cryptolocker | hxxps://cdn[.]discordapp[.]com/attachments/1266564505010180179/1296634790530912276/Release[.]7z?ex=67349f00&is=67334d80&hm=6fffd7746d21e386e608de784617c873e5fc96b77a6ef34b2780e36969886a11&

Analysis

max time kernel
1566s
max time network
1568s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
12-11-2024 17:16

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1266564505010180179/1296634790530912276/Release.7z?ex=67349f00&is=67334d80&hm=6fffd7746d21e386e608de784617c873e5fc96b77a6ef34b2780e36969886a11&

Score

10^/10

cryptolocker lumma wannacry defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware spyware stealer trojan upx worm

Malware Config

Extracted

Family

lumma

https://delaylacedmn.site

https://writekdmsnu.site

https://agentyanlark.site

https://bellykmrebk.site

https://underlinemdsj.site

https://commandejorsk.site

https://possiwreeste.site

https://famikyjdiag.site

https://termyfencdw.site

Extracted

Path

C:\Users\Admin\Downloads\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

CryptoLocker
Ransomware family with multiple variants.
ransomware cryptolocker
Cryptolocker family
cryptolocker
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

Annabelle.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\Downloads\\Annabelle.exe"	Annabelle.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

Annabelle.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Annabelle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	Annabelle.exe

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

Annabelle.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Annabelle.exe
Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Mint.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Mint.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Annabelle.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Mint.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

MSAGENT.EXEtv_enua.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components	MSAGENT.EXE
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components	tv_enua.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
5616	powershell.exe
2096	powershell.exe
4756	powershell.exe
1760	powershell.exe
2216	powershell.exe
4956	powershell.exe
5172	powershell.exe
5480	powershell.exe

Disables RegEdit via registry modification 2 IoCs

evasion

Processes:

Annabelle.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Annabelle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Annabelle.exe

Disables Task Manager via registry modification
evasion
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490
Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

Annabelle.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpg4dmod.dll\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shellstyle.dll\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cabinet.dll	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secpol.msc	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\url.dll	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmplayer.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\url.dll\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydocs.dll	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\usbui.dll	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dllhost.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cabinet.dll\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemexplorer.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webcheck.dll\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chkdsk.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DBGHELP.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rasman.dll	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DBGHELP.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DCIMAN32.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rasman.dll\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shellstyle.dll	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chkdsk.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DCIMAN32.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secpol.msc\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemexplorer.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\usbui.dll\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\Debugger = "RIP"	Annabelle.exe

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

NetSh.exe

pid process

1500 NetSh.exe
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

pid	process
1500	NetSh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Mint.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Mint.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Mint.exe

Drops startup file 2 IoCs

Processes:

WannaCry.EXE

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD686E.tmp	WannaCry.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD6858.tmp	WannaCry.EXE

Executes dropped EXE 64 IoCs

Processes:

Mint.exeSynapse X.execonhost_syn.exeSynapse X.exeSynapse X.execonhost_syn.exeSynapse X.exeWave (1).exeWave (1).exeWave (1).exeWave (1).exeWannaCry.EXEtaskdl.exe@[email protected]@[email protected]taskhsvc.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exeMSAGENT.EXEtv_enua.exeAgentSvr.exetaskse.exe@[email protected]taskdl.exe@[email protected]taskse.exetaskdl.exeBonziBDY_4.EXEAgentSvr.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exeBonziBUDDY_Killer.exeBonziBUDDY_Killer.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]

pid	process
2604	Mint.exe
6072	Synapse X.exe
4748	conhost_syn.exe
5320	Synapse X.exe
2344	Synapse X.exe
4476	conhost_syn.exe
2604	Synapse X.exe
5808	Wave (1).exe
5736	Wave (1).exe
3160	Wave (1).exe
5040	Wave (1).exe
6016	WannaCry.EXE
6048	taskdl.exe
4740	@[email protected]
1532	@[email protected]
5044	taskhsvc.exe
2640	taskse.exe
4888	@[email protected]
5240	taskdl.exe
440	taskse.exe
5980	@[email protected]
4196	taskdl.exe
2776	taskse.exe
908	@[email protected]
4444	taskdl.exe
3844	taskse.exe
4172	@[email protected]
5392	taskdl.exe
5740	taskse.exe
4352	@[email protected]
5900	taskdl.exe
5552	taskse.exe
2864	@[email protected]
5312	taskdl.exe
5272	MSAGENT.EXE
1916	tv_enua.exe
6520	AgentSvr.exe
6636	taskse.exe
6644	@[email protected]
6668	taskdl.exe
6796	@[email protected]
6864	taskse.exe
7088	taskdl.exe
7112	BonziBDY_4.EXE
7140	AgentSvr.exe
2088	taskse.exe
6076	@[email protected]
4484	taskdl.exe
6564	taskse.exe
4344	@[email protected]
6640	taskdl.exe
6820	taskse.exe
6832	@[email protected]
1756	taskdl.exe
3872	BonziBUDDY_Killer.exe
6552	BonziBUDDY_Killer.exe
6952	taskse.exe
6964	@[email protected]
912	taskdl.exe
4196	taskse.exe
6600	@[email protected]
5392	taskdl.exe
6740	taskse.exe
3764	@[email protected]

Impair Defenses: Safe Mode Boot 1 TTPs 1 IoCs
defense_evasion

Safe Mode Boot
T1562.009

Processes:

Annabelle.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MinimalX = "1" Annabelle.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MinimalX = "1"	Annabelle.exe

Loads dropped DLL 64 IoCs

Processes:

Mint.exerundll32.exerundll32.exeWave (1).exeWave (1).exetaskhsvc.exeBonziBuddy432.exeMSAGENT.EXEregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exe

pid	process
2604	Mint.exe
2604	Mint.exe
2604	Mint.exe
2604	Mint.exe
4412	rundll32.exe
3352	rundll32.exe
5736	Wave (1).exe
5736	Wave (1).exe
5736	Wave (1).exe
5736	Wave (1).exe
5736	Wave (1).exe
5736	Wave (1).exe
5736	Wave (1).exe
5736	Wave (1).exe
5736	Wave (1).exe
5736	Wave (1).exe
5736	Wave (1).exe
5736	Wave (1).exe
5736	Wave (1).exe
5736	Wave (1).exe
5736	Wave (1).exe
5736	Wave (1).exe
5736	Wave (1).exe
5040	Wave (1).exe
5040	Wave (1).exe
5040	Wave (1).exe
5040	Wave (1).exe
5040	Wave (1).exe
5040	Wave (1).exe
5040	Wave (1).exe
5040	Wave (1).exe
5040	Wave (1).exe
5040	Wave (1).exe
5040	Wave (1).exe
5040	Wave (1).exe
5040	Wave (1).exe
5040	Wave (1).exe
5040	Wave (1).exe
5040	Wave (1).exe
5044	taskhsvc.exe
5044	taskhsvc.exe
5044	taskhsvc.exe
5044	taskhsvc.exe
5044	taskhsvc.exe
5044	taskhsvc.exe
5044	taskhsvc.exe
5344	BonziBuddy432.exe
5344	BonziBuddy432.exe
5344	BonziBuddy432.exe
5344	BonziBuddy432.exe
5344	BonziBuddy432.exe
5344	BonziBuddy432.exe
5344	BonziBuddy432.exe
5344	BonziBuddy432.exe
5344	BonziBuddy432.exe
5344	BonziBuddy432.exe
5344	BonziBuddy432.exe
5272	MSAGENT.EXE
6372	regsvr32.exe
6388	regsvr32.exe
6432	regsvr32.exe
6452	regsvr32.exe
6468	regsvr32.exe
6484	regsvr32.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

5984 icacls.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

pid	process
5984	icacls.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Annabelle.exe{34184A33-0407-212E-3320-09040709E2C2}.exereg.exetv_enua.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Software\Microsoft\Windows\CurrentVersion\Run\UpdateBackup = "C:\\Users\\Admin\\Downloads\\Annabelle.exe"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateBackup = "C:\\Users\\Admin\\Downloads\\Annabelle.exe"	Annabelle.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Software\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\{34184A33-0407-212E-3320-09040709E2C2}.exe"	{34184A33-0407-212E-3320-09040709E2C2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qhvfvgsevfiqy755 = "\"C:\\Users\\Admin\\Downloads\\tasksche.exe\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tv_enua = "RunDll32 advpack.dll,LaunchINFSection C:\\Windows\\INF\\tv_enua.inf, RemoveCabinet"	tv_enua.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateBackup = "C:\\Users\\Admin\\Downloads\\Annabelle.exe"	Annabelle.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Mint.exeAnnabelle.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Mint.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Annabelle.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

Processes:

flow	ioc
509	raw.githubusercontent.com
511	raw.githubusercontent.com
560	camo.githubusercontent.com
569	pastebin.com
142	sites.google.com
143	sites.google.com
144	sites.google.com
376	pastebin.com
390	pastebin.com
393	pastebin.com
572	pastebin.com

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

517 ip-api.com
564 ip-api.com

flow	ioc
517	ip-api.com
564	ip-api.com

Power Settings 1 TTPs 10 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

Processes:

cmd.exepowercfg.execmd.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid	process
5176	cmd.exe
1072	powercfg.exe
4748	cmd.exe
5536	powercfg.exe
3460	powercfg.exe
1876	powercfg.exe
1748	powercfg.exe
5340	powercfg.exe
2432	powercfg.exe
1556	powercfg.exe

Drops file in System32 directory 3 IoCs

Processes:

tv_enua.exe

description	ioc	process
File created	C:\Windows\SysWOW64\SET62DE.tmp	tv_enua.exe
File opened for modification	C:\Windows\SysWOW64\msvcp50.dll	tv_enua.exe
File opened for modification	C:\Windows\SysWOW64\SET62DE.tmp	tv_enua.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

3260 tasklist.exe
5852 tasklist.exe

pid	process
3260	tasklist.exe
5852	tasklist.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

WannaCry.EXE@[email protected]

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	WannaCry.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

Mint.exeSynapse X.exeSynapse X.exe

pid process

2604 Mint.exe
6072 Synapse X.exe
6072 Synapse X.exe
2344 Synapse X.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4412 set thread context of 2796	4412	rundll32.exe	aspnet_regiis.exe
PID 3352 set thread context of 3764	3352	rundll32.exe	aspnet_regiis.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/5736-4573-0x00007FF982EE0000-0x00007FF98334E000-memory.dmp	upx
behavioral1/memory/5736-4574-0x00007FF99C330000-0x00007FF99C354000-memory.dmp	upx
behavioral1/memory/5736-4575-0x00007FF9A1770000-0x00007FF9A177F000-memory.dmp	upx
behavioral1/memory/5736-4580-0x00007FF99C2C0000-0x00007FF99C2ED000-memory.dmp	upx
behavioral1/memory/5736-4581-0x00007FF99AFA0000-0x00007FF99AFB9000-memory.dmp	upx
behavioral1/memory/5736-4582-0x00007FF99AF80000-0x00007FF99AF9F000-memory.dmp	upx
behavioral1/memory/5736-4583-0x00007FF992C60000-0x00007FF992DD1000-memory.dmp	upx
behavioral1/memory/5736-4584-0x00007FF99AF60000-0x00007FF99AF79000-memory.dmp	upx
behavioral1/memory/5736-4585-0x00007FF9A0DE0000-0x00007FF9A0DED000-memory.dmp	upx
behavioral1/memory/5736-4586-0x00007FF997C60000-0x00007FF997C8E000-memory.dmp	upx
behavioral1/memory/5736-4591-0x00007FF99C330000-0x00007FF99C354000-memory.dmp	upx
behavioral1/memory/5736-4590-0x00007FF982B60000-0x00007FF982ED5000-memory.dmp	upx
behavioral1/memory/5736-4588-0x00007FF992EF0000-0x00007FF992FA8000-memory.dmp	upx
behavioral1/memory/5736-4587-0x00007FF982EE0000-0x00007FF98334E000-memory.dmp	upx
behavioral1/memory/5736-4603-0x00007FF99C2C0000-0x00007FF99C2ED000-memory.dmp	upx
behavioral1/memory/5736-4606-0x00007FF984520000-0x00007FF984638000-memory.dmp	upx
behavioral1/memory/5736-4605-0x00007FF99AF80000-0x00007FF99AF9F000-memory.dmp	upx
behavioral1/memory/5736-4604-0x00007FF99AFA0000-0x00007FF99AFB9000-memory.dmp	upx
behavioral1/memory/5736-4602-0x00007FF99FF40000-0x00007FF99FF4D000-memory.dmp	upx
behavioral1/memory/5736-4601-0x00007FF9974C0000-0x00007FF9974D4000-memory.dmp	upx
behavioral1/memory/5736-4624-0x00007FF982EE0000-0x00007FF98334E000-memory.dmp	upx
behavioral1/memory/5736-4648-0x00007FF992EF0000-0x00007FF992FA8000-memory.dmp	upx
behavioral1/memory/5736-4647-0x00007FF997C60000-0x00007FF997C8E000-memory.dmp	upx
behavioral1/memory/5736-4646-0x00007FF9A0DE0000-0x00007FF9A0DED000-memory.dmp	upx
behavioral1/memory/5736-4645-0x00007FF99AF60000-0x00007FF99AF79000-memory.dmp	upx
behavioral1/memory/5736-4644-0x00007FF992C60000-0x00007FF992DD1000-memory.dmp	upx
behavioral1/memory/5736-4643-0x00007FF99AFA0000-0x00007FF99AFB9000-memory.dmp	upx
behavioral1/memory/5736-4642-0x00007FF99C2C0000-0x00007FF99C2ED000-memory.dmp	upx
behavioral1/memory/5736-4641-0x00007FF9A1770000-0x00007FF9A177F000-memory.dmp	upx
behavioral1/memory/5736-4640-0x00007FF99C330000-0x00007FF99C354000-memory.dmp	upx
behavioral1/memory/5736-4639-0x00007FF982B60000-0x00007FF982ED5000-memory.dmp	upx
behavioral1/memory/5736-4638-0x00007FF984520000-0x00007FF984638000-memory.dmp	upx
behavioral1/memory/5736-4637-0x00007FF99FF40000-0x00007FF99FF4D000-memory.dmp	upx
behavioral1/memory/5736-4629-0x00007FF99AF80000-0x00007FF99AF9F000-memory.dmp	upx
behavioral1/memory/5736-4636-0x00007FF9974C0000-0x00007FF9974D4000-memory.dmp	upx
behavioral1/memory/5040-4681-0x00007FF982EE0000-0x00007FF98334E000-memory.dmp	upx
behavioral1/memory/5040-4682-0x00007FF9A0DE0000-0x00007FF9A0DEF000-memory.dmp	upx
behavioral1/memory/5040-4687-0x00007FF99C2C0000-0x00007FF99C2ED000-memory.dmp	upx
behavioral1/memory/5040-4688-0x00007FF99AFA0000-0x00007FF99AFB9000-memory.dmp	upx
behavioral1/memory/5040-4689-0x00007FF992C60000-0x00007FF992DD1000-memory.dmp	upx
behavioral1/memory/5040-4690-0x00007FF99AF60000-0x00007FF99AF79000-memory.dmp	upx
behavioral1/memory/5040-4691-0x00007FF99FF40000-0x00007FF99FF4D000-memory.dmp	upx
behavioral1/memory/5040-4692-0x00007FF982EE0000-0x00007FF98334E000-memory.dmp	upx
behavioral1/memory/5040-4693-0x00007FF982B60000-0x00007FF982ED5000-memory.dmp	upx
behavioral1/memory/5040-4694-0x00007FF99C330000-0x00007FF99C354000-memory.dmp	upx
behavioral1/memory/5040-4695-0x00007FF9974C0000-0x00007FF9974D4000-memory.dmp	upx
behavioral1/memory/5040-4696-0x00007FF99E020000-0x00007FF99E02D000-memory.dmp	upx
behavioral1/memory/5040-4697-0x00007FF99AFA0000-0x00007FF99AFB9000-memory.dmp	upx
behavioral1/memory/5040-4698-0x00007FF984520000-0x00007FF984638000-memory.dmp	upx
behavioral1/memory/5040-4730-0x00007FF984520000-0x00007FF984638000-memory.dmp	upx
behavioral1/memory/5040-4741-0x00007FF982B60000-0x00007FF982ED5000-memory.dmp	upx
behavioral1/memory/5040-4740-0x00007FF997C60000-0x00007FF997C8E000-memory.dmp	upx
behavioral1/memory/5040-4739-0x00007FF99FF40000-0x00007FF99FF4D000-memory.dmp	upx
behavioral1/memory/5040-4738-0x00007FF99AF60000-0x00007FF99AF79000-memory.dmp	upx
behavioral1/memory/5040-4737-0x00007FF992C60000-0x00007FF992DD1000-memory.dmp	upx
behavioral1/memory/5040-4736-0x00007FF99AF80000-0x00007FF99AF9F000-memory.dmp	upx
behavioral1/memory/5040-4735-0x00007FF99AFA0000-0x00007FF99AFB9000-memory.dmp	upx
behavioral1/memory/5040-4734-0x00007FF99C2C0000-0x00007FF99C2ED000-memory.dmp	upx
behavioral1/memory/5040-4733-0x00007FF9A0DE0000-0x00007FF9A0DEF000-memory.dmp	upx
behavioral1/memory/5040-4732-0x00007FF99C330000-0x00007FF99C354000-memory.dmp	upx
behavioral1/memory/5040-4731-0x00007FF992EF0000-0x00007FF992FA8000-memory.dmp	upx
behavioral1/memory/5040-4729-0x00007FF99E020000-0x00007FF99E02D000-memory.dmp	upx
behavioral1/memory/5040-4728-0x00007FF9974C0000-0x00007FF9974D4000-memory.dmp	upx
behavioral1/memory/5040-4716-0x00007FF982EE0000-0x00007FF98334E000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

BonziBuddy432.exeBonziBDY_4.EXE

description	ioc	process
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page11.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page3.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page3.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Intro2.wav	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page1.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page12.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page2.jpg	BonziBuddy432.exe
File created	C:\Program Files (x86)\BonziBuddy432\T001.nbd-SR	BonziBDY_4.EXE
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\sp004.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Uninstall.exe	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page0.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\p001.nbd	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page4.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\book	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page16.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page0.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\sp006.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\empop3.dll	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\t3.nbd-SR	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page8.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb008.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb006.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page9.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page14.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\sp001.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page6.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page16.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\BonziBDY.vbw	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\emsmtp.dll	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\t2.nbd	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Options\uninstall.bat	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb007.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Options\test.vbs	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb003.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page5.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\j2.nbd	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\msvcrt.dll	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\SSubTmr6.dll	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\t3.nbd	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Options\BonziBuddy.bat	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\ssa3d30.ocx	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\MSAGENTS\Peedy.acs	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page7.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\ActiveSkin.ocx	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\BonziBDY_2.EXE	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\BonziCTB.dll	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Bonzi's Solitaire.exe	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\j3.nbd	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page6.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\sp007.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\MSWINSCK.OCX	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\SSCALB32.OCX	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\book	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page1.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\s1.nbd	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page15.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\sp001.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page9.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb012.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page8.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\book	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Jigsaw.exe	BonziBuddy432.exe

Drops file in Windows directory 57 IoCs

Processes:

MSAGENT.EXEtv_enua.exeBonziBuddy432.exeluajit.exe

description	ioc	process
File created	C:\Windows\msagent\intl\SET518E.tmp	MSAGENT.EXE
File created	C:\Windows\lhsp\help\SET62DB.tmp	tv_enua.exe
File created	C:\Windows\INF\SET62DD.tmp	tv_enua.exe
File opened for modification	C:\Windows\INF\tv_enua.inf	tv_enua.exe
File opened for modification	C:\Windows\msagent\chars\Bonzi.acs	BonziBuddy432.exe
File opened for modification	C:\Windows\msagent\SET5126.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SET5126.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET513B.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgtCtl15.tlb	MSAGENT.EXE
File opened for modification	C:\Windows\fonts\SET62DC.tmp	tv_enua.exe
File opened for modification	C:\Windows\fonts\andmoipa.ttf	tv_enua.exe
File created	C:\Windows\Setup\Scripts\ErrorHandler.cmd	luajit.exe
File opened for modification	C:\Windows\msagent\chars\Peedy.acs	BonziBuddy432.exe
File created	C:\Windows\msagent\SET5127.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET5129.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET512A.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\lhsp\tv\tvenuax.dll	tv_enua.exe
File opened for modification	C:\Windows\msagent\AgentDPv.dll	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\mslwvtts.dll	MSAGENT.EXE
File created	C:\Windows\msagent\SET519F.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\lhsp\tv\SET62DA.tmp	tv_enua.exe
File created	C:\Windows\msagent\SET513E.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\help\SET513F.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\lhsp\tv\tv_enua.dll	tv_enua.exe
File opened for modification	C:\Windows\msagent\AgentAnm.dll	MSAGENT.EXE
File created	C:\Windows\msagent\SET513B.tmp	MSAGENT.EXE
File created	C:\Windows\help\SET513F.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\INF\SET62DD.tmp	tv_enua.exe
File opened for modification	C:\Windows\msagent\SET512B.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SET5128.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentMPx.dll	MSAGENT.EXE
File created	C:\Windows\msagent\SET512B.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentSR.dll	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET519F.tmp	MSAGENT.EXE
File created	C:\Windows\lhsp\tv\SET62D9.tmp	tv_enua.exe
File created	C:\Windows\msagent\SET512A.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET513C.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\INF\SET513D.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\intl\Agt0409.dll	MSAGENT.EXE
File opened for modification	C:\Windows\lhsp\tv\SET62D9.tmp	tv_enua.exe
File opened for modification	C:\Windows\msagent\AgentDp2.dll	MSAGENT.EXE
File created	C:\Windows\lhsp\tv\SET62DA.tmp	tv_enua.exe
File opened for modification	C:\Windows\lhsp\help\SET62DB.tmp	tv_enua.exe
File created	C:\Windows\msagent\SET513C.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\lhsp\help\tv_enua.hlp	tv_enua.exe
File opened for modification	C:\Windows\msagent\SET5128.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET513E.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\help\Agt0409.hlp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\intl\SET518E.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentCtl.dll	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET5127.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentSvr.exe	MSAGENT.EXE
File opened for modification	C:\Windows\INF\agtinst.inf	MSAGENT.EXE
File created	C:\Windows\INF\SET513D.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SET5129.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentPsh.dll	MSAGENT.EXE
File created	C:\Windows\fonts\SET62DC.tmp	tv_enua.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

