ec855ac92977f55224f3e0a60e735d499c11e4a0a556de0c60ad70d9

Download Submit
C:\Users\Admin\Downloads\YouAreAnIdiot.exe:Zone.Identifier

Filesize
279B

MD5
bcb9707609402e88d489700b2c4423bb

SHA1
2802c23988f9265ca8c7e006f4146ee2e7f41852

SHA256
76ae0452592aaa11423e45674fb6259abde8e126993fc791ed988b8fc222b7ae

SHA512
7f951e192e940b5de9faa0d4bc95cfdd0860ffb9e8a342e2235d6f38badc72c2993aa266f6146f998bd3d1b87b43d921be905cce7c5614886c0ab9e6df4791ab

Download Submit
C:\Users\Admin\Downloads\metrofax.doc

Filesize
221KB

MD5
28e855032f83adbd2d8499af6d2d0e22

SHA1
6b590325e2e465d9762fa5d1877846667268558a

SHA256
b13b29772c29ccb412d6ab360ff38525836fcf0f65be637a7945a83a446dfd5e

SHA512
e401cbd41e044ff7d557f57960d50fb821244eaa97ce1218191d58e0935f6c069e6a0ff4788ed91ead279f36ba4eddfaa08dc3de01082c41dc9c2fc3c4b0ae34

Download Submit
C:\Users\Admin\Downloads\metrofax.doc:Zone.Identifier

Filesize
219B

MD5
e5f24e4738ab56b63e37d60740713730

SHA1
f6ccec09677e30380a8b805219d119269658989a

SHA256
9fd284bf8af89c4675649c6fec85efa8335f77419a93f58700f44caf9090eae3

SHA512
b4f25c52b67b8747c7091d7c45bf89fc75fcfc61746b9e5045b0cf2087aeb7c027e3fe754e28349de0edf61321f9e2f8ccc0bc4fba5f992186c2ea99f05e680f

Download Submit