5560 sc.exe
5320 sc.exe
2864 sc.exe
6128 sc.exe
1632 sc.exe
1612 sc.exe
6056 sc.exe
2140 sc.exe
6060 sc.exe
1292 sc.exe

pid	process
5560	sc.exe
5320	sc.exe
2864	sc.exe
6128	sc.exe
1632	sc.exe
1612	sc.exe
6056	sc.exe
2140	sc.exe
6060	sc.exe
1292	sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 5 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

Processes:

msedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Solaris.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Annabelle.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Wave (1).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WannaCry.EXE:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\Release\libcrypto-3-x64.dll	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

NetSh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

5124 5320 WerFault.exe Synapse X.exe
5676 2604 WerFault.exe Synapse X.exe

pid	pid_target	process	target process
5124	5320	WerFault.exe	Synapse X.exe
5676	2604	WerFault.exe	Synapse X.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exeregsvr32.exe@[email protected]taskse.exeSetup.exeattrib.exeicacls.exetaskdl.exeattrib.exetaskse.exe@[email protected]taskdl.exe@[email protected]WMIC.exetaskse.exe@[email protected]@[email protected]taskse.exeBonziBUDDY_Killer.exeluajit.exetaskse.exegrpconv.exetaskdl.exetaskdl.exeschtasks.exeWannaCry.EXEcmd.exeMSAGENT.EXE@[email protected]taskdl.exetaskse.exe@[email protected]{34184A33-0407-212E-3320-09040709E2C2}.exeregsvr32.exeluajit.exe@[email protected]BonziBUDDY_Killer.exetaskdl.exe@[email protected]taskse.exetaskse.exetaskse.exetaskse.exelua.exeSynapse X.exe@[email protected]@[email protected]CryptoLocker.exetaskdl.exe@[email protected]taskse.exe{34184A33-0407-212E-3320-09040709E2C2}.exetaskhsvc.exeregsvr32.exeregsvr32.exeSynapse X.exeSynapse X.exetaskse.exetaskdl.exetaskse.exetaskdl.exetaskse.execmd.exeregsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BonziBUDDY_Killer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	luajit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSAGENT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	luajit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BonziBUDDY_Killer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lua.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synapse X.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synapse X.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synapse X.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exevssadmin.exevssadmin.exe

pid process

6808 vssadmin.exe
908 vssadmin.exe
7164 vssadmin.exe

pid	process
6808	vssadmin.exe
908	vssadmin.exe
7164	vssadmin.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "209"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Modifies registry class 64 IoCs

Processes:

BonziBuddy432.exeAgentSvr.exeregsvr32.exeBonziBDY_4.EXEregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35053A20-8589-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7B93C8D-7B81-11D0-AC5F-00C04FD97575}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{972DE6C1-8B09-11D2-B652-A1FD6CC34260}\TypeLib	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B7-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid32	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\InprocServer32\ThreadingModel = "Apartment"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1EFB6594-857C-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C247F22-8591-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Agent.Control.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7B93C91-7B81-11D0-AC5F-00C04FD97575}\ProxyStubClsid32	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F581B2D6-E4C3-40BF-8A1E-F68CDFD8FEEC}\TypeLib	BonziBDY_4.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ActiveSkin.ComMorph\CLSID	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\Control	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A45DB4E-BD0D-11D2-8D14-00104B9E072A}	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5BE8BE3-7DE6-11D0-91FE-00C04FD701A5}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D0ECB27-9968-11D0-AC6E-00C04FD97575}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6594-857C-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D0ECB23-9968-11D0-AC6E-00C04FD97575}\TypeLib	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F4900F5D-055F-11D4-8F9B-00104BA312D6}\1.4\FLAGS\ = "0"	BonziBDY_4.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\ProgID	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E3867A1-8586-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TabStrip.2\CLSID	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.SBarCtrl\CurVer	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{065E6FE4-1BF9-11D2-BAE8-00104B9E0792}\ProxyStubClsid32	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E91E27A1-C5AE-11D2-8D1B-00104B9E072A}\ = "ISSTabPanelControl"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Slider\ = "Microsoft Slider Control, version 6.0"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35053A20-8589-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C247F24-8591-11D1-B16A-00C0F0283628}\ProxyStubClsid32	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A45DB4B-BD0D-11D2-8D14-00104B9E072A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A7B93C87-7B81-11D0-AC5F-00C04FD97575}\ProxyStubClsid32	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6595-857C-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F049-858B-11D1-B16A-00C0F0283628}\ = "IListView"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\ = "0"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{065E6FD6-1BF9-11D2-BAE8-00104B9E0792}\TypeLib	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{065E6FE4-1BF9-11D2-BAE8-00104B9E0792}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4BAC124B-78C8-11D1-B9A8-00C04FD97575}\InprocServer32\ = "C:\\Windows\\msagent\\AgentMPx.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B4-8589-11D1-B16A-00C0F0283628}\ = "ITreeView"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B976285-3692-11D0-9B8A-0000C0F04C96}\ = "ISSDataObjectFiles"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0A45DB48-BD0D-11D2-8D14-00104B9E072A}\2.0\HELPDIR	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BDF-7DE6-11D0-91FE-00C04FD701A5}\TypeLib\ = "{F5BE8BC2-7DE6-11D0-91FE-00C04FD701A5}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Agent.Server.2	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53FA8D42-2CDD-11D3-9DD0-D3CD4078982A}\TypeLib\ = "{972DE6B5-8B09-11D2-B652-A1FD6CC34260}"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F04A-858B-11D1-B16A-00C0F0283628}\ = "ListViewEvents"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FE6-1BF9-11D2-BAE8-00104B9E0792}\InprocServer32\ThreadingModel = "Apartment"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7B93C91-7B81-11D0-AC5F-00C04FD97575}\TypeLib	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83C2D7A1-0DE6-11D3-9DCF-9423F1B2561C}\ProgID\ = "ActiveSkin.ComMoveSize.1"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE33-8596-11D1-B16A-00C0F0283628}\InprocServer32	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5BE8BE8-7DE6-11D0-91FE-00C04FD701A5}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8563FF20-8ECC-11D1-B9B4-00C04FD97575}\ = "IAgentCtlEx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7B93C92-7B81-11D0-AC5F-00C04FD97575}	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{22DF5084-12BC-4C98-8044-4FAD06F4119A}\TypeLib\Version = "1.4"	BonziBDY_4.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF1B5D50-3C5C-48CE-B991-0E86D26F6F5E}\InprocServer32\ = "C:\\PROGRA~2\\BONZIB~1\\ACTIVE~1.OCX"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53FA8D40-2CDD-11D3-9DD0-D3CD4078982A}\TypeLib\ = "{972DE6B5-8B09-11D2-B652-A1FD6CC34260}"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FE3-1BF9-11D2-BAE8-00104B9E0792}\VersionIndependentProgID\ = "Threed.SSCheck"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FE3-1BF9-11D2-BAE8-00104B9E0792}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FE6-1BF9-11D2-BAE8-00104B9E0792}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04E-858B-11D1-B16A-00C0F0283628}	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A45DB49-BD0D-11D2-8D14-00104B9E072A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D7A6D440-8872-11D1-9EC6-00C04FD7081F}\TypeLib\ = "{A7B93C73-7B81-11D0-AC5F-00C04FD97575}"	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ListViewCtrl\CLSID\ = "{BDD1F04B-858B-11D1-B16A-00C0F0283628}"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Threed.SSOption\CLSID\ = "{065E6FDF-1BF9-11D2-BAE8-00104B9E0792}"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{065E6FDB-1BF9-11D2-BAE8-00104B9E0792}	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{065E6FDB-1BF9-11D2-BAE8-00104B9E0792}\ = "DSSPanelEvents"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EF6BEC0-E669-11CD-836C-0000C0C14E92}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{065E6FDB-1BF9-11D2-BAE8-00104B9E0792}\ProxyStubClsid32	BonziBuddy432.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

4952 reg.exe

pid	process
4952	reg.exe

NTFS ADS 26 IoCs

Processes:

luajit.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exeCryptoLocker.exemsedge.exe

description	ioc	process
File created	C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\ODAy.exe\:Zone.Identifier:$DATA	luajit.exe
File opened for modification	C:\Users\Admin\Downloads\WannaCry.EXE:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 662388.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Wave (1).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 817737.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Bonzi.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Executor.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Roblox.Electron.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Synapse X Crаcked v3 [new update].rar:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\SynX Key.rar:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 901701.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Annabelle.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier	msedge.exe
File created	C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\conf\:Zone.Identifier:$DATA	luajit.exe
File opened for modification	C:\Users\Admin\Downloads\7z2401.msi:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Release.7z:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Electron.rar:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 631360.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Krampus.zip:Zone.Identifier	msedge.exe
File created	C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\lua51.dll\:Zone.Identifier:$DATA	luajit.exe
File created	C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe\:SmartScreen:$DATA	CryptoLocker.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 981451.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 886677.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 417578.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Solaris.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 925392.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4712 NOTEPAD.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

5552 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

6540 vlc.exe

pid	process
4712	NOTEPAD.EXE

pid	process
5552	schtasks.exe

pid	process
6540	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exepowershell.exepowershell.exepowershell.exemsedge.exepowershell.exepowershell.exepowershell.exemsedge.exepowershell.exepowershell.exepowershell.exepowershell.exemsedge.exemsedge.exemsedge.exetaskhsvc.exe

pid	process
804	msedge.exe
804	msedge.exe
600	msedge.exe
600	msedge.exe
1188	msedge.exe
1188	msedge.exe
1516	msedge.exe
1516	msedge.exe
3120	identity_helper.exe
3120	identity_helper.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
1516	msedge.exe
1516	msedge.exe
2860	msedge.exe
2860	msedge.exe
1736	msedge.exe
1736	msedge.exe
5172	msedge.exe
5172	msedge.exe
5616	powershell.exe
5616	powershell.exe
5616	powershell.exe
5172	powershell.exe
5172	powershell.exe
5172	powershell.exe
5288	powershell.exe
5288	powershell.exe
5288	powershell.exe
3152	msedge.exe
3152	msedge.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
5480	powershell.exe
5480	powershell.exe
5480	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
3672	msedge.exe
3672	msedge.exe
2216	powershell.exe
2216	powershell.exe
2216	powershell.exe
4756	powershell.exe
4756	powershell.exe
4756	powershell.exe
4956	powershell.exe
4956	powershell.exe
1760	powershell.exe
1760	powershell.exe
1760	powershell.exe
4956	powershell.exe
896	msedge.exe
896	msedge.exe
4076	msedge.exe
4076	msedge.exe
5876	msedge.exe
5876	msedge.exe
5044	taskhsvc.exe
5044	taskhsvc.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

@[email protected]msedge.exevlc.exe

pid process

4888 @[email protected]
600 msedge.exe
6540 vlc.exe

pid	process
4888	@[email protected]
600	msedge.exe
6540	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

Processes:

msedge.exe

pid	process
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zG.exe7zG.exe7zG.exe7zG.exeSynapse X.exepowershell.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeRestorePrivilege	4916	7zG.exe
Token: 35	4916	7zG.exe
Token: SeSecurityPrivilege	4916	7zG.exe
Token: SeSecurityPrivilege	4916	7zG.exe
Token: SeRestorePrivilege	4980	7zG.exe
Token: 35	4980	7zG.exe
Token: SeSecurityPrivilege	4980	7zG.exe
Token: SeSecurityPrivilege	4980	7zG.exe
Token: SeRestorePrivilege	832	7zG.exe
Token: 35	832	7zG.exe
Token: SeSecurityPrivilege	832	7zG.exe
Token: SeSecurityPrivilege	832	7zG.exe
Token: SeRestorePrivilege	5500	7zG.exe
Token: 35	5500	7zG.exe
Token: SeSecurityPrivilege	5500	7zG.exe
Token: SeSecurityPrivilege	5500	7zG.exe
Token: SeDebugPrivilege	5320	Synapse X.exe
Token: SeDebugPrivilege	5616	powershell.exe
Token: SeShutdownPrivilege	1876	powercfg.exe
Token: SeCreatePagefilePrivilege	1876	powercfg.exe
Token: SeDebugPrivilege	5172	powershell.exe
Token: SeShutdownPrivilege	1072	powercfg.exe
Token: SeCreatePagefilePrivilege	1072	powercfg.exe
Token: SeShutdownPrivilege	1748	powercfg.exe
Token: SeCreatePagefilePrivilege	1748	powercfg.exe
Token: SeShutdownPrivilege	5340	powercfg.exe
Token: SeCreatePagefilePrivilege	5340	powercfg.exe
Token: SeIncreaseQuotaPrivilege	5172	powershell.exe
Token: SeSecurityPrivilege	5172	powershell.exe
Token: SeTakeOwnershipPrivilege	5172	powershell.exe
Token: SeLoadDriverPrivilege	5172	powershell.exe
Token: SeSystemProfilePrivilege	5172	powershell.exe
Token: SeSystemtimePrivilege	5172	powershell.exe
Token: SeProfSingleProcessPrivilege	5172	powershell.exe
Token: SeIncBasePriorityPrivilege	5172	powershell.exe
Token: SeCreatePagefilePrivilege	5172	powershell.exe
Token: SeBackupPrivilege	5172	powershell.exe
Token: SeRestorePrivilege	5172	powershell.exe
Token: SeShutdownPrivilege	5172	powershell.exe
Token: SeDebugPrivilege	5172	powershell.exe
Token: SeSystemEnvironmentPrivilege	5172	powershell.exe
Token: SeRemoteShutdownPrivilege	5172	powershell.exe
Token: SeUndockPrivilege	5172	powershell.exe
Token: SeManageVolumePrivilege	5172	powershell.exe
Token: 33	5172	powershell.exe
Token: 34	5172	powershell.exe
Token: 35	5172	powershell.exe
Token: 36	5172	powershell.exe
Token: SeIncreaseQuotaPrivilege	5172	powershell.exe
Token: SeSecurityPrivilege	5172	powershell.exe
Token: SeTakeOwnershipPrivilege	5172	powershell.exe
Token: SeLoadDriverPrivilege	5172	powershell.exe
Token: SeSystemProfilePrivilege	5172	powershell.exe
Token: SeSystemtimePrivilege	5172	powershell.exe
Token: SeProfSingleProcessPrivilege	5172	powershell.exe
Token: SeIncBasePriorityPrivilege	5172	powershell.exe
Token: SeCreatePagefilePrivilege	5172	powershell.exe
Token: SeBackupPrivilege	5172	powershell.exe
Token: SeRestorePrivilege	5172	powershell.exe
Token: SeShutdownPrivilege	5172	powershell.exe
Token: SeDebugPrivilege	5172	powershell.exe
Token: SeSystemEnvironmentPrivilege	5172	powershell.exe
Token: SeRemoteShutdownPrivilege	5172	powershell.exe
Token: SeUndockPrivilege	5172	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe7zG.exe7zG.exe7zG.exe

pid	process
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
4916	7zG.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
4980	7zG.exe
832	7zG.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

Processes:

msedge.exeAgentSvr.exevlc.exe

pid	process
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
7140	AgentSvr.exe
7140	AgentSvr.exe
6540	vlc.exe
6540	vlc.exe
6540	vlc.exe
6540	vlc.exe
6540	vlc.exe
6540	vlc.exe
6540	vlc.exe
6540	vlc.exe
6540	vlc.exe
7140	AgentSvr.exe

Suspicious use of SetWindowsHookEx 45 IoCs

Processes:

pid	process
4676	MiniSearchHost.exe
6072	Synapse X.exe
6072	Synapse X.exe
4748	conhost_syn.exe
2344	Synapse X.exe
2344	Synapse X.exe
4476	conhost_syn.exe
4740	@[email protected]
4740	@[email protected]
1532	@[email protected]
1532	@[email protected]
4888	@[email protected]
4888	@[email protected]
5980	@[email protected]
5400	OpenWith.exe
908	@[email protected]
4172	@[email protected]
4352	@[email protected]
2864	@[email protected]
5344	BonziBuddy432.exe
5272	MSAGENT.EXE
1916	tv_enua.exe
6520	AgentSvr.exe
6644	@[email protected]
6796	@[email protected]
7112	BonziBDY_4.EXE
7112	BonziBDY_4.EXE
6076	@[email protected]
4344	@[email protected]
6832	@[email protected]
3872	BonziBUDDY_Killer.exe
6552	BonziBUDDY_Killer.exe
6964	@[email protected]
6600	@[email protected]
3764	@[email protected]
6000	@[email protected]
756	@[email protected]
6540	vlc.exe
6540	vlc.exe
6540	vlc.exe
6540	vlc.exe
6064	@[email protected]
6956	@[email protected]
228	@[email protected]
6260	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 600 wrote to memory of 2556	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 2556	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3368	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 804	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 804	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3092	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3092	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3092	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3092	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3092	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3092	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3092	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3092	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3092	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3092	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3092	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3092	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3092	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3092	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3092	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3092	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3092	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3092	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3092	600	msedge.exe	msedge.exe
PID 600 wrote to memory of 3092	600	msedge.exe	msedge.exe

System policy modification 1 TTPs 9 IoCs

evasion

Modify Registry

T1112

Processes:

Annabelle.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Annabelle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Annabelle.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	Annabelle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Annabelle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WindowsDefenderMAJ = "1"	Annabelle.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	Annabelle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	Annabelle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	Annabelle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	Annabelle.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

5452 attrib.exe
3704 attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cdn.discordapp.com/attachments/1266564505010180179/1296634790530912276/Release.7z?ex=67349f00&is=67334d80&hm=6fffd7746d21e386e608de784617c873e5fc96b77a6ef34b2780e36969886a11&
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff986793cb8,0x7ff986793cc8,0x7ff986793cd8
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1848 /prefetch:2
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2428 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=984 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1160 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7548 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7796 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7816 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7932 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8432 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8612 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7324 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8460 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7948 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7448 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7692 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7832 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7880 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7380 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7920 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8300 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8392 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7684 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7504 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1816 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7872 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8400 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3672
- C:\Users\Admin\Downloads\Wave (1).exe
  "C:\Users\Admin\Downloads\Wave (1).exe"
  2⤵
  - Executes dropped EXE
  PID:5808
- - C:\Users\Admin\Downloads\Wave (1).exe
    "C:\Users\Admin\Downloads\Wave (1).exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Wave (1).exe'"
      4⤵
      PID:2208
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Wave (1).exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4756
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
      4⤵
      PID:5720
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('A Module Is Missing!', 0, 'Error!', 0+16);close()""
      4⤵
      PID:1464
    - - C:\Windows\system32\mshta.exe
        
        mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('A Module Is Missing!', 0, 'Error!', 0+16);close()"
        5⤵
        
        PID:1892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:5872
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        
        PID:3260
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:1076
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2652 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8368 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8412 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3028 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7256 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7372 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8368 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7872 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8304 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8532 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8224 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4076
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2401.msi"
  2⤵
  - Enumerates connected drives
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2568 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7648 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7232 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8352 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:1936
- C:\Users\Admin\Downloads\WannaCry.EXE
  "C:\Users\Admin\Downloads\WannaCry.EXE"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  PID:6016
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h .
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3704
- - C:\Windows\SysWOW64\icacls.exe
    icacls . /grant Everyone:F /T /C /Q
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:5984
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 52811731432743.bat
    3⤵
    PID:4192
  - - C:\Windows\SysWOW64\cscript.exe
      cscript.exe //nologo m.vbs
      4⤵
      PID:5900
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s F:\$RECYCLE
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5452
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected] co
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4740
  - - C:\Users\Admin\Downloads\TaskData\Tor\taskhsvc.exe
      TaskData\Tor\taskhsvc.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5044
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b @[email protected] vs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5188
  - - C:\Users\Admin\Downloads\@[email protected]
      @[email protected] vs
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1532
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        5⤵
        
        PID:2500
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5900
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2640
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:4888
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "qhvfvgsevfiqy755" /t REG_SZ /d "\"C:\Users\Admin\Downloads\tasksche.exe\"" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4260
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "qhvfvgsevfiqy755" /t REG_SZ /d "\"C:\Users\Admin\Downloads\tasksche.exe\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:4952
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    PID:5240
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:440
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5980
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4196
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2776
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:908
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    PID:4444
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    PID:3844
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4172
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5392
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5740
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4352
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    PID:5900
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5552
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2864
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    PID:5312
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6636
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:6644
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    PID:6668
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6864
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:6796
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:7088
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2088
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:6076
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    PID:4484
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    PID:6564
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4344
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6640
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    PID:6820
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:6832
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1756
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    PID:6952
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:6964
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    PID:912
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    PID:4196
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:6600
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5392
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6740
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3764
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    PID:1820
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2864
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:6000
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:560
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5228
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:756
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    PID:5552
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1632
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:6064
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3328
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7104
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:6956
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    PID:6000
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4340
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:228
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8032 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7676 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=133 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7696 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=135 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1800 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7508 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=139 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8124 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=141 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8320 /prefetch:8
  2⤵
  - NTFS ADS
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=143 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8304 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=144 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7632 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=146 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8344 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8244 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:6612
- C:\Users\Admin\Downloads\Solaris.exe
  "C:\Users\Admin\Downloads\Solaris.exe"
  2⤵
  PID:5780
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\RarSFX0\scary.mp4"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:6540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=149 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7216 /prefetch:1
  2⤵
  PID:6472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=150 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2568 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=151 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7520 /prefetch:1
  2⤵
  PID:6492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=153 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8016 /prefetch:8
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8556 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2384
- C:\Users\Admin\Downloads\Annabelle.exe
  "C:\Users\Admin\Downloads\Annabelle.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies Windows Defender Real-time Protection settings
  - UAC bypass
  - Disables RegEdit via registry modification
  - Event Triggered Execution: Image File Execution Options Injection
  - Impair Defenses: Safe Mode Boot
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - System policy modification
  PID:6480
- - C:\Windows\SYSTEM32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:6808
- - C:\Windows\SYSTEM32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:7164
- - C:\Windows\SYSTEM32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:908
- - C:\Windows\SYSTEM32\NetSh.exe
    NetSh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1500
- - C:\Windows\System32\shutdown.exe
    "C:\Windows\System32\shutdown.exe" -r -t 00 -f
    3⤵
    PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=157 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:6572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8492 /prefetch:8
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,2149135135301447203,17465266331835919433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7832 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:6624
- C:\Users\Admin\Downloads\CryptoLocker.exe
  "C:\Users\Admin\Downloads\CryptoLocker.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:6584
- - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
    "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\CryptoLocker.exe"
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:756
  - - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
      "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000238
      4⤵
      System Location Discovery: System Language Discovery
      PID:976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:492

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2400

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Release\" -spe -an -ai#7zMap5275:74:7zEvent10721
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4916

C:\Users\Admin\Downloads\Release\Mint.exe
"C:\Users\Admin\Downloads\Release\Mint.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2604

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004E8
1⤵
PID:3904

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Electron\" -spe -an -ai#7zMap12756:78:7zEvent25966
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4980

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Electron\Electron\Electron\" -spe -an -ai#7zMap24126:114:7zEvent14184
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:832

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Executor\cache.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4712

C:\Users\Admin\Downloads\Executor\lua.exe
"C:\Users\Admin\Downloads\Executor\lua.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1840

C:\Users\Admin\Downloads\Roblox.Electron\Roblox Electron\Setup.exe
"C:\Users\Admin\Downloads\Roblox.Electron\Roblox Electron\Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\msvcp110.dll,GetGameData
  2⤵
  PID:3152
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\msvcp110.dll,GetGameData
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:4412
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
      4⤵
      PID:2796

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4676

C:\Users\Admin\Downloads\Roblox.Electron\Roblox Electron\Setup.exe
"C:\Users\Admin\Downloads\Roblox.Electron\Roblox Electron\Setup.exe"
1⤵
PID:1056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\msvcp110.dll,GetGameData
  2⤵
  PID:4952
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\msvcp110.dll,GetGameData
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:3352
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
      4⤵
      PID:3764

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Synapse X Crаcked v3 [new update]\" -spe -an -ai#7zMap4859:128:7zEvent5611
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5500

C:\Users\Admin\Downloads\Synapse X Crаcked v3 [new update]\Synapse X Cracked\Synapse X.exe
"C:\Users\Admin\Downloads\Synapse X Crаcked v3 [new update]\Synapse X Cracked\Synapse X.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:6072
- C:\Users\Admin\AppData\Roaming\conhost_syn.exe
  "C:\Users\Admin\AppData\Roaming\conhost_syn.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5616
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:5412
  - - C:\Windows\system32\sc.exe
      sc stop UsoSvc
      4⤵
      Launches sc.exe
      PID:1612
  - - C:\Windows\system32\sc.exe
      sc stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:6056
  - - C:\Windows\system32\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:2140
  - - C:\Windows\system32\sc.exe
      sc stop bits
      4⤵
      Launches sc.exe
      PID:6060
  - - C:\Windows\system32\sc.exe
      sc stop dosvc
      4⤵
      Launches sc.exe
      PID:5560
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
      4⤵
      PID:896
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
      4⤵
      PID:4624
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
      4⤵
      Modifies security service
      PID:2952
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
      4⤵
      PID:720
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
      4⤵
      PID:6132
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:5176
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -hibernate-timeout-ac 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:1876
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -hibernate-timeout-dc 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:1072
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -standby-timeout-ac 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:1748
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:5340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell <#jpkho#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /tn 'Realtek High Definition Audio' /tr '''C:\Users\Admin\AppData\Roaming\Realtek\Realtek High Definition Audio\Updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Realtek\Realtek High Definition Audio\Updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Realtek High Definition Audio' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Realtek High Definition Audio" /t REG_SZ /f /d 'C:\Users\Admin\AppData\Roaming\Realtek\Realtek High Definition Audio\Updater.exe' }
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell <#ykfisbv#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "Realtek High Definition Audio" } Else { "C:\Users\Admin\AppData\Roaming\Realtek\Realtek High Definition Audio\Updater.exe" }
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5288
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /run /tn Realtek High Definition Audio
      4⤵
      PID:2504
- C:\Users\Admin\AppData\Local\Temp\Synapse X.exe
  "C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 3324
    3⤵
    - Program crash
    PID:5124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5320 -ip 5320
1⤵
PID:6132

C:\Users\Admin\Downloads\Synapse X Crаcked v3 [new update]\Synapse X Cracked\Synapse X.exe
"C:\Users\Admin\Downloads\Synapse X Crаcked v3 [new update]\Synapse X Cracked\Synapse X.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2344
- C:\Users\Admin\AppData\Roaming\conhost_syn.exe
  "C:\Users\Admin\AppData\Roaming\conhost_syn.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4476
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2096
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:5176
  - - C:\Windows\system32\sc.exe
      sc stop UsoSvc
      4⤵
      Launches sc.exe
      PID:1292
  - - C:\Windows\system32\sc.exe
      sc stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:5320
  - - C:\Windows\system32\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:1632
  - - C:\Windows\system32\sc.exe
      sc stop bits
      4⤵
      Launches sc.exe
      PID:2864
  - - C:\Windows\system32\sc.exe
      sc stop dosvc
      4⤵
      Launches sc.exe
      PID:6128
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
      4⤵
      PID:5816
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
      4⤵
      PID:5776
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
      4⤵
      PID:4312
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
      4⤵
      PID:5864
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
      4⤵
      PID:5716
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:4748
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -hibernate-timeout-ac 0
      4⤵
      Power Settings
      PID:5536
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -hibernate-timeout-dc 0
      4⤵
      Power Settings
      PID:2432
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -standby-timeout-ac 0
      4⤵
      Power Settings
      PID:1556
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:3460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell <#jpkho#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /tn 'Realtek High Definition Audio' /tr '''C:\Users\Admin\AppData\Roaming\Realtek\Realtek High Definition Audio\Updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Realtek\Realtek High Definition Audio\Updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Realtek High Definition Audio' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Realtek High Definition Audio" /t REG_SZ /f /d 'C:\Users\Admin\AppData\Roaming\Realtek\Realtek High Definition Audio\Updater.exe' }
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell <#ykfisbv#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "Realtek High Definition Audio" } Else { "C:\Users\Admin\AppData\Roaming\Realtek\Realtek High Definition Audio\Updater.exe" }
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4220
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /run /tn Realtek High Definition Audio
      4⤵
      PID:5500
- C:\Users\Admin\AppData\Local\Temp\Synapse X.exe
  "C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 10536
    3⤵
    - Program crash
    PID:5676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2604 -ip 2604
1⤵
PID:5624

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\SynX Key\" -spe -an -ai#7zMap31861:78:7zEvent2667
1⤵
PID:3020

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\SynX Key\Key.txt
1⤵
PID:5928

C:\Users\Admin\Downloads\Wave (1).exe
"C:\Users\Admin\Downloads\Wave (1).exe"
1⤵
- Executes dropped EXE
PID:3160
- C:\Users\Admin\Downloads\Wave (1).exe
  "C:\Users\Admin\Downloads\Wave (1).exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Wave (1).exe'"
    3⤵
    PID:6008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Wave (1).exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    PID:6116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('A Module Is Missing!', 0, 'Error!', 0+16);close()""
    3⤵
    PID:5532
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('A Module Is Missing!', 0, 'Error!', 0+16);close()"
      4⤵
      PID:560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:5244
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4344
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:2460

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004E8
1⤵
PID:4876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Krampus\Launcher.bat" "
1⤵
PID:5816
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:3756
- C:\Users\Admin\Downloads\Krampus\luajit.exe
  luajit.exe conf
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:5776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc daily /st 12:44 /f /tn WindowsSetup /tr "C:/Windows/System32/oobe/Setup.exe" /rl highest
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5552

C:\Users\Admin\Downloads\Krampus\luajit.exe
"C:\Users\Admin\Downloads\Krampus\luajit.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5172

C:\Users\Admin\Downloads\Krampus\luajit.exe
"C:\Users\Admin\Downloads\Krampus\luajit.exe"
1⤵
PID:5344

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:3524

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5308

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4504

C:\Users\Admin\Downloads\Bonzi\BonziBuddy432.exe
"C:\Users\Admin\Downloads\Bonzi\BonziBuddy432.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:896
- - C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE
    MSAGENT.EXE
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5272
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:6372
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentDPv.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:6388
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\mslwvtts.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:6432
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentDP2.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:6452
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentMPx.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:6468
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentSR.dll"
      4⤵
      Loads dropped DLL
      PID:6484
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentPsh.dll"
      4⤵
      PID:6504
  - - C:\Windows\msagent\AgentSvr.exe
      "C:\Windows\msagent\AgentSvr.exe" /regserver
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:6520
  - - C:\Windows\SysWOW64\grpconv.exe
      grpconv.exe -o
      4⤵
      PID:6548
- - C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe
    tv_enua.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1916
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll
      4⤵
      PID:7136
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll
      4⤵
      PID:7152
  - - C:\Windows\SysWOW64\grpconv.exe
      grpconv.exe -o
      4⤵
      System Location Discovery: System Language Discovery
      PID:5524

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
PID:6372

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\@[email protected]
1⤵
PID:6752

C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE
"C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:7112

C:\Windows\msagent\AgentSvr.exe
C:\Windows\msagent\AgentSvr.exe -Embedding
1⤵
- Executes dropped EXE
- Suspicious use of SendNotifyMessage
PID:7140

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004E8
1⤵
PID:4076

C:\Program Files (x86)\BonziBuddy432\BonziBUDDY_Killer.exe
"C:\Program Files (x86)\BonziBuddy432\BonziBUDDY_Killer.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3872

C:\Program Files (x86)\BonziBuddy432\BonziBUDDY_Killer.exe
"C:\Program Files (x86)\BonziBuddy432\BonziBUDDY_Killer.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6552

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:6436

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38e4855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:6260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Safe Mode Boot

T1562.009

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\BonziBuddy432\ActiveSkin.ocx

Filesize
336KB

MD5
3d225d8435666c14addf17c14806c355

SHA1
262a951a98dd9429558ed35f423babe1a6cce094

SHA256
2c8f92dc16cbf13542ddd3bf0a947cf84b00fed83a7124b830ddefa92f939877

SHA512
391df24c6427b4011e7d61b644953810e392525743914413c2e8cf5fce4a593a831cfab489fbb9517b6c0e7ef0483efb8aeaad0a18543f0da49fa3125ec971e1

Download Submit
C:\Program Files (x86)\BonziBuddy432\BonziBDY_2.EXE

Filesize
796KB

MD5
8a30bd00d45a659e6e393915e5aef701

SHA1
b00c31de44328dd71a70f0c8e123b56934edc755

SHA256
1e2994763a7674a0f1ec117dae562b05b614937ff61c83b316b135afab02d45a

SHA512
daf92e61e75382e1da0e2aba9466a9e4d9703a129a147f0b3c71755f491c68f89ad67cfb4dd013580063d664b69c8673fb52c02d34b86d947e9f16072b7090fb

Download Submit
C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE

Filesize
2.5MB

MD5
73feeab1c303db39cbe35672ae049911

SHA1
c14ce70e1b3530811a8c363d246eb43fc77b656c

SHA256
88c03817ae8dfc5fc9e6ffd1cfb5b829924988d01cd472c1e64952c5398866e8

SHA512
73f37dee83664ce31522f732bf819ed157865a2a551a656a7a65d487c359a16c82bd74acff2b7a728bb5f52d53f4cfbea5bef36118128b0d416fa835053f7153

Download Submit
C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE

Filesize
3.2MB

MD5
93f3ed21ad49fd54f249d0d536981a88

SHA1
ffca7f3846e538be9c6da1e871724dd935755542

SHA256
5678fd744faddb30a87568ae309066ef88102a274fff62f10e4963350da373bc

SHA512
7923556c6d6feb4ff4253e853bae3675184eab9b8ce4d4e07f356c8624317801ee807ad5340690196a975824ea3ed500ce6a80c7670f19785139be594fa5e70f

Download Submit
C:\Program Files (x86)\BonziBuddy432\BonziCheckers.ocx

Filesize
152KB

MD5
66551c972574f86087032467aa6febb4

SHA1
5ad1fe1587a0c31bb74af20d09a1c7d3193ec3c9

SHA256
9028075603c66ca2e906ecac3275e289d8857411a288c992e8eef793ed71a75b

SHA512
35c1f500e69cdd12ec6a3c5daef737a3b57b48a44df6c120a0504d340e0f721d34121595ed396dc466a8f9952a51395912d9e141ad013000f5acb138b2d41089

Download Submit
C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page17.jpg

Filesize
50KB

MD5
e8f52918072e96bb5f4c573dbb76d74f

SHA1
ba0a89ed469de5e36bd4576591ee94db2c7f8909

SHA256
473a890da22defb3fbd643246b3fa0d6d34939ac469cd4f48054ee2a0bc33d82

SHA512
d57dd0a9686696487d268ef2be2ec2d3b97baedf797a63676da5a8a4165cda89540ec2d3b9e595397cbf53e69dcce76f7249f5eeff041947146ca7bf4099819f

Download Submit
C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page18.jpg

Filesize
45KB

MD5
108fd5475c19f16c28068f67fc80f305

SHA1
4e1980ba338133a6fadd5fda4ffe6d4e8a039033

SHA256
03f269cd40809d7ec94f5fa4fff1033a624e849179962693cdc2c37d7904233b

SHA512
98c8743b5af89ec0072b70de8a0babfb5aff19bafa780d6ce99c83721b65a80ec310a4fe9db29a4bb50c2454c34de62c029a83b70d0a9df9b180159ea6cad83a

Download Submit
C:\Program Files (x86)\BonziBuddy432\MSCOMCTL.OCX

Filesize
1.0MB

MD5
12c2755d14b2e51a4bb5cbdfc22ecb11

SHA1
33f0f5962dbe0e518fe101fa985158d760f01df1

SHA256
3b6ccdb560d7cd4748e992bd82c799acd1bbcfc922a13830ca381d976ffcccaf

SHA512
4c9b16fb4d787145f6d65a34e1c4d5c6eb07bff4c313a35f5efa9dce5a840c1da77338c92346b1ad68eeb59ef37ef18a9d6078673c3543656961e656466699cf

Download Submit
C:\Program Files (x86)\BonziBuddy432\MSINET.OCX

Filesize
112KB

MD5
7bec181a21753498b6bd001c42a42722

SHA1
3249f233657dc66632c0539c47895bfcee5770cc

SHA256
73da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31

SHA512
d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc

Download Submit
C:\Program Files (x86)\BonziBuddy432\MSWINSCK.OCX

Filesize
105KB

MD5
9484c04258830aa3c2f2a70eb041414c

SHA1
b242a4fb0e9dcf14cb51dc36027baff9a79cb823

SHA256
bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5

SHA512
9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0

Download Submit
C:\Program Files (x86)\BonziBuddy432\Reg.nbd

Filesize
140B

MD5
a8ed45f8bfdc5303b7b52ae2cce03a14

SHA1
fb9bee69ef99797ac15ba4d8a57988754f2c0c6b

SHA256
375ecd89ee18d7f318cf73b34a4e15b9eb16bc9d825c165e103db392f4b2a68b

SHA512
37917594f22d2a27b3541a666933c115813e9b34088eaeb3d74f77da79864f7d140094dfac5863778acf12f87ccda7f7255b7975066230911966b52986da2d5c

Download Submit
C:\Program Files (x86)\BonziBuddy432\Regicon.ocx

Filesize
76KB

MD5
32ff40a65ab92beb59102b5eaa083907

SHA1
af2824feb55fb10ec14ebd604809a0d424d49442

SHA256
07e91d8ed149d5cd6d48403268a773c664367bce707a99e51220e477fddeeb42

SHA512
2cfc5c6cb4677ff61ec3b6e4ef8b8b7f1775cbe53b245d321c25cfec363b5b4975a53e26ef438e07a4a5b08ad1dde1387970d57d1837e653d03aef19a17d2b43

Download Submit
C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat

Filesize
279B

MD5
4877f2ce2833f1356ae3b534fce1b5e3

SHA1
7365c9ef5997324b73b1ff0ea67375a328a9646a

SHA256
8ae1ed38bc650db8b14291e1b7298ee7580b31e15f8a6a84f78f048a542742ff

SHA512
dd43ede5c3f95543bcc8086ec8209a27aadf1b61543c8ee1bb3eab9bc35b92c464e4132b228b12b244fb9625a45f5d4689a45761c4c5263aa919564664860c5e

Download Submit
C:\Program Files (x86)\BonziBuddy432\SSCALA32.OCX

Filesize
472KB

MD5
ce9216b52ded7e6fc63a50584b55a9b3

SHA1
27bb8882b228725e2a3793b4b4da3e154d6bb2ea

SHA256
8e52ef01139dc448d1efd33d1d9532f852a74d05ee87e8e93c2bb0286a864e13

SHA512
444946e5fc3ea33dd4a09b4cbf2d41f52d584eb5b620f5e144de9a79186e2c9d322d6076ed28b6f0f6d0df9ef4f7303e3901ff552ed086b70b6815abdfc23af7

Download Submit
C:\Program Files (x86)\BonziBuddy432\SSCALB32.OCX

Filesize
320KB

MD5
97ffaf46f04982c4bdb8464397ba2a23

SHA1
f32e89d9651fd6e3af4844fd7616a7f263dc5510

SHA256
5db33895923b7af9769ca08470d0462ed78eec432a4022ff0acc24fa2d4666e1

SHA512
8c43872396f5dceb4ba153622665e21a9b52a087987eab523b1041031e294687012d7bf88a3da7998172010eae5f4cc577099980ecd6b75751e35cfc549de002

Download Submit
C:\Program Files (x86)\BonziBuddy432\Uninstall.exe

Filesize
65KB

MD5
068ace391e3c5399b26cb9edfa9af12f

SHA1
568482d214acf16e2f5522662b7b813679dcd4c7

SHA256
2288f4f42373affffbaa63ce2fda9bb071fd7f14dbcd04f52d3af3a219b03485

SHA512
0ba89fcdbb418ea6742eeb698f655206ed3b84c41ca53d49c06d30baed13ac4dfdb4662b53c05a28db0a2335aa4bc588635b3b205cfc36d8a55edfc720ac4b03

Download Submit
C:\Program Files (x86)\BonziBuddy432\ssa3d30.ocx

Filesize
320KB

MD5
48c35ed0a09855b29d43f11485f8423b

SHA1
46716282cc5e0f66cb96057e165fa4d8d60fbae2

SHA256
7a0418b76d00665a71d13a30d838c3e086304bacd10d764650d2a5d2ec691008

SHA512
779938ec9b0f33f4cbd5f1617bea7925c1b6d794e311737605e12cd7efa5a14bbc48bee85208651cf442b84133be26c4cc8a425d0a3b5b6ad2dc27227f524a99

Download Submit
C:\Program Files (x86)\BonziBuddy432\sstabs2.ocx

Filesize
288KB

MD5
7303efb737685169328287a7e9449ab7

SHA1
47bfe724a9f71d40b5e56811ec2c688c944f3ce7

SHA256
596f3235642c9c968650194065850ecb02c8c524d2bdcaf6341a01201e0d69be

SHA512
e0d9cb9833725e0cdc7720e9d00859d93fc51a26470f01a0c08c10fa940ed23df360e093861cf85055b8a588bb2cac872d1be69844a6c754ac8ed5bfaf63eb03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e9a2c784e6d797d91d4b8612e14d51bd

SHA1
25e2b07c396ee82e4404af09424f747fc05f04c2

SHA256
18ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6

SHA512
fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fc959921446fa3ab5813f75ca4d0235

SHA1
0aeef3ba7ba2aa1f725fca09432d384b06995e2a

SHA256
1b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c

SHA512
899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7045966b-e38e-44a7-a765-007281cc6523.tmp

Filesize
4KB

MD5
d866dc79bd3f3a6dfdd6383b748ddbdf

SHA1
6f439f80d5b67b49e61e87c38b57a7c56d8414bf

SHA256
1992f0775bcc0411064f06a9e1ddf34317392ef21f3b60a9e462d12a5ebf4e87

SHA512
7cf1a428f5d53878b4e4b3604863dcfedefcb922d8d6aef1dbc39607b0881217881e0f201cd7fdd4be702dca0a303ee35f42e6b3a2a470c6917ffaed6d9d56da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
19KB

MD5
2227a244ca78dc817e80e78e42e231d7

SHA1
56caeba318e983c74838795fb3c4d9ac0fb4b336

SHA256
e9d7b93bae57eebd7019ac0f5f82bac734b7ac3534d1fa9bdba6b1fc2f093a24

SHA512
624cc23d4a18185ae96941cf8a35d342e048476b0384f0595ec1f273e19163ca49b17b14760628eb9da9a5f5519d4671544669fb08985c4945faf663faf92e12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
47KB

MD5
55a93dd8c17e1019c87980a74c65cb1b

SHA1
4b99f1784b2bb2b2cc0e78b88c5d25858ff01c5d

SHA256
4925dd477b8abf082cb81e636f8d2c76f34d7864947114fc9f1db0e68b5a9009

SHA512
f9ade542c593067dbcd13ed94da1ba17a84782575355396db8fd7c28aa70a3120d0c0a22d3ca3d2f0774c1dcb06b9319e243b36001c618c92e0af25cb9c8e46b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
67KB

MD5
fb2f02c107cee2b4f2286d528d23b94e

SHA1
d76d6b684b7cfbe340e61734a7c197cc672b1af3

SHA256
925dd883d5a2eb44cf1f75e8d71346b98f14c4412a0ea0c350672384a0e83e7a

SHA512
be51d371b79f4cc1f860706207d5978d18660bf1dc0ca6706d43ca0375843ec924aa4a8ed44867661a77e3ec85e278c559ab6f6946cba4f43daf3854b838bb82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
25KB

MD5
cd74fa4f0944963c0908611fed565d9b

SHA1
c18033d8679d742e2aab1d6c88c28bd8f8a9e10d

SHA256
e432edfafbd52fcdbd59ef74892aa2e2ab19df6647ae723b368fca529066a804

SHA512
b526216bdbc73a97db41edbec6fdfd09b7b4ae149d415fb5811dde03ad4b1b0247950abd78fef807ae47674ab1b56ff0b971fa5e305b26bc92dc07871313b750

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
38KB

MD5
084a7c45c750134bc52120929e4adfa2

SHA1
7caa207a66cb97095da77cb26bc03c05e3e3e3ef

SHA256
d897e13540624694573d596496a442f317069973a8bd8f9464b2ee91406fb990

SHA512
6aac3796f0435096a86e81ef9bdcd0186ecf74d35a38dbcd9d5c08662fe707c50d015453bf7eef1cbdbade8fca2779aded56bf3a2407a5ae97fb2a6eb1092f2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
37KB

MD5
908677684413f5278249c1b08127d6a0

SHA1
df54a142c7eb47537509a54a8519f1c6c82d0965

SHA256
49910739da15aef97cf1b1fab8a1c6817991542d296c3fe6619248258626330b

SHA512
d6458614c8cf209da33129d5672f4eee9923bb56e91692c87a0f82a0e00c0ed0c03bad913e3ebfae7dab32f76465e58289e15e579bc5f8af37845ab250301773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
20KB

MD5
4e786ef6de6d058a7ee21d714b5878f8

SHA1
a25cf3a4ef2c4208064a295fc00bf84be1557e8d

SHA256
fd7a0097dcdb4360e99e3131665aaf1cdddb65f638323d8dcd86832ac1c65b57

SHA512
79f32a2fe5204c324bcdfd5b11b3d7423cb8961e61350ef8b1a40390212bb1f2125be11aa9a8761edb2fd4c760a39c9f18394a8bd8bc55148ff2937b4ea67bac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
20KB

MD5
dc1fead1a573751765cafd211836ba29

SHA1
1d94ba0be07f3e81518fb5be569ea00e3b6cbc25

SHA256
991d3d799a919cbac9895ac58d8a6e62ef3173f78f2e0a9bb5b92578cbb8f8ed

SHA512
b12e15e781cab71469d6960e7a2760ab6b376a260533fbbb7d761c827659b1d3e2838754e42fcbdebbe6ee92ff0714bfd61d24004f8a57af8885a0be6e774898

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
18KB

MD5
2e23d6e099f830cf0b14356b3c3443ce

SHA1
027db4ff48118566db039d6b5f574a8ac73002bc

SHA256
7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

SHA512
165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
17KB

MD5
aa9d4b0371cd9ae330d7b131493f54c5

SHA1
e83c2b6b6f023a6e00d18f0c9ed6b8ae9bab1459

SHA256
1ffe9b8b344a25a19f33e5900aadb00e53b8bf1a22210ab66c7b50bbcbea45a1

SHA512
337e27650c4b534683c8589dc4787eb9bcfecae020bcb1a507a1530b1fd7562ba8d185157e8af23b06e80cc70136f51bbc0fc0ac63e581e34e410c6d08d398e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
18KB

MD5
551ec1ab5799476429ed57184a6e0502

SHA1
7bcf188080787adcbcf62dcdad2ffa9ad38e1301

SHA256
a26c3b6f6f77a35a297032c0ab11fa2be0a3e3d0091d7d2cf275fd40c84a43c1

SHA512
c9f59fa7160d68e2eb1cc8453a770423af23c2ea93a779aca1180111705096760aee976db84155973402731b113e7e4266772d32d1efd3fdd674d2ea0e5bf058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
59KB

MD5
b2fd30df44561caba77e306bab6d040d

SHA1
3aa15b05e9428b20b6072c770db79f097f0558f9

SHA256
5d6c32e6ce14a8b55f4eca20d6b324b68f401977e42e858fcb0d14d3bf642a0e

SHA512
0c1d2a2680b50189f2582cbc136f64340ed69c140ca376c87d3cd37cb842fe069ffa7fca2dfcf99590a602a073ec8ea033a1fa4c6496f14864b1624fa9a17a07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
38KB

MD5
8a99370cbc67874d68319f5b624173fa

SHA1
46d9eec29e0fc6d642407e5d9250a2f4dc65e990

SHA256
d5c8d14b82bdd5b502444d9cfbfe9ebd3e041a819bd5c187a50ca7a6b2c929b3

SHA512
813170bfdca29d5f0de41f4f538d6d2955750419998c35bf4aaf55b9e8864ba3ffe41d039463ffc0f7d5793d90d1e7a76b9bb77f68f002d63b4ebf5531d0e921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
53KB

MD5
cfff8fc00d16fc868cf319409948c243

SHA1
b7e2e2a6656c77a19d9819a7d782a981d9e16d44

SHA256
51266cbe2741a46507d1bb758669d6de3c2246f650829774f7433bc734688a5a

SHA512
9d127abfdf3850998fd0d2fb6bd106b5a40506398eb9c5474933ff5309cdc18c07052592281dbe1f15ea9d6cb245d08ff09873b374777d71bbbc6e0594bde39b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
88KB

MD5
76d82c7d8c864c474936304e74ce3f4c

SHA1
8447bf273d15b973b48937326a90c60baa2903bf

SHA256
3329378951655530764aaa1f820b0db86aa0f00834fd7f51a48ad752610d60c8

SHA512
a0fc55af7f35ad5f8ac24cea6b9688698909a2e1345460d35e7133142a918d9925fc260e08d0015ec6fa7721fbeae90a4457caa97d6ce01b4ff46109f4cd5a46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
101KB

MD5
d9563d31f82d0dc6ace5a3f763651e7b

SHA1
8ae67dd28a3728ee94a457f74f42d5e39a2069c7

SHA256
82cd695b5592f803299b350e6fc244931a3042b5169ff2080cfa54a308f024ff

SHA512
8f52d7e7601a4d141ff433018d25fe80a41ac853e6968416303e522c021f0d625261ce740b3e2979a45cd87df2e522a8332e01ef1d1e50fb527606b4775d3e3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
19KB

MD5
46c65c348f90aa174bfc5f9dbacbc3a1

SHA1
f3f1cb408e89e48b14532730632dba27858d2676

SHA256
0b36587fac66193c3e84fc32c4edfecf3b9a8717aafea51178f5480239bfa008

SHA512
e18be3c74e039ff4297313b12abae8719e26eb852724a46f119121d008a7165e249bc17d17b3275a108e6de14b1bc443a7827589bc4fd46d616de699b8294ada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
22KB

MD5
50fee96b020979b5d3b1ef885b1f8d83

SHA1
c063d6883c0f8ca599c66847cea88109aba8cb6d

SHA256
6f16b4d447c08c895e2ead7983cbe0e615945a76c4ce4a3e54470eae33576464

SHA512
1899d6eb265cd53ab6c60d90131a127ca9bdbd3dc741d3eec4c680adcbbb44583d03de4fd6bbabff4e8b08d6c9e10ab6290af1ce2270c87a0496db8980dbef49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000063

Filesize
52KB

MD5
ebaf2dacfdf0ef4a1a0ab49970115548

SHA1
f7ac3a29c306d33c90214dec79e7dfe707d81cf5

SHA256
f45792afe12ccf96374a1dc43ff90e7a6ecebe2fac0e536fa3669cc194fac06c

SHA512
c57e852f0331b6690ec9a67787283966f59c8b33ead0480cfebb2fdbb0f5791bfc052fe9f480794cc498bed8088c1c9afb904693e1155b3fd7411420ba675ab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006a

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006c

Filesize
20KB

MD5
4d8b471a2271ac4e3b5d25b5683964d0

SHA1
67b52c3bfabc09bc4f99d259de43213dfebbb5c8

SHA256
d0947470db9c332a7e6abf959a45cbdaa82e6e032e325c512cc9a3cd32dbae65

SHA512
d734faac61756e2fc07821704a9ebc5c5a0e7a7dec601b3c8ac4ad6b1cec59cd6446f38e4df41f9c51cf5a45bc7c6241801fa945023bec1a735c0bf450a0c0f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000074

Filesize
20KB

MD5
7820868733f40be1532c203ddef29dac

SHA1
b05284788e05da2048eafe2d32ae82d72cc7bf20

SHA256
697fe36c8e350ba203e98a5b319be12ac8c3c4b1b0c7b0659d32b0d8210f5c12

SHA512
34ea94632c42798d74da4bae84839889bb071a6545e20e6732523f1b1f8357a9db9b5002c897307bcbcfcdacaab3a7939f069d8b8c8ab2d04c5bc39ffdcb795c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000075

Filesize
47KB

MD5
015c126a3520c9a8f6a27979d0266e96

SHA1
2acf956561d44434a6d84204670cf849d3215d5f

SHA256
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

SHA512
02a20f2788bb1c3b2c7d3142c664cdec306b6ba5366e57e33c008edb3eb78638b98dc03cdf932a9dc440ded7827956f99117e7a3a4d55acadd29b006032d9c5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007b

Filesize
18KB

MD5
0c6df089737353836638e77b567d156c

SHA1
bf72626cfc3e4ccc68a5d7b547a1c17e594b3b10

SHA256
13cbf6e913ef52716ed4be8228b07498173fda67f3da69dbbe830a2e6319d1ff

SHA512
b4bb313f3c172f49e847b05db95d728ec2fb3726270cc224c04bdbc3bde968dcdfcd85b570e313cff7ba71bf1b7d26a5889e58c3ea1b98df3ab818532440c4b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000aa

Filesize
38KB

MD5
1806db26c5d614e263c1cefdbb1211b1

SHA1
412443dfdf346d3dc2d68e30cf717b402443f939

SHA256
5c191b166a2ad5f70572dea7fd656306623e3274a544d8e084a3c5f28b9acfa2

SHA512
43ffd45fafc2063328297193a992dea6e8d389943b3d39fb393e74d8bc64ffd50017be0978cc9b1c1e1242b88486e36d5b33840008e2482098c79814de4ab2fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000b5

Filesize
18KB

MD5
86bd07fc23df63032eae2b71fcd4d953

SHA1
c03c4239b201e51e480ebf88c2f7d819f8165d00

SHA256
85147518b553f8a19ae4f20123e23ceecafaca3a569f442cd9aa67830d3e8245

SHA512
bee47ffba3c3707cf429355cdfa897ead768b3930ae71417b01babdc59b0e0aa61ff69febce92b9839c8a13b2e2d579a456b5d029eea7df16a0df22175f38116

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000b6

Filesize
61KB

MD5
2209ef861f6c70654da83580a7df14a3

SHA1
c887eeb4641ed6fa49fbba6aeda443faaf435026

SHA256
ae7d7bfa5854a3d2b5792953e6c38308687f12cbd26e4a0f8ed9594454e46abf

SHA512
e2d484e218e7b519a876a418963d2415ed0cb0e7d1b7e35fa2b00b3d56edea3653c86bd90bb47c670910e88b0235bc40dd3de67e18dec364a0b34c3c6bd2cb1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000b8

Filesize
6.0MB

MD5
982565bc2a84320f9c1d8f1acceb8483

SHA1
5dafdd8eacf1ddd854393ff81cbb39596fb7c043

SHA256
714a85f2c7cb1f31f7df9b9042755a9f59b077a3f855a74e0a9786065f1b6b64

SHA512
ee32a8412d38801a64cec7c7f2249e03eac5a34c051ce30b38156426bf7e72663e3c0ec219e9b6464746609aed8df1b36eaedbd831097df30a663316873c7005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000bd

Filesize
30KB

MD5
8fc04f0a1a15bc42f5a832fd31f447a6

SHA1
1fdc1cbefb2a9bc601fb299241022d695b3013be

SHA256
8e5e82e50f588067cd159c159fc88735d4123d3ce180b0708d6e2535b048add8

SHA512
2e3d44c486d41ee24ae02e0dd8fd206b3f797885ca304d40777327d61ee494b3fa77ed1c7b8fae1a2df34120efab31fe63e2053ae44b8faa7b2976adeeb094a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000c1

Filesize
18KB

MD5
115c2d84727b41da5e9b4394887a8c40

SHA1
44f495a7f32620e51acca2e78f7e0615cb305781

SHA256
ae0e442895406e9922237108496c2cd60f4947649a826463e2da9860b5c25dd6

SHA512
00402945111722b041f317b082b7103bcc470c2112d86847eac44674053fc0642c5df72015dcb57c65c4ffabb7b03ece7e5f889190f09a45cef1f3e35f830f45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000c2

Filesize
18KB

MD5
8eff0b8045fd1959e117f85654ae7770

SHA1
227fee13ceb7c410b5c0bb8000258b6643cb6255

SHA256
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571

SHA512
2e4fb65caab06f02e341e9ba4fb217d682338881daba3518a0df8df724e0496e1af613db8e2f65b42b9e82703ba58916b5f5abb68c807c78a88577030a6c2058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000c3

Filesize
143KB

MD5
617c36ee66bc851f4994aa01dc92a9d7

SHA1
1e96772ee2fe99ffa3edfdbd51fa3422489cf57d

SHA256
b8d1a79bcffb10faf5a340c751e2dba0c0ceb405774295b026d04c3a4812f009

SHA512
7d21fbf9ee2760c214c0b955fcc16f0ad1e42a93b0edd47cbdf83e1addcf81d788db428a0827709c7205ac54ac1aa412619b3d60a57c66d69ffdaeddf9747e1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000c6

Filesize
67KB

MD5
9a36e47b062c2a7cc98b2c7c60423338

SHA1
a981b814d5b10e4dc0ab86fff926c960f19d756f

SHA256
cd85f4762e736ff87d7184e4a146149df68c9b646be1841aab202e55ccad499e

SHA512
8e4f25e2e4af4a3317e94eb97c580008ac622ba7110f3716e09a15647793921912ce57436c31dd48578185b6cd00edb975a49a21d1684420b07cb98c0f2902ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000ca

Filesize
35KB

MD5
7c702451150c376ff54a34249bceb819

SHA1
3ab4dc2f57c0fd141456c1cbe24f112adf3710e2

SHA256
77d21084014dcb10980c296e583371786b3886f5814d8357127f36f8c6045583

SHA512
9f1a79e93775dc5bd4aa9749387d5fa8ef55037ccda425039fe68a5634bb682656a9ed4b6940e15226f370e0111878ecd6ec357d55c4720f97a97e58ece78d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0143edd150d6fe42_0

Filesize
2KB

MD5
393c3effbfa34372a54f186b4d8ebd62

SHA1
974a6b3bae6624a57733b3fa42b080d0d7ae4bfd

SHA256
479831ef913395e824e32297e07ce97f11b9fa5a84080f5004adb404ac3e100d

SHA512
1fa3ed10b5d9700bdd8e1803766910aad43cf9f956f876174665e93ba48e88d9ced6da0a35be86cc8ff487c51f3888da46c0c4d88e36c7623d9a5de328c1d760

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\02735674612cbc52_0

Filesize
1KB

MD5
8db171f1df129addbe2f2e62468a739b

SHA1
6698e642021e0b4fac2916545a0a8f661f0af792

SHA256
bff457fa897bc325a41a71ffa0734ed6fc7b49f9a9ecca3a05ef321116d3740f

SHA512
88340be9f89ee0a1e2546074579c52cee8f63841c368c6b3b1415f0ab50963e19698e94d60898cf44862c0ede0f6f4ebcf121cecd9eb681c8bd3384302368d4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\03eef0e77feb64d4_0

Filesize
7KB

MD5
b5a710de0f8d3b2b3ced6e8083d1bc9d

SHA1
2cdd2302bccea0ca24155a2834f0f23b940d2a01

SHA256
8fb8cdb8210d9fba97fc216f3286435cd2c672faa1687c7440cfc8deedb93f5e

SHA512
3bd559fce16d4b682821798db00cac05bbfe1aa3728e458c6b709679a498b1baa8e9973b8f64a77617e4e20e7e3139e8ae4b5e686ceebee0d32b87d28218895d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\067fc740fd98a15b_0

Filesize
1KB

MD5
e6e7555603c03e562a89d6ac56a60a24

SHA1
ce634a721ff76bae4f4f2b433ce53e5df8677717

SHA256
6d166e56baff037043917baa17a013f0e869df8301dc7a4fe85e334d98d100d8

SHA512
cfac10d78a76adc7ccdebe069c973923768201a81fba67ed959ee85147b875362377a9c3a37fd6c9bf26e4e5b1b0271db3bf26da7eb0015fdc207c36b09bc0ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\07290b0701b94f9e_0

Filesize
294B

MD5
366ca71ce884e6ceeb590a25389b726a

SHA1
7b1860f2b7529e601dd8c8c2a8b0a49770725de1

SHA256
5ab475d524f02d7a4a08138bf2838602bbbca0d6583f20a1c8e0785b509c1cc7

SHA512
19516725d857137679f7ef341dd08fd87c8db24d6a4b33f981171bc32e9a7484bb0a2348b48cb4ef2eebeac3c00a46122f8e5570cb3868459cf385eb77d6c1a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0bbe00d9bf7b798e_0

Filesize
5KB

MD5
131a2a4d3ceff8a1271b64285ca24494

SHA1
efaedc0bfd9373a2b573dacce0705d6a85d05fca

SHA256
f91fd35513e4690ec9a92a5156e62a044fb53913e03b46f97295eb93e4f5641b

SHA512
976858b17a3e34b93724a80e5309528f1fcfb6ee1fc582263dadcdb59b71ec94d15cb6f491d8ad9290d4b5891144ee065d23ed900c5d686828a64aab4cb19a03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0c2ca087b0d95fc8_0

Filesize
7KB

MD5
c0196556bf4ce708234a632653c96d3a

SHA1
ec4c451142f3a2c6e1594ef3d73317707e7dd50d

SHA256
65a8cf349d228c8b54b999e7e12f4fc388863c8390cede0868d0b10e29ce2700

SHA512
b883e590bae29c146171359181a297313dbb09e57c12692e8aa0b96203a7e3ac26e3cc72e9b80bde93604e99e7936a4d8f2b5e07be226be568d9c0c23c59e4b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0ceb49e44acf34b3_0

Filesize
2KB

MD5
aa44e17b106c63a5c380db299ebb65c8

SHA1
4b38864c609a1440d6848a483794aabcb3ad70f6

SHA256
3ee124d2fd5cb3e51a62e6ed3eec6755f10a69cd9e1dccec46d935a023ad8df5

SHA512
4da0618ff5663eeb80bba0f8a5c403e82020c530b439e4fdb54dd44e2d239910d80fd9a5d9d3139a05410be2b86636a55ae41ffff486c4655c4b7dbd70ebd89e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1337b0e5117116c5_0

Filesize
11KB

MD5
2b490c8d73fac4810e67a955a3f77794

SHA1
b8b8e95f70894488e9e1ae4fb3f1842c262797c9

SHA256
21d7d94ce232306dda196769958244ec70d0cdf533fce3770ca6a296d426f253

SHA512
051e91180e33ce2b639856736c4e0ea99e65f0f6e948939509f284ec3f00680ce600a61ce9a761fbf4952dcbf4bb8ac04bbeed9f2eff09c65660ec190cda1a6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\14ff8116b518ca2d_0

Filesize
2KB

MD5
d6a28f11b326749615ad4ad3b70a2644

SHA1
6251ff282d4e59ca47d192fd0c3f1e5f5d18a516

SHA256
629f8133c3da6c932d37afc342f68dd7596dfc8f4c503fd3212f221630d45349

SHA512
93d7e2abdb641066e2033aa185e1433a87f114909272e665ab8295a3269a4098e1092055024b495f1d923bcfb57edbb507a573997c46523d1c037e3c06d96717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\15e18e6d4e4de065_0

Filesize
2KB

MD5
764dcb81d337cb885f8b2a7b48406f34

SHA1
b9820e4048044343ac916a88204f029eecb6229a

SHA256
6f30edb58d6eda0bde60bdbfea8d1aeb58300621453fe2c82680751a37e2e6d6

SHA512
527c5df6c636006e8713596906529a03f75c465fb27f8ee6e7f0a319af178bb9cebde5386d4fc7c3fc8bd0a15fb47319013719da2c88037c5327dec0265bf3af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1d841f065bf583e6_0

Filesize
1KB

MD5
2b9a440046b6e845ebc9e06c3bb078a2

SHA1
1a3667c9944f6a5dab0e7f2d51d7a6cd6b199c3d

SHA256
fd452a66dcd4c6d6e53d1cb30c55cccf97d492c817feed51febfab9d0262b6e5

SHA512
807128f4f684f2b2583105da5237baba0e8f44777e0305c1ef52a0b49a7e49a86912f40d8d5cbefebca582d0a9fee7ec671abde26db67042e896d66c3c80ad0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2005abd1c10ed4cf_0

Filesize
1KB

MD5
ca53a160e109fb4fb8d0e7e6dcc0f52e

SHA1
d1b55fd7851d8c131d1c9bd1996c9b691a16d57b

SHA256
5a4c41bb3634947046758d248854024ae9280650b7c89947c863f49328b2acea

SHA512
6a2e397c3d7ebdbab2e66ca02183326cfb98de67aa8e597d201abc4a214bf3cdcafc63c8eadd4bab2e78ef2a2f7b5a14bc72562c9c6cab013b7ce71312176323

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\24115f4e5be1b051_0

Filesize
1KB

MD5
bfe25719e7437b061e8675e72ec8f97e

SHA1
345dbe548c4a0add971d7f919676a884c4521779

SHA256
a88f19e6244cc3d7a373fb8808b7c59c1e5f1e126b292a48f7b2535aed77a401

SHA512
83c9099917dd85b7482cb64a1539c3530d20e9accd16ca354137ba450d76530c488d00a17fbf41086c7b0c80c5f1952bd46c50e4dc6f4ab2d64820c8c1151534

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0

Filesize
1KB

MD5
2e3f074d05275d53e2aaf1c44ebc1aa3

SHA1
80e3ea2fa0f7fb40216121b7ff199a456dd7e41b

SHA256
f50f3a72331a426b3902ed4a77e92f34167b5c225de0b66aaa30a1eb069f2131

SHA512
b65532fe1e306068c07a645b687813591610cbf00d6055c9c70a50fae3e0b98c5e490eee5e76bde55e2837a92e46ce8691af6a9a957704fc59f266f8fe437afa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\27af1c8d2db74e2f_0

Filesize
1KB

MD5
0d4754130273c683f4ae050f285fd633

SHA1
2dbb4e1e1675f6716ebe68509e8a2e392680dd78

SHA256
1cb6d4caf1004261027ce2aebbc16db5ede5f9b701de52bf4d397743b7147db6

SHA512
6a493df00a0ca7c644ca4f1c65769bcb5aa60bd2ea13ceee63727d52f3ded7ca0092e2298c226a7ccbf14c33391f5ccc154df9f809584ca9ebe91a86c9efb471

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\27c6c43cae743946_0

Filesize
209KB

MD5
aba63bb7eed0a9bf69cc554648a75212

SHA1
94594a23940f2d549f58d2a2e48d6a2edb84e90f

SHA256
1372d18184463c417b597f8bfcc8cd5fd374109ae53bff88d6d68bf8ae2f29c3

SHA512
6bc3a58db127e9149a35b79d68d6ff7d7f16eae6a4f10fdb43403eecc67e929756de025f1af6fc10154523bde862213c9bef5e333fd2885392b5db047fa018c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2971f80f10bd8d9b_0

Filesize
1KB

MD5
19068a2e8a40bd7475d12d6a1e5923d7

SHA1
458a1b67d44724054fa803d79fb99f1b9943e584

SHA256
044a74c7e16e455071e44563127fb1f018c94ec7842dd600dabe42c82490183a

SHA512
3747e86a24eeccefc8b3d99784e055d3b99a8ddc7b6b4f6543e10d368899fd1f9152090daee7254fc0df18acb96dc37f4df010ee6ec2d0d8c18b1c8fd527751a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2e697fee15be8a1f_0

Filesize
1KB

MD5
9b8c9ac05999b0f79ac1b87bfa6f5453

SHA1
6b6668f37f14529a4483310fd91f4f8a47e17d86

SHA256
0b997cc348d67c341fe40eb6b0d52eb97a79856a8741d4140b4573f3d8c430bb

SHA512
d3dbb719ad9167ac67f007c301db062cd05b00eae4e34fc102bd59c369aab2c9dc909d3a072aca9ec7515341bfff7a6856721c668ec248909e8ca425ae3af741

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\302acb0cd4a267e9_0

Filesize
6KB

MD5
f22b036b3cb0ca043ffc98b4712fea7b

SHA1
7f7836e452100f013e327ed69c901a40d150ce5f

SHA256
da177b3e3b3d9e0c48b441f8d3e2869a08f3ea47348d0cc642d02c0ac6fceac2

SHA512
476c38bedc1ab349e6c6ea49ecd05c8df71f63f3caf84701727c4c5fa95b1e17a4a0a20596fdb2088c5c6a7c3df971ce70c9e7d437386dfdee129fc419f2e5c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\30a58d4cf6a6cbd9_0

Filesize
1KB

MD5
cd1e3aa2411b4fafa14a034bf2edf707

SHA1
8788a0a63dcbdca459447f7912f5330433262917

SHA256
8d72dfe1a3a84aec9380a0843931a2ae83859b11cbd3688e7e1a656aa0cec518

SHA512
4414294a1db93e568c863fbffc827c3b79a87345071ba70ff787655e44b8922a817a8e47ce85bb322500c76f9fd27b8ed46fb27542b476d73da091aaac8b132e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\31d3611f0e13cd20_0

Filesize
3KB

MD5
67d4fabdebb39501ba24bce9f98e5d16

SHA1
336b429adced8cf5a92bd4edfdad3efeec76ec9d

SHA256
a832d7052b1ee1af6784478921571c34b0ca47bc1aa8e6ec342a6d73fec74d32

SHA512
4334c0603c207a807e814c60f10b394a0d151c8027ed81e2403646147a963ceb9f5bfb3833d4eaabcaa5be158bec9d55497eb0a978d231ecb317969297cea3dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\31f67a59e91dffa8_0

Filesize
1KB

MD5
0fe76109f14967a5cc1e06ad3c06ddec

SHA1
980c69dc01bc1e46e2432b6735911eb5c8e820ba

SHA256
10b37a49bdc6686b3cc71e7347426f5f50d71da570f752e5ec0d8b47455a0b36

SHA512
20d788f96a8cb691be6181461d90300631974b88a8b791f93b591c0afbb0e4213b8c48625d53bb9c4efd72bf08325bc19936153390e505aba03b16ccc00795a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\368e6d8695dab822_0

Filesize
1KB

MD5
356d959d113ae2ac429439e6380e27d8

SHA1
6c52ee74a800fd878f91f27c9586b45b75ee9fef

SHA256
3de20ad998b0e2c5f22ca98c2faad06413a483d4a856a970913a6f750fd7ed56

SHA512
5a2a825e9bb0a87c85296511668f6b8869c052e4f858694a2d2bba43d0843bf6bd630787789dbaa2a8f7dbd2f72d510d41d74e1bc72d23626d698206f84a6d32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\37bb96de86870082_0

Filesize
8KB

MD5
ee6ba040a161dec8d7d48901eed7eac8

SHA1
4cb9348522d3c16f9fab34c29d538de3549658f9

SHA256
6668bd63efae3687fee343061d8490801536090896fc950df729c079050422f6

SHA512
675f1b7d026354748b3be84fea6c844e7f1bce77a47d4b818543962e68fd3fd5d349d64ebad47b060cd4d6e9441367bb687e65131c0cece7e12bb9f616f0cddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3b88aea3c26b8b39_0

Filesize
73KB

MD5
824ab6a9ff034e74dc36720aa01a8458

SHA1
af85cc58f53495bce450725b8952e6c027819809

SHA256
03b4141bd31ed90cde40ae2dd975ce9deec5ca248b899cce280e77a0b2716ded

SHA512
a5de7fff42fd0b1a9f48b86f3a2b45781904c15a7dccfd7285b496549eaeaf715efe5895c882fbe9b7b1445e5d4b0808f47e0c6295df9c451e47ad56b7786d3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3c0976e826452b12_0

Filesize
1KB

MD5
6fa8dfc102828f61ae1bf1dae2641983

SHA1
d7422355c1538d68b9f2bea286908baf39819d31

SHA256
7a36392d1baef392182198f0081a99836b976c1126c597624b3ab70a8435f000

SHA512
a12c160024940a559cfcb12bd75413e17bcce2d18ed19f0674881e7cef867db6bdbf837c0e97c83bb32cb04d5f5b18ef085bedb070534f377e518e4af4585325

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3d310365d097fb93_0

Filesize
2KB

MD5
8019a6ec61b90314bd485534dc48a3b6

SHA1
58308421dfb49925d48d9e930c3e4bb7ccfb3437

SHA256
43b3e7716eb5e806b5981efac07a9cd397f82920a2bd87229cd22f39623b617a

SHA512
4e11f20fce52d3977f3cad61c370ea877a3b2ebfad8be7d6a9ea7f41ae07e356836234de99a581656f0531627d747a0f1411c0e40a85877fd47832dd61bfc645

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3ee4296198224a06_0

Filesize
1KB

MD5
13456392617af9f66fbd0f5fb56507c7

SHA1
5fdf21c6f2909087493e465c8b3a0f665fa21378

SHA256
25c79b3fa4646061eaef4961c078007e7d356cd98a834c2ab81f30672e29f730

SHA512
f42e344d739960faf5cddb1b8342aef3167be99fa5eaae5eb43a5c6d9ee7b192cc89b640d3d535e1fdb416f6699b42513879d1dd29132f4e5ee0b2c5794e2499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3fce2772ba8b623b_0

Filesize
1KB

MD5
19046ae3b5873cbbd652f9f49bec8a43

SHA1
20a4179f34a419c2620b26c29079b3bd09eb57eb

SHA256
3d322fa3347b0a651ce033fd6fdf78bb8caf967241e5691cf204bf0a63e07bf0

SHA512
0825edca05fbdbbfe672d33032da8c423af1dbe9fcbec62585d40e9919b8a20264bc826b6d3b64d798f128f3f523a6bc525f5768da76a588c389b158514120ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

Filesize
1KB

MD5
1c8c536da1e09fc3ea8a15f461918cf8

SHA1
c9ac618b6c5b6dd651f9c2abb8b7dd82141a5906

SHA256
d7e6a1123f7e7734bc99e55d9fd83b138a1a084c2dee8ce886b08140bbf5931a

SHA512
08f09ba33a1b7dbe53e818ddef18fc9b8067b98b12dda2a116a1508cc79035bae5b1fbd5f66c2aefbbcc49c95362f77107c67c92f46d2f5bbec8174387ad5bfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\46d8591239c0d052_0

Filesize
3KB

MD5
079e808f38ec43ccc8af11368840c244

SHA1
2374cfb9157471393c72209038cb40f5fb094b77

SHA256
61972c0a5ce42f5f9dd04888a737672aa83b8c27ba3b314de00579c3f59f2edf

SHA512
4a0ca4ac75761e9f67560ecb11c6103afef6b552aca758b8e0ae4751367f6b3a160a8c378d59abc60a56c267153abee7178c70c018e9f16a7cac404a7b6116a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\476831ba582729ec_0

Filesize
13KB

MD5
337195367b92a2ee6e356c78a9362d2b

SHA1
7b09f0abab1f08d4d29ade3692c141764a57c22a

SHA256
53c32b2dd6bb362eff3176d06acbc2e3ffcf537162e23c4843909929fdb7a55e

SHA512
04ed515ede5f1ff3ee66cb82978737e1ac10a1ec87de9a1318b9b970cda5b14514f507d2f1c809a547a49cbeac60c11f0d9b08b1e7cbdaaa6b707418e9a6d029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\48b1105b4c2874b5_0

Filesize
1KB

MD5
555e6bad6d86015bbfdc6d5fce70275d

SHA1
9ce3ee6b4f7e2a4a0178b51a92220eb7861a43a2

SHA256
784e07e4ea78d4cf4980850311178541252e089afc049a46206de2aacf8edb32

SHA512
671b4afb21f906decb48358ac56d1b838957e104102125cc6f3f4cb6312d2170cf636bd2168df0a7b39f1cb585aee682804559c374e65c68a4e0af0627d5d252

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\49eeef473c3d7409_0

Filesize
152KB

MD5
7a1da46a84b2bd93adf623dc73630a1d

SHA1
74e474620125017810cbcc78cf56133c9b7a6b10

SHA256
f2231bc525ea66eeed7263e6c2743a1b5dd79488c190851d3db5d017f1c4d737

SHA512
1cce736435eaa95f8652acff0d92b97cc0619e7df764ef1bdda1a7202fc3c717104a7725b8e6ca295015dcf874edbd0a52d5dabf6452f94ee9c6c471cdfbfbb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4b5026a6f1fce7c2_0

Filesize
2KB

MD5
bb18224b203ca434fc2d738692a07957

SHA1
d55a2dee709869ae4a6109f39a83acab61753649

SHA256
e988f38507c847b988adab42a2259ada573cc8fd2aacf075df4f6d1a955c0187

SHA512
0d33c8b3ff671a018f4f7a1ecf8dc17a241ecd1a240a88084abe246eb2e90ad0902d4585e5dc94b783f7da53a60446eeb6e62d904f67d7c0cb7fbb432aa24416

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\52a92fe86e56ca75_0

Filesize
53KB

MD5
68eda2fb052e08f60a75fc83311ea805

SHA1
f5ea6fd2d01da2c9d5bfea177d2b8bb703f4d2ef

SHA256
e1863898e4af99d2736bdf8e179cbc6d76c831bcf30b409dc5b6fda3209ec055

SHA512
5d956c69f640d7c26bbc27868851c7363fd9614f948dfef8b3d68275ca6a1ab993ce58fbce03f4158dd177d932daa0f30eea558df94d1449e3d94fab75add9b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\534ab76442c26020_0

Filesize
39KB

MD5
8ff42e0410123e6f90790fd755dda3fc

SHA1
1d64cc836e7dd760d8d012388ec84984c3a15d94

SHA256
a1e08db7c20a67621e7f1e0b624ad1c0d38ced84f2cc181a79838daf8eb4563a

SHA512
37dfaf8add52820515c8ac528d08167108d5784d95c5d33458941fc672b1556a3b887cb529cdd28e1ce942a581e8301fe899d16ec8950f2ee095cd927568ef53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ac5abc87e80789_0

Filesize
3KB

MD5
3d000ab340675c14b4b190615c9020ee

SHA1
b10bee8af652838ef8e214a7a79916b97d4f0062

SHA256
e3a1a3ff719fcb562a5a9a862bf54354205583503a888395743ee988b86ff814

SHA512
49cec3739f1f2c3e0d4d844784fb348e57341edc85ea8e513db56ff72a4b10200da6f689ff4a99cb77c66ef1778c4cf1b3ecac66a5b350651192bfa8cb0e03dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\550530889377c4d3_0

Filesize
1KB

MD5
c0cfb7c64bbcc064dff7f42cb5b5511e

SHA1
7b19056c439ee361e7cc1fc4518d3c124366d057

SHA256
cf55aedf7f82a5cb435d9cd7d6b11b73da9cc5679583b444a73959b14789ffc4

SHA512
37db10bffd6200844d0929661dd72507248e5aeaca99b68a8c16d6756265582b135454747a42c2c9a321bf5ff5db8f5ae63a52192ffa9e4ab8c67425c0fbdac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\552e9cab9e32a74c_0

Filesize
1KB

MD5
cf1dad312f8b074d11d17ced873ef020

SHA1
4df1caa9b00f0b7c21129ae4a202b8360c3c2485

SHA256
20ebadedcbf982e3b172567e63a0623fd86c28fd04773ea875cb830d695f91b3

SHA512
0b15bca4c31c661e88bf2dacf31a4e13d05d3291ef41ad7301f45068a239cbc460448898ec2d3b05c6f4a00f1c73f8b8da7401033a9ff5f96dcad2d8cc3cca2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5801d3329fb36c59_0

Filesize
7KB

MD5
1056b2ad6badfa7a930fc8c7d4b3119a

SHA1
f0d645e3a8b986efadfd15cc5905a9803ebb329d

SHA256
9825a34d36fa3ce3ac50ea6c58fe81b22a4d5a114ae3f3f891c121dda01fe91c

SHA512
e6b81d0c2fcd5edd040947a9d0707166b428eca2bcb9311f85a520d1b60dc01c2e8f932fde48093fd315a6bc4f3e5f594e323c8b80bb8c11456f30b210479ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\580fd9376c2d4a3e_0

Filesize
9KB

MD5
2141c2432a110e8b4ead1637e74396c5

SHA1
42e18b6ebf70eba8178b500a75af9db83273f333

SHA256
8106ddcb026981c6cf22c94893350a0db78411b97f31763f5cc1e6e3a5be10aa

SHA512
0d60747b55e2b3a2c025217e0569293ca64419eaf73c98d7e0d130f35b111c67ea57c415f0e4bca6532218e14b37f760cc45e7352f38af2e9fe3c775a960949e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5a994fe24b451732_0

Filesize
15KB

MD5
3022c909205c55d2d6581ab1308ce8bd

SHA1
2283cba6357fef0de458ea21fa2d58fc2ccf718d

SHA256
5b1f5a234c68493709031085f6af8c8206bfa58d56324a1b3f811ea03b14bb6a

SHA512
88eb79e4a450eca660e94f5612299881329bb0ef07529e2b42db23984a9c6772c8882172a0b702d03773132b9c92de48792fa7b11258a71a7411d25d76a6bf2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5b0f71fcce6ad311_0

Filesize
2KB

MD5
790d4cb77304da6c2e7ceabed18fb271

SHA1
fc823dca950e4d8f9336de13e0e59cecc4bb6009

SHA256
cb51077c4c6f298bc2bbdfbd8ae776349f3e98c3c133cd36f158b83ba8cc3ecf

SHA512
ac624fef274faa9e2e504741dce9c33ab47a713c1ffc0a6e28f3b259cf48cf92747befc753f3e40ef9732c8ca81493d2e0e8f8ec8811b4efbf9e3c514f6f199a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5b115e1bea96c5ee_0

Filesize
7KB

MD5
2b091c1a674042a9c37811fc7812a371

SHA1
c043e96c16d4be45ff06cf8864739ff4e33d90b2

SHA256
c94dcbc97f0d28c04f7664e19df9891402b1c7a64c547235e844a6aa3d7ce640

SHA512
5962821ead923503eb921ee67d72430a48478d4ff7f71446787a9d9528196c27c386be6b138c05c06b2a127d1e36240a02f8c7c293cd5bb8c60fb0f7b1e38697

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5d0c04f9998369cd_0

Filesize
10KB

MD5
7f069842cea4839b44d6d6a2b6904ac7

SHA1
a741f58cde1f2978fd2e7fc43862bb593c1ede80

SHA256
3d1e028e0c2d03f6339d39d9f5b63c5df1b79376a245b7d374ba054680f03050

SHA512
3d13cbb24386fa52962d9597b456a08cefe6e518c4ad1d65c6e45cb1e0cdcbdae2604eddd97f84db21b944748b2fd26e931b6150c119bc831022b9a3df6a7cfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5dd1e579c9681f95_0

Filesize
2KB

MD5
86d540de4950a3491e6e7538b405e3cd

SHA1
39ad91b9a2e1828a8e216eca293518886c551b70

SHA256
2381c3490603771fc63662d27ee163c38a359ae874a09d314eedd6790f26a35d

SHA512
29151ce7fc3a5535438fd86725f48a1c9d174b31a9e187e4c9835bc3979aa18705fba1b317b03348691888304797ffeca69ccf88c50c1cdca805dc8b873f58f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5de9f44e801f6134_0

Filesize
12KB

MD5
188edcbdcc0be2b7a19e27f5d349cf08

SHA1
8030795ea4394b0a3651a7b4b17371adcc1b3f68

SHA256
d0de57ced2eedae79d4e97444aab0a7a550e062dfd5ea57765f457bcdf95bb5b

SHA512
9fdca96932ea3b8786cfd08e9bd9ebdf19b80e1111505b358f7cb170e38402c6e5e78d2394bde173f85b322bba547cc18436496de87c86865f2da32333253ed4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\605167868572c6c4_0

Filesize
38KB

MD5
95dc8db59c20bdb375d788dc19bb7407

SHA1
7dac5fe57a08a07c223c7493cb88a26dcc9092ab

SHA256
83ec251f24d38e5b51810f61369c675b2fa3205a69028dc29aff4edee4bbc49f

SHA512
348fdd321de314fc4ebc73030726e3d3597a6c91ce48ce7b5a72a29cf693a5feba93746721b706b7ba8da246661ab135995e9c52a7a52fbded8e761ac93fa552

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\635e64b37935c888_0

Filesize
1KB

MD5
bd088909cee9d25f15426611227d9006

SHA1
55787f17214d947f031736344fee4f24e74241a9

SHA256
f84245ba650a79710b7ed4597bb542677528d630943b00da39314045cab1e28e

SHA512
fdcc35bf1d6ba23a224586d741ffa944d740c2a99f8e1cb05bcea33425f2b14fdbbb74362cf543b415e95d7c4b0943c104cfd984ef367ebc898ae44a98cfe8f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6371abd4de1ed606_0

Filesize
1KB

MD5
4d272bcbd17af9209765f7bcfe555e25

SHA1
35e2f03ab6f48d818d7c29441548f0d4bc88455c

SHA256
252c264e30bff5ef6bbbdc8a1bf9f619731376ab53f1a12f20b65a35cee73d9f

SHA512
af43cf6dce3d3f6923c20dcc4d1ef8a7b9beb21d0d674cf08aa2c510056395edd0c7c0dfb1841254981d95edcb0f1898c4d141957444c42546a8298b52faf242

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\63b0eac39b1841fa_0

Filesize
175KB

MD5
a1e5f4f70b3ab80033b2e8914c5881a2

SHA1
ad481b17ebd095b7d7f193ccfe465182759da51d

SHA256
0738ce364d554eebe7917b69f8c05c3b2e8a1fe8b041c354e1f08dfaafd0556c

SHA512
f02a9fb1a04b8d4f37df14108c3c0c0e7720f4bdd1b19ad6539103280eb026260c7a16145ea5035165032caaad824e6afa2cba1f66a795f1934f7cf5e7b00802

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\63bab61298dfac24_0

Filesize
27KB

MD5
f601ba9258b1068e26ebaf5af5b3ceb1

SHA1
57096a7ec429739d689cdfb2eb4f3fc224bc429d

SHA256
be377c7ce2b4b6a1c7ff6ed68b6d15ae76396a2c1949300e206faf306c2a8e17

SHA512
4e256a54b30266b0653358eea5e0d98e062da465284e2365df9d6a40c00f975e9915b89de94a12459fa381719d15375e963877fdd8988f83716040d610987998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\65029c17e720c1c5_0

Filesize
1022B

MD5
65b62b762bc1b1125b29b3dfb479cc89

SHA1
4963d28656d8e17b35c78994e4c0d85d93421cbb

SHA256
bea22179cecbc8a2272b05f40852925ae11697441d274ebb4ba31978df196190

SHA512
c1082cb4ebbc2048f22de36da65be1d10f8bd5dc3c95b6dbedecb36789425b253e668c5ac80408cd8695bb9f3033e72b5e612cffdd64d2bea5a4dc5a0f3a75b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6a26de030ab5c02f_0

Filesize
21KB

MD5
501b6556e495b1ef41de482c178b971a

SHA1
dd702790d50f8d68ec86786fc14e9f8a036397a0

SHA256
118e68534767cb95af03b8631e204ba929db6e44e5ae504c5db9ae44bfdeb25a

SHA512
d1ca5ea9a88764fb249d969b13b09b28f46e48884626c2445c6da75600a3c4ed61051dd474e8acbdf2db5bcb6de6e7bb0e2e0637a0f9fc38b2018d94c715c215

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6aa9a2943612cce1_0

Filesize
3KB

MD5
ebe8f34d628fb1f9ceb27b372377eeb5

SHA1
953f5d70e4c4c391bc66fbfbc01aca3d9227bda9

SHA256
116a53265fe51d08725f406b27481d307f563fc467b111e967570947379a4666

SHA512
cc8fed02d514a501e634047bf475742557a5a106cde7ec7c09321df1b2bfad8f38eed9d5c528e6e974bb2e79930e82a088e9812598e008bad9fe6894d730e6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6b7644cb858ee390_0

Filesize
3KB

MD5
9d81fb0d947b5d1d959cf2fcd02f7e32

SHA1
e9a4878dccb5ef14ca4045fd0accb4b5b7c2c3aa

SHA256
fa8a70e02f39b995f9914e63a2677b6bb13846cc64f010a0536393208f7d04e7

SHA512
b2d29facd1d3397aa22d8b3eba485f7d6b5f8e3cff22de48f4c28a3234eb26b657db199c019eb85235aaaddf5c51ee3a617773d4fd8f439886586c91158c3b76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6bc6664cc6cb1de4_0

Filesize
25KB

MD5
5356647f841dd515bfd929b19108d5c4

SHA1
84064fd8eb64a229d82eed2630e3b78fb8680e65

SHA256
76f4cc5f4790938d60257bdb5a78ba29554123ce98b8b4f744b0e60493c15e6b

SHA512
e7de07b48096df92b9c93d1ea3aef796d1fa789dc1dfe2745752f1321aaf35d5f5079dd73cee13fb4d6402e3bf5286b008b6943f00761bc14b4857dbaed19d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6d3b0ad57bdf7db9_0

Filesize
1KB

MD5
ec1e2c9668b6cc11a9aab586db8cadb4

SHA1
98e559ad45c58cc65063b1204578bf6acebb139e

SHA256
6c4f477488fc09a3eaf6b8f6c537579c8f3791b7a1fff4b4c704be0bc6d5a4f2

SHA512
d118a82454353a469d5a882c68bb16c0894d69a1ee0be8dd3d653c2a4a0df7a075e448fe7c74f9b3e699562d81c7ce831be3dffea992cfb92cd165207ea3b5cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6dac06d87b633d78_0

Filesize
1KB

MD5
b955d1208b1065dd3aef035f84d1f721

SHA1
386facff1494f4e9b56005fc1f147f1a25f81d65

SHA256
13e0274aae85fd1a6ba4c2a0b18ffc0f81ef06ee89277e02ce9f1a0222736cc4

SHA512
0398cac573e0a8e57567c3361a2074a7e66b8dc7f56cfdb1e88445473c0553c8d36541d8dea3e4d142a036853ae67604de93f0ef3ad71bd657390a1449d428a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6e1427d19ff38087_0

Filesize
3KB

MD5
d67e29c27c7d07bb68722d5e3439b792

SHA1
5278b5231d2bd17981697d97139dc2dcfe63b6a5

SHA256
25c6b5429a197a176086c4889d4bd30d430a4bb9f6a41c1af13ffce2f65b777e

SHA512
47fcc1a95b5d59d90fee6ad319aa644a653e2440bfeab8367da19919a81e17c083d8aef2bfb447ac2c01a4d54c3b2ac788d8e95c730c5c433bcb43557199a08b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\718aba49c9504085_0

Filesize
7KB

MD5
5adf4c76ab3cff6493dbdc81cfa18052

SHA1
e59ad285226bcd20f2734bd9c41da52ddbc2b380

SHA256
510fd3cde3d5a75fab8cbcfedda796b2e8b816407946ec7b93d5136727854a1f

SHA512
99be83b7a46d163b9c5e49b3dbbb1947f3b32d0a0081bc59cea1cfb63ee5bfd4bea5757423a00a151b6426dc9dc3a9744a4c59edfae62628586fbb02787b52cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\72079ac2309c9dbe_0

Filesize
1KB

MD5
5f51ffbaef2161ca1e149bc652a62cf7

SHA1
27adace1f409d8792cb1192542a86a3c23d83c59

SHA256
1fd366971b7ad12feaf393e92fc5adf9b543ebc7e3579b85da046e1934d86d64

SHA512
89bac132877ebe3ba9871914f564bcdf59e40ccff0db3789579705af7b38feb0c69dc7b703fde83fa2298e1278c1809cdff7a1ff2e0b6e2b0e2c1b7c9dbcfad5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74a6ca90dc8a6040_0

Filesize
14KB

MD5
b1614ebf8ab83c5a7beb2151696d309e

SHA1
d66c6e94a415a2abf22eb4f88cd9acf8a36e3c79

SHA256
a96f03edbb6d2c23de00eec3bbe511c3533fdd676add123285e9739dab942b1d

SHA512
f418a88677213ad2c2ff8a8c74e2c2d74d20b2a282203fbc7e8e52042955830c7a691f1c8acc66866d8d5cd98d166a2e497250ccc0f7b410013abf69333e6996

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74b88724f60b0383_0

Filesize
2KB

MD5
5ae2c0c41e8134bbc18cd97c8e280611

SHA1
afff217e51e171918f6f3c30c4762f794812d7cb

SHA256
510d369dd9cbed4f6fb970dcca3b995d6d17b9af53bc03661fb1d939af8cf26d

SHA512
931bd923bc8ca76dcd53e7e99c6f04fe773a63574ecc0c930310feee76bf1cfa0d3c7bafbc326f452e4fb891e68e0f8c0763bc41e9aaf157f9add66f6739a7bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74c4a22c9167daea_0

Filesize
1KB

MD5
d2ab5add9ed425d488afea149dc367c0

SHA1
93bfa15f18f0a527fa767519739666393db9c6f2

SHA256
c19617de2317bbcdbf43eb62d248984e1045b4b9d52f592b1ea29e31f00f27f1

SHA512
24f0e648d2f6ec55727d4e777ebefca7273e20b02b4b261cee1fe1f872d6c24cc856859bade32b3398aecaa560485b42c94b5ebc76a40dfdc143e778bd31e0c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7899d2b49a9daab3_0

Filesize
262B

MD5
808e16378953d2e22f0e482085a46a33

SHA1
b222a01f11216cf9d7a42bb5f08d0c58505624b2

SHA256
466fb3b6de04ba39d65e4f545fd3985a44f13b5fa0e0da6b18155dfda70a9379

SHA512
6c1cda8cbdc0838e35f88b081ab43e49aa52a080085aa78951781293b8a3777604cb2c862a68b8b0a322717354d57dd280d65da589fd22af2415eba800d064dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7995e840ca44f32f_0

Filesize
4KB

MD5
6d2f09efa0221ab226e903b72d1be114

SHA1
d8b47c82d42da654f5eaab48af8840950a76394a

SHA256
c8c78a9cb331c8861448044d5f51e41e75a1f64473c503b00926c94a6c3212e7

SHA512
0d14a13fb1a5046d1bd1ea94325bf6c3d83c83c9c9a52cb3b8952fa149ad5a6813861650a566d3c58dd9e738ec96b6bf7e70cd71020efe50aabb0de487873c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7a66a1246c4f29f4_0

Filesize
12KB

MD5
3514de3473feffdd0faa14a0b85fdc42

SHA1
bedbe2e7a8baa823776379e343aa843c5b6772d0

SHA256
bf02555c1b7b9e50590c227ca2014d07aa2e9ffec61772493ed9c04dfd33f586

SHA512
7cf193e40f4045d719f40adbb9e8d1e556c5e4c016394b35a1d12e69320eaf2a079d694023df4bf2cf11c12149793520f3531daec5cd29d798c83933d3e0363f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7cf9843337c39c04_0

Filesize
2KB

MD5
b686a3e48c619f90f01770a418bc2c2e

SHA1
e19494338ca5623cf739fa6fc093372c050f5a6d

SHA256
ee4d4490b3b724b700cdd89fec8ff679a714b799ef37847c7b282d576a38d70a

SHA512
2b18b7a212b93bac9bf2bebf3724118f368bbf129bcb32fa276b46991fa9f7d79dd4d4e861752900b5261fe4b3cb342decbb2dde371b4bd9ca9ecdef270fd8f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7fe85d7249e8dc55_0

Filesize
1KB

MD5
242872dd99739ecee6fdd1b1943fbaaa

SHA1
2aebe295c408af2660b64088c5660e16ccab0c5b

SHA256
ba4842407342a5045624ca806c4ce86e58657d5dab6cb184e5a0ca9314f6ece4

SHA512
f8d9a4b1e75332dda4ebc310a972aabbb250a0064442cc3aa2f0b347b06071b4346626d02d1d14976d93a9fa95f39de4571291b38520a4c133ca1ac9b257438e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\81764cdb356c9506_0

Filesize
6KB

MD5
e2022b7c53f875a7cccc834ae20391f0

SHA1
d6d2bd681d08f4bfa1f75974806c6004a99db54c

SHA256
af1b328b199f3c3bd1f57d0d1ffda1fec4baa687200a826a72aa4f7379eed1ee

SHA512
2a14eeabf7ea103edeaed8079fdb4544923a7e1d9bd887c03f1a77ffabc79e02ea7d83210c1827154d6033cb0af720fe82ffea95e7406e6dbc6106ba26d715f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\81be90bc46eff1e8_0

Filesize
12KB

MD5
ca10b8a6c001841423480622b7efeed1

SHA1
9eef3fea0b2bc78610c01ed927c7011d4013b589

SHA256
b443a73c81b380d9f46a14bcdf0bfd610fcfd3fd2a6844665d93360e507b91cd

SHA512
af653be681b371df091f51c3cf659636de63f7dfc6343b800e12eed3f8d1302297df96cfff0493ad2a5cb3042189c54134c43188b7eab331a127ce3037b64ec7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\83d6d3a772bbc707_0

Filesize
6KB

MD5
baaa1f4e25abcc0ec5c109cdaf3356e3

SHA1
db37c7e804526fb1938eb6ca94557e9c025a89ce

SHA256
e4dc2a77f168fdfaf28bba05f05db794f9f9618e40ca73f8423483e15c29e154

SHA512
fd7ffa93c548556b245a352f781d2f85a681e3dfbec238b84f1446752c37eccea14cef67e0e9ec141a37362d20cf11c06a4fd9e72d0151afa93a54bb2fb97fa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\83d923e02fb02d0e_0

Filesize
2KB

MD5
cc995a0894729ab3ac123ea6732a98d3

SHA1
41df00ce4d8e6eff007a9891b1fe87c3c28cdaeb

SHA256
db88f2c22a1ca2a2c3b947ec61745328d12ed27a02f6f4f1a69ecde4fa8b5f7b

SHA512
831e6eeff1b5fb4f9804921d7995f15c909a4f090279cc3cde8406399b0bb5afea0329b8a63ccb62f22ec11cf34ffbcbb794c695b169749882f48065c878a564

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\87bfea9426cb2ef3_0

Filesize
10KB

MD5
1e47d418d6874fc960ac061d7e55cfde

SHA1
c0f4f6dc7144046b9c45d9b8b1148f72f32e75df

SHA256
cc6db6e32868feb24120b70271d6031c49708bbc67bd1da4eeac42a937a30319

SHA512
f780a822e0a0467255994cdf2364288fa13e074ec5ec6498267446adffc59f8ba705f5a026d023cf68e2319568a3110941bf145b4853cdf278dca0e265fd0676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\88959886ada0ac83_0

Filesize
1KB

MD5
7ba590126f3c315ebfbbfb74757eb15b

SHA1
b1737e1e3b863a167dce0a452d881f6aab9c651f

SHA256
b73d58412e9186716da90f1e272803c27ab5cb981f8e6ebfc037f15f708f28e1

SHA512
87aa26ca7c572ce1d8e811fded597b46bea46d7240a172fb414a649b61c4e90a87116e02276958a1b72f8ebfc99e2b71c99f3f5876832509df7d43ff5e5c3170

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8908012b8e4a5af1_0

Filesize
11KB

MD5
4fca8ea5078c0be9cbf82400bbac8988

SHA1
1aeb903e7d4232cb2b4cebd6e26465311d961596

SHA256
8f62b58ebcbef71ac0d5bc9b0935cbf576f9921b553ca502896bc02cb642e9eb

SHA512
f942ef7390180ff491435c9369e22b1385363344ca6caee83453a7677c9a35bb72529267c3b6b8988b6020b756e2e16a2470522ea57f140293f4937e67388023

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\89e53e805c801dd3_0

Filesize
3KB

MD5
8b99669551793a7bc3b80336d3c4e787

SHA1
b3de9572e99bf21998d90931f9a774c750baa041

SHA256
41ec499e912aba57de90304f761eceddb9147bd792ee81e18d3f044ba8f9f4e3

SHA512
4deddc65a39a792087251853956f269b9b56b219ea7cc2f36f9c4cfdbd1cc329f92b5496bd087d3884846e3a0c30c0bdde3d6746479ccd31baefacb7f4415e37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8aa3a2758ee14c11_0

Filesize
1KB

MD5
58c4172d9d9f9c76661f85c74cecefa2

SHA1
fa650144e325b91123966aea3850bfad9e1f0ed1

SHA256
d8da8ea93621624f5716df3342ce75cbd19b9f6560de28d66b6dd17cd1e1f93b

SHA512
e26374ee40e6efe55fec8605b6d05b1a4fac6fb06c04a3dd56920c8ffe0460d01dd802c5c150626512e4741b6a71bf0eff970e14f8b09276ae48f5af2668ec6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8e5987d08f7b6e11_0

Filesize
1KB

MD5
2282aa6259e7eeed7810810ef4462558

SHA1
7ac9e2148d1d3ae319c4631c808c7a559e8e7e68

SHA256
3fd191ec487ef9a80b251bf96009883c8f924fda6cf12b1a1f26f73095bb2c12

SHA512
bd72d35d4bee0822508cc3db0af1f0bfe536c64e6911a46c09085abb109bbbdc328403def29425c04002d6f7c7f2d01953097da4dd1d4bc58d6761f2f2d8322f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8eaeda4dc7af93fb_0

Filesize
1KB

MD5
0d2a2792ca86cbd6746d3ec7edd4b4b7

SHA1
32c20ff4738611ee0ea48177da06f08a16794a78

SHA256
bac12de9ed70a182725f0b8935697c5701bd5804474e3516be6ee25fb9b65a54

SHA512
22e821e3725ef31e80df3dc88a45fc88957458eb5823f3f0169587e138a183e5f8953d0695b124502e3764678a6273667b45fe26b31441637fdd0dda8a64a652

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8ec4b11de0b23393_0

Filesize
9KB

MD5
d8723562fa8ec472434145059b9da4cb

SHA1
d07103dced63cc58cf569997741d7259dbcc1a33

SHA256
6a293e4bac9fd15bc0bd92fbddc6c9baa16a3ac3e552b424a1ec65f8e75d21af

SHA512
90a36dbd14531845050217b315c9297adf7772d205a66a06957e2345fba0e9e80e0ed5b4cf849977a252d8641008fea6e8400fceb7a9a210f320d7a37c65242b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8ee73a31bd0cce7d_0

Filesize
21KB

MD5
e5a1d54e87fc316084942d83b47ea904

SHA1
07aba83908e930ce908b6688bebcd9f39c49aa75

SHA256
db90cb863e9a0799445c4b71683ef539ff5168991e12fe4a77377241eb2e2fb2

SHA512
a0309d9685f80793bbef22b92a4d282ebd0faafb459a6fbc7f3948c69aaa4b6e910ae65892f12d532c245719f5c0417d4d4b08128a780b848cd333302f0fa019

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\90902f35e6384078_0

Filesize
1KB

MD5
25ac68158ea57c240c0c43cd5b5108d0

SHA1
5cdf13baf7f9b536702034a9828e25d8008b4c1a

SHA256
24ff3585b8b6ad248875c600cf9f28d08a2436a0505e41305e25d65186acdd75

SHA512
f41f68bf8114727af4fede0ad0f9bed00e740b5cb1ab6ca176492c6ab0619edd29f6cbc5172a938f73d27d771123c49d2037c11171cb882b6a6ac7544d4a21c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9412c8b664751f90_0

Filesize
2KB

MD5
bddcad7a282728b48222e8faebbedfc5

SHA1
29b0b7d68139db48ef06bb15701e857860fae07b

SHA256
6d115d26ffb01cc48299e569be37026dec61cea0bc9ff316b1616fab150911f6

SHA512
4b8d4a1aafee29ee9c9645d6263641cc50d241a6d08551a2be0501ff2a178147a628907f48adc8f35c1ef324647e52d59678689902d9b4ce5af5893f65ec77ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\950822ca8a0f3b0d_0

Filesize
2KB

MD5
aa70a17354778834236883e5e7434c8f

SHA1
dc7778f3e7f4fd3a49446f3c9a27a4006df87364

SHA256
2f49db4136bcf2be4c547e2854f738254733e9897e7f9372810511aec6d34572

SHA512
43fbb9d7f11fcc223d96a36d0f7b298452969e87cc893181eb0897618240ba989fd87245efbf8f98f0a510db93d6d8b8ae5f3192846e65622b762831ef5dc993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\951674a2601a33d9_0

Filesize
1KB

MD5
0ad2b200572f928e60ae135da9a6a06b

SHA1
82c9b03093f7e03e197a75a448406df97ffb6cd9

SHA256
b7d18ce5282f26934f5ed27b5741eac58f303940e9c82718afcc5997778e3e6b

SHA512
40bee45e8f0bd716c61ef0c90a970f6dc19e69112971dc4e657948f40668ec7e0c38a2a2da369eae94837d32facdc6e8499817cb3c41ecd3db5c7f85801450df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9981b5a812466fce_0

Filesize
16KB

MD5
23275d7f95e153b20829ff71030e0662

SHA1
9e2e8e977efa4a768a57d7ab3f439c83fdbce500

SHA256
1d81d076f1543a959be85d52925e408bc635851e65aceed306f8cdf32118b8fa

SHA512
25a920bd738cb86eb353c23b498cba8c9efc6e18864519f596ff3b6a3c6b06a788a593ff0daf14c9320f0c68f0f35ed35ec6ff08eb672fd3e79aeaaacafb6cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9a267665648440b9_0

Filesize
8KB

MD5
c0908b760b41105050c366650e32ed27

SHA1
14eeca4fe5b9134a405214193b03393b2bde3ed4

SHA256
e642a6a1f23f60ec0f4c033da8f701f84c6391f7f5d301c2ff3e73799e6b07d7

SHA512
4c2036678a711b1433c51c96be223a5ef5535101371a1dfb960437ded92bdc4437f2898165297f76a1c68f798e9e595f10f730416be320c0f2e43588d720cd3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9a93a5af80c0c9ac_0

Filesize
2KB

MD5
282b21e45833bc665bcaa33385fb45f3

SHA1
948bf3d7fff61f677ccb75ba5214ba5e56495624

SHA256
d2558afc1a074087eef86b0fcd17137d11a951909ea39f9b74e11474a4891e7f

SHA512
860f026cb450b81e672ee7213eb560d66b79472fd060eae56e8e0105b4b11bbd6836d9426ddeae197f381c98af766302213b70a1d5b6f02a8fb0b53b046b5e2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9b7af585498413d0_0

Filesize
5KB

MD5
187ca2ba26ccc4c8a3338b21eb5c4b72

SHA1
551959d89b2f6233932d58185bfcc3cd9bfb1c15

SHA256
8ca1bd5b338a95717ee77aabc31212693ba6868da83fd690141a32aa6d11fd37

SHA512
177f7192007c71c3fafa40ff4d8689b43fbe38375b855b66ce704de8640860ed00bb35f4d1ce4c4698f13d42935b38c336d7c21013437eadeffb8481ab3d832b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9dbb949d27873cbc_0

Filesize
3KB

MD5
c03a84b9669865a1f027abb60d60e9b1

SHA1
0af5b323d2a707f6f363f1f034849073b2352a33

SHA256
b111f98c1b9a4449cd4898735929c70c90925da58da49f3a6529a0316c34066d

SHA512
41a6455c03e98859acf92322738393f9953e5d7b40587642a398c197b5e149058e8f7f75f032885a46e6a105a4cb915ef402dc56d889fc7276dc28ba3d3b8c18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a02df7c313f59d27_0

Filesize
2KB

MD5
dccb9671c4a4917e19c557f65f12118d

SHA1
8d798035b1b8423a3689ee4a0fdfdbc25af74c70

SHA256
2dcaff731a4d14574c8255c5c76bb238f68fa42fe4c23bed5fa9706574efde03

SHA512
f76559199bcbcf2bc1213eb0a0b710d6bb9b94e3e87de0d97c4439f605700fcdf9403fe19f985b4a3b2616e35f135124bd06412d3b6ff797de140d7afe0437ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a09f6271ad0c4092_0

Filesize
48KB

MD5
1e37c701b1a9c79a5a042a784627eb00

SHA1
5a21db63d8598a4ca301228020aa2b1cc5abd7d8

SHA256
f1b077957007f4630f12330d76cb4a38e1fbffc6a4cc678a276c35eb57af70c0

SHA512
bd78d1844c601e75091c632c15056733b072c7b4ccfab3c192fe74bc17ab7107b9157fdaa7a6351636241d93b9f441b0d4251bdace7393f293cd8df83db6f569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a267b7c21d8b8c9c_0

Filesize
13KB

MD5
55024349cb64352caf443461e0e44af0

SHA1
d0d5673afa2b97d433d8ae48523c661ed15e88e9

SHA256
c3c6c79bea9cc6142c4ce0459a324b8ceed87b773a9d02035e5678dfaf65cf90

SHA512
e8f7196fd7234f0e2b8c5b7df0eab87c5c1246af356018b26e9b2e47ac6589b8eada8f30602992702736d903dbc253a03ec2af179e18c73272cc4bf59175d51e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a67769912ffcf13f_0

Filesize
12KB

MD5
2632b1435b75593876740b42da323710

SHA1
1c4a982307d7cf35b026eb169418b5ccc4739d8e

SHA256
d9c111fc68e735d12fe166e85a636e9780944b24fea2b6ac18d7c7b44404b627

SHA512
4978ef641b4d2c75a5e0175b9c7e29565a855064e487914acd801413e718d05cb7a480ffaccbe0e7f123c7dbc800851ba499ccd3f9497d9853e9084bacf85379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a68c55940f346823_0

Filesize
29KB

MD5
929c6ed8ca6cc5943856149a3dd8df3f

SHA1
b2e46173ce0555aaa54eeb9f7534f1a0ff38410d

SHA256
730796db9bc85496d257e55cdc7c622c59b3f9d5f7ca3420997399e8f65482b2

SHA512
cf7aa115b3659ff561ac78106a59b7f22953563ca3c0bacc8ad9e20ab7c05e47ae5e4183db6b2e4389e416c623e44b38355517507061394a5b1aab86850915c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a98be47e3f606fc4_0

Filesize
2KB

MD5
55ee5f7435d0260fa369856189db90d1

SHA1
a93a91e0fea36a1f1f2074ff212f64731e2463be

SHA256
a6db580c406bfac6a495baf79f32397350b3a25f25eb3a158553aec683f7c732

SHA512
407efe497365b927b63281b03451dcd7fa0cd828e9b2ed8708de70e84d4dd718d08fbabed4101af4cae2c9f3f28c357381ff181366ceddae82a7538d7d1ac51f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aa02dba0120a0392_0

Filesize
3KB

MD5
379f88c7b2232da2f5169ad6cd222a2b

SHA1
d0bc8a202c5c3bba6b76912b0610bed5da35312b

SHA256
f2f82971e8544de3ea72f9aa7580a15ba64690aa1d3642a981966e85dcf8a25b

SHA512
7df8f5663b7b5311fa8a812f4329e083c2d32073fd593fc13b4bac4a8ef31b83f06e789c9558f4426155bb9a7bd0f09d61c2413703dc8c7369b140954e6db478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aa22ed8fc94af805_0

Filesize
11KB

MD5
293e2951dd188790bd46467a3fd469f0

SHA1
f59ffb78941b289f6469c699c2751968eb231dc0

SHA256
a3540a4e885d7b61492ab454a3138bb7ec4ae3978e24477b83ebd6eab86d6c78

SHA512
08d598a8ab0a6cd848cc96e3c7a295868d316ea3eab9218f5e1c4a1de17f322512a4d539fa1d43f5bab86488bc5ad9f5a573127a92243b6e370a564320f4b3cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aa5fe3b36e22e31b_0

Filesize
3KB

MD5
872bd053f3f28b6bd92203118c6ff841

SHA1
65424330c2675541c1c723ccdb6362563a165125

SHA256
336d66c7a0d52ca14dd4fbb4f863489ce0427982115446e2d365565d21d6c4ac

SHA512
7f4bf0c2d4d1fd8d892a1c13b8ef9ea2ff93b3a3b410d100340f3ff7d167ad2b1a600ab4ee02444f84075f6458cac719ac9ffacf80c94b64cba5a6a5d6ee18fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ad3da63b93fca116_0

Filesize
1KB

MD5
580b4bedfbee535e209bc930a372b272

SHA1
a79b4957ea8ac505a666d2529db7acb064cc2118

SHA256
13b94ae098bcd6fbd6a67ad2b89626685fb6a22f01cf9741ff32ff6dac91b42a

SHA512
d92b00441f214fff6b0af407d33ba581299aebff3f6b44fea680427e105f9ad6f22ce554f42ddf7e778fe1422b2051f7c681dfeda0ae76289b8d80cbc2e9c1e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b2311e0d6ecf644e_0

Filesize
1KB

MD5
a0519a1b07ecae318265fbb991392439

SHA1
9e2c8f51cc095320cb0a660764a12517089724ff

SHA256
b11960dd12721172d0b8e74c6d0ca56501828a0dacc169d8c7da71ace6e85956

SHA512
035d89c62ae71bef43772a4d6cb6df2f10cc5ce7dd6397112b9bdd581adfdaa7442bc0ebe1da2dd263158f4a9a043b52d59876e76c745f4fd8f86734360cffea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ba872977e7eafed0_0

Filesize
1KB

MD5
0fd197163da90727f765dfe4996d844d

SHA1
918a0ddba343d2150a5db9d398ea5b4b47125f96

SHA256
fc9560b169700c6373ff3e5fdcb5f34b7300740fc78d266963aa5dc72f103e8d

SHA512
5c2de3fa71804b87350ecb96c9c0ee5d69afe952360ebf6a00c079e9864b46612237cd977429a94a89c26e9954bdda80929bcbf678d07834f3eb1b9f433c0633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bdd8a4f7267aaf50_0

Filesize
2KB

MD5
8973ae325d83e0fe45190170f7797503

SHA1
3d01adace27b34bf998c1100b0ec8696abe656e2

SHA256
afb3a2b24a1e51ac27a6e39c7fc533ae626a85591239354375cf361f84024140

SHA512
f1a6f07ef7e81fb82e084012c4a15aee0f83d715493749ba2f5ab61ff14d7684c7423e0def1ae3cd0959a6c7a65b2d94ddb25ff9b45a165b1d43f42e6183d145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bf2179c1073e87f5_0

Filesize
1KB

MD5
f74032c5cd9e62a1d15e7e756b1b879f

SHA1
a2a80d311057a5050d361f3fc6994d003f0c5536

SHA256
586a75fe6d0e6eea58f9842eb534d7a2042e32a2960194049d52ee87adc6f725

SHA512
23ab0d70d25811c4b2c691ec50c3f632292d270b3d7411f039c78fc4f426d18bf23e35e0f370d53aee7a2c64dba555241fb6f20a9467fc0e390207a2c88ff704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c09016419eda93ac_0

Filesize
1KB

MD5
2b729bd3f4c719604b41fd04817665dc

SHA1
983bd7bcd50eefb0ed467dba2810d7c7cbc77835

SHA256
653a3799b87079514d50adb754c16c518522b48e3602d2435d0bb0a354d955bf

SHA512
2514328c49d928adcd78cc70c1136cf375b3aef027f6c15ea1733decd914090dfe91d7883d10d71b2d474b2cad0eb33b6d5f1216d0093403302d1695a95e9512

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c37586a6bc341b9e_0

Filesize
2KB

MD5
e6f9f6bd55214121766b71cf708a4cf6

SHA1
032061f2aee687305e815f58b3e3ec96db0317fa

SHA256
89f8c6494433bb7566cb66a77e620ecfbc17165ae3ef770e4d7f74c7a951405d

SHA512
b67f449d03565d5ceabbf69f3ebe95a6bfa297195f86ffdb5dc109e126ec6fd29a4495a038460c41ce3639227d1c3bdd868ce7f37483c3c6e780798007cd819d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c4f2da4e4b4dba36_0

Filesize
35KB

MD5
e281052ceeb713b60162c603090ad32c

SHA1
e45740dc0da6bfc94725c6e9e732dfc755cabe3d

SHA256
e5fe22079ef3e2c396142d0045759727350deb584c4e4f474eacca306273b4b1

SHA512
f346fb109ea4f40dd07c41a3e64febf289454eadc865d2247656bd1d1a203926666fd533efb62e3ea56f22658d1d217d23ceac8a313e9c4a03124a0dd69cf8b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c5bcdf5c0c582076_0

Filesize
1KB

MD5
52e5a25595fdc231796d714214d480a2

SHA1
b2bec31094b633373cbba108065b7390fe695b1a

SHA256
04e547f57c725b6874b9e38582a30c0520f994967edcb6d0b31fadd8eda45c23

SHA512
a02dd7d15e273807f9c8742df8072e23472cef83c6d54a89398001481e16526f00c8cbe3c8c3a841dbfb7e8c2a1365c6c56fbd6a958d012fc1d7bfdd65d4d97e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c846ec194d8fe574_0

Filesize
1KB

MD5
883164b689cef9f8f174681248a836e2

SHA1
83b058497ce97c0148efc6b46403a8b54976e813

SHA256
e77f46cba38fe1f80f967e73035d2b9f4cb25e8504990dc35b808ea6d87a48dd

SHA512
b08b73e296169b06985f09f73043763afde51c626b0239e438a462466cac8249f356308b31fb4b927338029a625dcf1984a888883e596a1b49d9513a193fe36e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ca5bb3c84b908d6e_0

Filesize
3KB

MD5
f82704585feaa7e06c0f24c36e795bff

SHA1
9c82da9bd5c6ab9cbbd0c20eb33a5c0386f5ff55

SHA256
2ee44702bf227f83b73011391a6733dcc698525650f8699b661720129dc0d523

SHA512
ae7433cb96b69ee90d76a1fccd07a3e835794981a5f741ac801508aec90448dfb1b4f1434fec1d38b0ecb33cf16c12693fd0c2c65d5d5d15502d12d75aeb666d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cbd0b8d2e4928abe_0

Filesize
291KB

MD5
62921ff13bdf9ee101000cb1e7e8b7d1

SHA1
a91a8f9e33dfd4fc8248696c0822e4550f1d5f33

SHA256
f337ae92fa60bdd9e1f6f60adf9c6edc65eddd889758d4b6591a8a3333620c0c

SHA512
221b4f2bbb48d12a1549bad733ab6f7ca773e09a1ff86c3986c351a349d6d829ae3ef9d8ecebdbb04f531c946cf8756f0970b5f612a2c84b6674ee7713baa489

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cc2f0fedd3e9608a_0

Filesize
3KB

MD5
c4d9abd7e37cdf6a9d5e1539964cec87

SHA1
34642a277a2bc3a4d527bd2960ca032ad9d184ff

SHA256
98e5468836a62815ce075621b845a2772636a5ed81e11bc7e3991f1c635f9368

SHA512
474984972fe5e7e6f9185decac7d294f59e38fc76555ee529ae21c8b1d0a3dbbc63d3e5454f934166e549a687c9accb0fee1d4f87a0c3a6ec72c9d6a9c48cc75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cf93877435dd915c_0

Filesize
5KB

MD5
104ec8f738681503c87daa423ecd8d5b

SHA1
0e6dfa6b4c3dbc97df30c57c470188efc990f139

SHA256
fad6907d666f48388ac3d845fd8f5b5eff97a970445ce1651d4ba1fd3f94bf73

SHA512
fa337826e503016ab9ff436aa0cb92b3e61ac4c9a07599b110b5ad69a13905cd671d86d91c314671c6a5856f70b617f97ef4692615af9f2db52f6ecef1abae56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d13dcd90e0ecee81_0

Filesize
1KB

MD5
030cb4b190865abaec7bf19df2e524c9

SHA1
036baa09ecf91792030f3c43be50011a7f9a3528

SHA256
a879950f0a53b5d9e4cf0a136be8d50492d19bd853a3211d222c5ffc4ec3d74c

SHA512
705e5beb0d8578a60194265ea48601b1a95580cfd2368a71b19d8af0d22d0d1f7bc03c97fa38f8bff4a1a00a762da663d504b2c27476c7d576aa4dde37252bd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d3dbb3008455b523_0

Filesize
262B

MD5
06bd54b614b7430ecaf9f3e8aa9379c8

SHA1
622e56dcc17f5f3afe0861fc9a3d4b09c7f5462f

SHA256
53b3005ac4d847b5516b1ef39e1512a9439b82c980b4f12909bd19d2deea421f

SHA512
f9226163aee309413daa73f934537d6e0fe192e0aa07a15e54996950dbb65d55d0c8e6f5fdbd32aaa8bdc9555ff7357c1f14fcf9dfa3387eb2fd2ed798c317d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d4031cebe9939020_0

Filesize
20KB

MD5
07da0aec4414e4b6b87ddee2b6873493

SHA1
75dd9b3b3ccce7d089ebb5c0dde1a7e7046902c9

SHA256
2267c4bc9931769ef3044db73d5542e12288cad93d99f41d475732cc63110452

SHA512
e69f5baf79e22afb297195a2ec4ec1f2d5ce2486b40e642129994e4850b068e734b5478f20702038eccde1fe42bc57f0eee0539bbdeb9c1e4fde0cdc2a13df92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d5667bf87cc6b1b8_0

Filesize
1KB

MD5
3714fa20095cc2202b909ce6e6001a14

SHA1
f290a39f176ff3408bbb380b467d72c80c61d007

SHA256
25ba3ecfb6b27fcf5652629f58b956321d88fdfcd3db07a69af0aa0cbe0e66ae

SHA512
9c160e6b2e2d7fbaa473f83133c610120c29240aebacfa113c4f1517f8e4bf6ce132c1326253803afc166bd3da16b5c461649028b661378e04a37b4caee4fc17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d6ee81079c1cbac4_0

Filesize
2KB

MD5
f3c820242ced68fd1abf4ca59905e429

SHA1
3466c0bab3b16b1eae79a59f9c08d0a000a26948

SHA256
b92a74af13159d7b25e567d0e9438f21dfaa6738ffd233f8aa29bf0bedef400b

SHA512
4e93559797e29bb221207a426c4c668bbac1ed2848c6af767d9e9fbcac3065676fe95b74567eeaafb60947132e51472a71e149001a0f8c8609b6b4e5444450f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d7a29efad91a1117_0

Filesize
262B

MD5
b005e5f5dc58967d10ef365d99e795a0

SHA1
f826bc3e0f47fccf274e277432c1b08f5691d2dc

SHA256
744683fb1015c134363cdee591d18bdf1c52a177d1b31eb29c895b157d238a48

SHA512
f0629d7e84b9c1cbb6944a50ef437dad8ed7bd0275b1ab953410bd016174f533ad4f7bdfa8b40fc986e30a3ca3e2e11450257dcc47759dba3ce295b3dcf07e1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\daea348421cbc209_0

Filesize
3KB

MD5
4227c3d17af903ba10091274eba2752d

SHA1
c2b3dcba23f9851b3598a59ca21fc0b0da8cc6e4

SHA256
34a7f287499e5c0a7e143971b6a3f84592035a0221f84ea20dd994e30736db9d

SHA512
d51fabc56a48883e29373a739ec5c3ee965cd0e657d7c33acab141086df24e0ee3a31bee4bf07b4cdf168aa15d7f62e0bfac8e6ae1017593563f5de54ad82100

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dd3224241fad19b5_0

Filesize
32KB

MD5
d8526bbc3517ab6427d8e40af7db0053

SHA1
ae2a560d19c2e32d50ed85397c09e0823491436e

SHA256
f18b87c1c3e1563a5f9024cc4850a426a5cfa67b01807f5a1fdd4d16adbc3f7d

SHA512
bbb099e81cfb55de19704fd6a19116bb9a35d4c61289246fe2765a1cbf2a59b9138fcf7bdbe40ee39a6a9fd3956fa310dd740a0648498bb88e965d557add4328

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\df800bfdaecd1334_0

Filesize
76KB

MD5
359da5dbf3df8a100c6143d46712e58b

SHA1
b0ddfd15df9a4747583a8a7acbac4fb023a151de

SHA256
7bf97fc0c7000e4f4fa0a82acc7e9e5833286b21fe977a005ebb25cc43e45363

SHA512
9d42eb6f020d26577320b8656fe605a5d2c7bf5f26787591e6052d54537ca957a487c9ce7d76d68e8165065075395d2b84ef008a291cac2c895306a8e92fe90d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\df9da550ea6d3003_0

Filesize
1KB

MD5
c885c7741c968f97f78df64c62e3a93a

SHA1
864b358fc07f42019a3f287489a6d3a674899111

SHA256
f62cfd970f90490a830e9d5f7466659f5f4841e3d7142b572dfcf0bea882f4f3

SHA512
6dbb53df47ae7c2ebb88706ae3522689cf7522eee964f71da1fe70a194acb708da7e5ba04e210497fb69e4152dde2aa648cd9d48f61647998f202fcdae0706a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dfe07f2c15075c28_0

Filesize
33KB

MD5
1ba9366a5ea978c5be1850e45705b569

SHA1
3f3bcb9db8c21b11b4b14c22953630584297fc4d

SHA256
796ee83356b71fc5f9876a9141d867300aa6e1d8c83b7629123ac1239ee44c23

SHA512
37f15532b08d3123cfc2608a886139ad6ea84a3edb2a60783b515af99375902c36fd131c0d929ae35898501dc211fc609b986cec678b67ebdc0390019006de80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e239929a95f56ab5_0

Filesize
2KB

MD5
709b0b2c40f1433165239f13d7c30b8b

SHA1
93ea1af54b3ad5ad15c4f77f506e45d923369cdd

SHA256
b8f0d1a2717ef4669a2bfd5bad998f9bfae2c5037df644ea1b924dbe8bbf235f

SHA512
b97175a70187fa62641f46259312661af2dbc955d8f99db15535b7c65a96a40a4b271945053f62869ddacc6b07bc019abaca8b68bb9d1f5372fd58ec25183d99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e4f85019800026a2_0

Filesize
9KB

MD5
b748991d492d524c5217cd57bf737f14

SHA1
059ca64b10382b28e9c561cb8617b303630d209d

SHA256
d90cbaa06595ead218ca504cff71bb2f8f09c817faa3a32b22ae7f637ca4d28e

SHA512
ff978bd096fe9a5fa635604bfcf56bb0ec8e7b07d4be3729063545c9c563de52650da624b76877ac5ef789e8f6287ec91fc000ff4f844fe04dbc6eb1ae8742ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e7a7581f8526325c_0

Filesize
5KB

MD5
e451008c8bf971159d6a63b9b8507c5e

SHA1
cd9b6362ef4414ccd8e179248420f3ebbe60734b

SHA256
56528cf00d3fa650a690061bfb2d0407ed2f8823570d61b13b3fefe3e972aa63

SHA512
b47dcf506241f2107c84b46f03adf990771c482f7fff74425fadf4ceca14cfabb01ff745db2d424cfcf900cacb7ddefea075f522225371e90f2c63a2620104e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9365e295e2d0d36_0

Filesize
1KB

MD5
40e81e4aa8bba2560f8215d46d9c9989

SHA1
063a7f1aab1490dada65fa71791fe971323c8279

SHA256
76ae8870d46dcad75240db06fb81fdecbbb44462dbd88af1a629cc175d28c139

SHA512
0fe7b2ec74f2925a1f75841adcd349ea810eb1723160248858e1b4c4c8fb347824c89a7e518a7860e6bb6fb0f51e50f05ac49e2c692e351a623ef007aa0cfbc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f14427a5250d82bb_0

Filesize
269B

MD5
f5c9d3c8cbcfedda5ba865a56feecfed

SHA1
95d1663223614738da65a30c9d7c5436e37fbeae

SHA256
0b203477ea9892c7cf51573b960d613b748123bd2fb59ce0570f93a2d688c1ea

SHA512
b72260973dae02c4ff510ccd00b98ca73373569c21a6422877c44c1a3cbc39a097f904de0549365c8bd2eacfb97f75734227ce0e09fd7e611af658952e61dbeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f299668f7f337ff0_0

Filesize
1KB

MD5
de2bbc78a62d25f3e3283a283a6cb775

SHA1
cac068895745fa78537706d6670c6ba9af86effb

SHA256
343500c63dc2e422a5b095b46a0d36da858f0e136c7dbd201ad2a9c36fd6402a

SHA512
78587204b7e2051b407d196500dfb4b2ca55bccfb6958bc3a21467beb622813192fea91446e569bca477ede2abb1119e623f3e4a0d82856ed4d55169aa8a1590

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2e4bbad99a372cc_0

Filesize
2KB

MD5
00849c5cc1154824337fd4208fc8c414

SHA1
89e81826410a3fb44dd8e0eae53737ba8bf8310a

SHA256
e9ab9de1b1d83dc192fd128c6b4dca044bf0b1c37325fe59dc97e7504df585f4

SHA512
fb561b0c323f682ab7eeed6f6de53bd58dd2fadf767a87e24eaf9125630bfc0be5a5ef7871afa5dde133939d21f61bc3b66aa0bbd8add5aeab7f993dcae729b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f3228217b39896be_0

Filesize
3KB

MD5
bf2ecdc47875471eb692b552e2ae7b6c

SHA1
87fc4d33c5dbe102478e07118648fae019702f02

SHA256
7d57cd55720860cdf324db2ea18e601c294e8940d1fa138c1db94bdc9e9a98eb

SHA512
ce6c0df240f0a3aafcb7268d37555051c287eed35c2edce358762fa977d1ccdd04cd728cf62216c8dc207661cdbeb0fa7ec81d7e6c2351c5256d896f5bd317d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f5c5b9cbc406ca3f_0

Filesize
858B

MD5
7e7e77ac0b2a7b84e14e02dc67e108e4

SHA1
cedd2fe9421d2e20e2fe746e87bb73ccc8f066cf

SHA256
2e634534776cad8aac238303cff7a1a1290bbe78d179a6b56d1dd48bc1a10045

SHA512
349f93ad9d1e9cd6f005c6300598fc4849c658edada366b34d479f820cdc703e84064311b9f92532d3d026d149837837c32cd5c825eb93248ae3266100825c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f72f2db5654ae915_0

Filesize
4KB

MD5
594d53991e2af1d6a137cb7758e373ef

SHA1
f75fd6aef52783f88e3363a5d8340f119b88e01a

SHA256
e4f8384088eb78170d60662696089fd9c7535db21cb26f06f3836abb12abd149

SHA512
268cdf7091880134ddae144062a5d41e5860ed685e32a6afcfa322b6236cacc7115ede4ce679ab7b8f18d50529eaaeb9983c9d87069cd2c0569a4da3d5a9a30b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f9681fa398f65a8d_0

Filesize
366B

MD5
e13834ec0735df7e49544d0d5a915f1c

SHA1
dd03a9768514b430909fb4f73de9e0fb5be57dc5

SHA256
09e7b81629b68dac2bf3b6995c775cb90f47f6ffb2f2d802ebcdc77bc64936ac

SHA512
612ef3076fa6c8d567184112925ab480736eaf831adccd38f8484f1d3b2582cc1fb40ce976aa26a5626a7fa80e0a5f9fdad4e07ee14811bc98e102aaed5303cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f9f54d7f2e6cf0b1_0

Filesize
43KB

MD5
d1360708c328642c3a01d14495754ad7

SHA1
ede4cb3c2372f1e7e430f0265c5fa419a129cf99

SHA256
baf053c6f7b9d64e5e80b8e6c0bdcb90026c577ec64a78f9caeb22a3d990ac43

SHA512
51c914132bc2784ad57847a35942154b7c6503eda973c926c1fcc50bf064e555678fa823436f5bb24562ade7d514e99534c1348587f0837c1bac58cadbdde77e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fad43496817469ba_0

Filesize
1KB

MD5
53a780aba47ae9c564de7d35409fb743

SHA1
628cd645a48badbcf24dc1885f7c32af748d610e

SHA256
5e09a561aa3b18138051ec9f71991045f059e8cedb309d3ee65ab402b0c2e987

SHA512
a617126af04d61a0ac2cd4a815b66f17e34b98739d43627f270e027c09ae439dc99412828a0164c18f4b8014e6bd6697df4ff1e20507855e9fede09b70fbea53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fb77cdbeca77f865_0

Filesize
3KB

MD5
1f1550cf52290425cc84e8fca8a7ce28

SHA1
f7c74b2bee865b52b348a0d803cc44ae7c3c768b

SHA256
ec76152e9e5329c2675758af5e9a88a8ca3c3db8e07656d478f38c64432bff9c

SHA512
3615611a7d38e8139dbc0b15e41fa9d28af8289bae384ab2e2f04c9449e68909c93ddee0e101a35f497c44386abbf1d8d556a748770dd0049eb37c2a8e7fc4cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
e9e61248ac980267acc80bab72330bcc

SHA1
95530b1ba4b9597652479c9b61ebdb19edd73c4b

SHA256
65448633a249b1e376e66d549a4e76e19fad7b01eb72626cf4620183c2f9c78d

SHA512
3f5773732e858909736fb82a22a0c88dcc8ff53fee34d8c6ba1a93700976ff1b63e895e0294095a59f7206844b36f5a3964b5d86e1dd8c1abca5420242b320cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
574733900f55ddcee83b1806aca07461

SHA1
16f25fb17de34c18533f3965a59b87e3f3edaa25

SHA256
a727facfd0d18dcef195dd5a1f10e1ec6c9629100720d8a3b6f1e0f5286f88c2

SHA512
3d4bddddd44c7f8edf94ada945418f75aa74cb9d998667930e9f7628a5d7b3f17f2499773339bc49ecd3b990681f66f335e22e4c96aa96aacc8ccce07e92e89d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
8a38fa79081bb05f36e6d7ce59eacb20

SHA1
c9896625c50245bad105f4dd16fdeabaf615f9aa

SHA256
497baa1ca7fb63befc60415aa5fd2b81bc1f7b6e6b1354227ec3b1e26d293efa

SHA512
148161fc7bca067291a762ca10260431c872cf2079cb3888f15a0721f97a1861d7c830d8003384e6d0aa7c2d06f3dd9767b1ee5b74512b032dddd356103972e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
ce1bdc1428b99d4bbb13d33f41002530

SHA1
0d180b9f68bd656a45ea9da98cb5653f508cf736

SHA256
cf33cf9d85ab7340577b224eaadf9fa69df4a652cd31a52c7f1986d369d68a9e

SHA512
4c80cd4f98c0e4f4d8b9936620782b1eec52f8b1ad48612106547360d020f7d311f30932efa7551353e881d3ddc0fc2e2fc4d2eee8a0d154562ae7a11f52e497

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
5477a6144471145766fe1da1ae6aab59

SHA1
9743503b0a1f2cc1f2fcd66eaf809cbf137822a7

SHA256
f969e5223f814b31b022982d9c5dfed2d3a19b6055ee323b54a573b05be0d34d

SHA512
41ba272853a84d4fc011913ccad729bee59703402abc570b5e076a5d3d02ce4a11b4c7306ea225a3d3e3ae4f43df5677776d8aae155766cf20578bb5ee81eed8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
213f474b2ee91982cb4d198dd27e948a

SHA1
35beb4e6541158f7d8de764bc4db3cba5f3576e5

SHA256
4ff1aa704559ca45fe1fd6b64c6564e3ad77fecf028e74bd0e9282089d417284

SHA512
dec5c93b763f464d9fa263a50f1712cc2a6e5186e7ab2909db9b35eb520be4351e25afda7b2e8ce8502eb4485548bba09d9f7ff925b03bcb0fcbcb6683a441bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
dd289f9cc99825d77c122b7360a11a9c

SHA1
dbb4bb2b36b16d4dfb586d7d88c650b0aa44d048

SHA256
546a29c8a507dc52cd4c51bae0912f37ff9bd00aed214560058ddea339d15d59

SHA512
96e579fcd023315d80d53074fc3a89c5c140b764a9f55a1fd5a779fc5a06d2e9904636260d2bd5c5d21de0a5c2ee8a10183ac5939e99fa2cd3f894edbfe5c38a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
c0bc4cd1fdbc1405acd286d6dde3404a

SHA1
c123277dfa0c638cb31ef0315dc2fe7f726be707

SHA256
995e301fb09e137268d104d869d52f038afc3585b594f502dd48768c4a7d0426

SHA512
2236d4f5ada4ee4da8d81020fe45f165a506e95c0a54419254f66fd83fbc3bd06574f3217d2e6e3c3e9347e2bab98b68a61491fc534ae8f2c1d5ae67064fe306

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
5438e65ae9b3c323e297145d35478d3b

SHA1
d50b43db174b50d1df82f0f0bc8ff17f760c6962

SHA256
ee678f5eb8e95b383091830dcf958a09b4459022149275bb9a5ac2e1c2801db2

SHA512
59e9849bb4e49f8f79b28e6d30d2aa7a113055b7b241e79330e343bf8fcb2e24fb45e65b5d2a560a2bc505f0d72b1e012e0a108c245e49d389c1a146314da340

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
d3c333c482f57d0ac87ba75a741890e4

SHA1
ebfe8c513858491f9844b3a98acf24cae6a34f5e

SHA256
f5903bd974412717b45bcd241b8e8c2145ee64dba3e020198050a2caa0bcdf81

SHA512
0ba13cea530741d3366dd946c79898ddffc5f92752df6550ae380226a69de60a3d0fe65f301e33640095ce991be22a48e1ceb1dc58335a05957f4c3e36731527

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
e31b0835baf50941d483c0acdddfdc4f

SHA1
ce93fb2453311162c86904375c483a786cb514e2

SHA256
11360b22a9c02cda9c90d7010a94df82d8ee26499fc80b466b25def567ab748d

SHA512
48c49cf75a528c29fa9ace5fa57a62611c1eafd343c73cdd51f69f509597730d955e26b7ee0f94b2b662044b8d4e22a2b7f4912c56e83a356d8df22de0adaec8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
4ac6b8e03c978021fe60e1abf93ab362

SHA1
0208550f50d7642d221d329df6ebee45ff80eab2

SHA256
8a478cc2c3935b9156359ac689d5583e9204a965e6b0c0667b664ff6650d4fce

SHA512
dc61a1bd3ea1d2030846cea44ce487d107ad8a62447160df0e822539f6f7a976aa819253f3266068d11769f775d19c3ea24689d33c97a43eb6e0196477170442

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
79755bdc5a4d08ae7171cdd7a33d3166

SHA1
75693b310a0dcd06a37eb57fcc348b3eef8e321e

SHA256
52bf22438a30de96e708add2ee5cff52e85ad6195fe062aa58da5e93fe0d5d7f

SHA512
dd95462ab5bbf2989f414aa0564d49b8776c2983ff0754b418ff854431f52b4e955b3e585918cc70b897139336bd5d0319329d46023d1cef40bf3ad0bf3095aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
cdd7e1e2a3ceac548b04bafd1faf394f

SHA1
7e41e2c7818a4024a48c855d8967f7a7bcd5b11f

SHA256
e8c7e5a2727f994b6783236b558d594ad9654f7f57962cc3232985c7d455e47e

SHA512
5496d732bc7ff53b207abaa14c9e0f8ff5639bf946098ec6424d13b7daea239167db761316923562e8cf6b9b5dc08ca4ba95732e5c11e7e8e94d28dd7cfa9d5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
8337154a9cf54a00ece944be25aba214

SHA1
ac4abcd4d9b7a43c22fab790d8e8b4f9f7c20381

SHA256
d9de50817d43542f5106ce68f8d9536ccb8a0028ff64665b1cf70420a22a7633

SHA512
178fc38ecd456d705ed0a945d56f82cfff047bc11f3f74cdf09a0de51164f2ac5e1faf34c9afbefbaaae5d745261be65ef4c7a82d9e75870103b43b485225829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
e68d07e32d18fc17e79fe607ffb0ef40

SHA1
c18d4a1b8742af72230a68b3d9797d215ce5bf10

SHA256
48bf14afffb799c1897510fe68fe045e2157bb276cbde16cf080277f4ae1a15c

SHA512
c0d757870f049e97d33ad59ae2619a4394f69500fd7011094042979594d1bf2f4a7b3c67dcec21a0fe8f87c18409a9ab74514039f8fb62e4d3e9aeefde327273

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
8974ba339912a1c6f456191d0da3ec6d

SHA1
56137fd0aa490cc7b0aa6099f4b580f4ce35629d

SHA256
6ef266b72557da502f67de5279310e89e06b7c96151146da6744cc3b1e0a1fe2

SHA512
00e58661b7026b48e1d336444301f4cddd3fb29c111d91e5bb0976d1eeadc5e8a77b92e9fef8a452c8f7fa8a7ab3659a9c11ee42b171f4b2e3922708fc715820

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
34eb9f245cca5f27ef8cc0e58412787a

SHA1
f9955eba7718872360bc8072b7693b8cc634f6da

SHA256
a7ac032ff6dca40c9b4feba99cd854c1f77881a27bd176d0429748b7402499a2

SHA512
79e26ce532fc876c9a754a99314e1a69fe887890a2a64428983499bd4473806b1aca063f40a3f2dbfc74235ad70ca37ef3ae4086a05ada190c72267131547303

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
35f58fbb1dba75688aacce7ba337b673

SHA1
fb4a74b3f550f59c61db5ba54f377d43ed4305e1

SHA256
f65f27190f57eba66ec655e1bf47e2e63fc3998656278baabd758822deac39b4

SHA512
4a64769e5da68365aab9c9b77cdc89a0e891be141e347900122487a14a6a21bb2c9c1a05c165cac51af91fe7420b6a2fe12f5e70bad40fddb01d0ccbbd35cad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\JumpListIconsRecentClosed\55555430-7070-4ad5-8039-8661bf973304.tmp

Filesize
25KB

MD5
21f4df4635f9a2d9e8035cf315ba5192

SHA1
d00f54f18d424650aa9ac330588d96722e42bf8a

SHA256
cf886afb161b5fcafa4da3a11244970bc82cbbcc901f36b4d6bed44dc14ec034

SHA512
57feffbc2ac512011a62abaa638016afc943e0b366aed9bb86233ad2db588a1701695ab935d4a0ffad8c47857b9d72c8013451f0cf2b605dbd706c1eff413754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
78293f2bba9d638b94e290f143d0e63d

SHA1
68da93a2d33503d724b302c87ed07787f3b4f116

SHA256
6ee54aa0b8c2b7a6f75542a9197b31c15e42fa0af38833ac94c5b10739291026

SHA512
b9151ef325ea62233e4a5d3df89a0fe849f921e6b18ede69002fcce71563e418e09bc6575b9c0091a6de0bc645d9e3da1d0359e82a300185a88086782f713e4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
332B

MD5
9cdbfc9a4444d5c950cd3f3d9f14124f

SHA1
490c9230143a69b3276d8be0eab95a52ffe57b1e

SHA256
fba1b4b0d6fccf5eacf819ed05bc34ff03eb0938d867cb0f59c39b67b19fe07e

SHA512
b4e5eb297a554d171a10fce651d76efd4137e6163c4f53608e4843901759e04cff91f905db24e58f62fee0c4eed88f065db151403d9e377d4ef7becbc7a44b91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2385bafacaed0f0fffe9e2c191957344

SHA1
eb29369426125cecc518703871e68adadfda61e8

SHA256
9b5b847b52b6993825d521cc2f91d1a39ff9be76c3fa4154d8e77bfd6faebcca

SHA512
f2c644c995274784ad8e000cd12d1462b79ef16d8777d8e4285186a453749c5b066c063302665aad18469d69cf1bff9eaf4edaa8a9a88210b10f5542e1b1bee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
fb1b359dc33759e351c70877f7490078

SHA1
ea7e43fec1312aa65fce0f04b4a15c97e64404b7

SHA256
304077dffbcf4203ea93be9277fc68704c8b0b2121be8e5afeca521df37524a6

SHA512
deaaf816b704fb13e8db62919f45c5c538a031775f1ee44d7eff2e53cc7dfe7ae2609f2524715a7a99fee4cc05150eae1a1d2c25be59268d7aba5add3fe4b3ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9f80bd649b5d9b5fe88849009dc59194

SHA1
74e2d3dae3cd761884bd5deb643133cf75fb8244

SHA256
1eb0c8e4382b075994b28d650853c569205ba238fad180000818f470f3cfe60d

SHA512
01360e233fb5dd6a61ce526bf804ac6e711262fc6904b19a3df8b17c6d7714342da05f8921b503fcba2f66af1e007ef6f0ba4d1e86a94bbafc078b37802d1775

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
13KB

MD5
545bf14a17a235e0494b4b6019dfe7cd

SHA1
cbe19d699dd151c51e80f0e0b840f7136fb6a433

SHA256
b92ed45a8224ae83c857e1348cd2f8a6cd97536ac156abdca0b211e9b589bde1

SHA512
b994fd8d025bb964d73a949c36383f5c13e719dc178e6569c7cda921d0b677588a099027a663b6d2e0bc6c04761ba11cb7a7b145b38b05091c181e4881a1629b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
13KB

MD5
822182462f0e82b8ee7618f82a2bc70b

SHA1
63ea150951e56991cb60003dbe7cb7b0559c7721

SHA256
8e11ccd700c8a79f9f9bce09bca326b269b97571557d7481c127d4261d6d6416

SHA512
f01f2d4e792a7926f00b3637d46811cbc7d81e718f161becba7d953d3fb82aa375ae319fc66ebaebb4ab7a14b2792e0466f8d624053eee5b016fa742f86e0980

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
12KB

MD5
958233b32366e6ec1b1aa000ce76cc6d

SHA1
6a1f6651d4af3f639a332d610d9501c4df9fbe60

SHA256
bd80f86437885f289958aca4b05cf89beca866bc24b1fba54c9920a925b81e65

SHA512
98429a2a9b0691fb8db0f92c38fcea01c7c16318c7af9daf86d575beb4d6d9f5888fda9be503f9205d9e0d65cee4fa18e8b3caeb50088b96d8017630f805c000

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
13KB

MD5
e192367184bd9c5336fec95e63f9fda7

SHA1
4b0c2829817b456b19a1fee7751b0a1e367254c5

SHA256
c86d518250cb0cd2a7289c5b598f5b6533525daacb444c9b86ee02b50fcfe8aa

SHA512
39fcf65ced116338e0bd07efca24782038cf19a9210d50204c1dc92cd9a4342a36cdd14dfbfbbe74247f82fd67c94b56af7baa0c755336e601b7f56f9e082f2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
13KB

MD5
f7c8483b8323bc59178e13ade7ef80d1

SHA1
36b64e9954da86aa8fcf4048ccb4b7908770c2a8

SHA256
9230da8672905ba80f043e2b32ce7ae1f31a8dc53d886362969fddf559b297cd

SHA512
819e4fd8e65150771295a86951ddd8ec3e46e471b4431b09e0d46382b1108f605a941641df0ec81dbefcacafd268969cfbb22e5bdf6e5dc4d0aa93d42df348e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
92367383f36a6061489dffb61e1593fe

SHA1
a840dded6e50305ad290d8f10282aeb49fdc3cce

SHA256
43d906f8872fbf61badd89e03fd5981571e08b51c3720911a48be6fe94ed00fa

SHA512
0ace801c7f429ee4a6db1105e22fe9454fc7b7ccf93de4449cdd4b4adf5aa59fc3948c18efd2632e6d155bd58e91fb1f6f794eed7e762a5db57bb89bc60edc6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a56e850b6164784f18823e3e1906e288

SHA1
0fe9d1d75492cdce2a094fc5db3c8383debbb621

SHA256
6b0554de5b009dedcc64d6c28c2b9974b0535cea4993bb7b4a8922c5606d45f7

SHA512
1b21a9f34c5ce274b473424ac1c1d44899646df7834cb866fb15f73486de622729f17e82531d1157dfd49c4364e2193c0cdf8ff841815c29c99848a99705c278

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
29d7cc5c515e719a85afd1b220386fc9

SHA1
415264448c6aac3f045763ee644c4b1601dd6cf5

SHA256
ab1d5eccb3e27c7993b1ae6d88ccf36fc37a3ef082acad3f5692de5fffbd2425

SHA512
b9232b6c11f687b3a5fea411bcfa0d711d835eb5153b57eecc0641b6e4b0d25a2f9ba1630b13348c2296cc223954e1447bdb91831a2bdea6cf8b60292ac7e01f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
f632481ecb3d9f793cfac2e86d4b4945

SHA1
e9ab2331e57bb1c1b236828fc9274a871000afb7

SHA256
a2a824ef0dc27b8c9948b2e3add3cdb45f72b49d523cdf3e23a0df5bf90ae351

SHA512
8a7c307cf5d9cafb3e51aeda94cf907a2dcf2cac61b49d12c089df84fcdd2db881f2fb0a2d83c4c8f734a91b830b7606e304075459d0f2a4ff6ee962dac81f26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e9f671ab615ebc0f4f0c6e25bd086806

SHA1
79e55123ea0e6f3891a77862c2a99836b671a377

SHA256
aa07635823a7597da4bcce79ac9c2a2fa3c8190bff4dec7461740a513111c6d2

SHA512
9bba9dc72f084de7b27a08d31dbdc632377b7b649aa138b800228a4d82d1047926699cf8c5a31635d7bb6547371f83e2869ab48f1b6bf16f33d6764779957225

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
06b54e9d57f71d2a22769f66dde23e8e

SHA1
716675728a19ec748b79a7dbdca27e5d998b245a

SHA256
61ec924b9b3fb55fb56f86008731d3bca32b93e29bf0adc8d4acbe0ba0ae6654

SHA512
224f1104d7a935f90af2f699f81a34f953e864dfaac542fe0cd15606c6d1e5b41ab81890740ee04a0cac8a262bcfa57cf9472f7242a237eed9a247b5e29285bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e521b811b5170730ae9a7be69ebbd36d

SHA1
e0c0c80d6725dd1502874472fd7c1256d0ed7fb1

SHA256
f6eb29d774cf552136a5649b018b0b07e95887f4016de5f697db1e2a8f493e12

SHA512
5590e25962c1715f55a5b85cc3219064410d438a1ea19e126d6d159900fe1bdcfb0e33568a5034bb2b230f25f421a965325398b07c6ffbf8b0264e918c749145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f23b5d4f32e0a5cd9cd02527ea10b2d2

SHA1
63ba77ec900181590d6cffa30b6ef30120e0c9a4

SHA256
615712987f99d76910ea6d1d3bab8f3ab8e8f746b0e67d35446b441c0cac6daf

SHA512
7bdc2a1e3739cf3edf535ec7d08bd7735d266f630a8c07fe9ee51446fdd0a00738a463ba01239e3ad1eea36a4e67bc6bf3be4231e81962db6160c27c91bc0ad0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fda2bc79d5a7d22f41a38fb73c1b3e96

SHA1
73da376dd97e68166747fa667a5790102f704999

SHA256
a67b18f1c0d1882ca716f0850331108cbc453cb5f240d7b0076029200e34b820

SHA512
79b03fe65abc52127b18dd15eac9e0005a88fa4daefba7e712f74cebe996933eea8f47cf4770d698f91c90f8cb359ebb5e631bf97bb545d603d3fed66c22ec14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
d37bb3996cf8249e4298ceafd006e7f4

SHA1
8140b853a98681fe8569c1e76c8bd58fe202b8f6

SHA256
ca08171ae92055ced7d755dbf5afa1100b873b4c57054cacbfa1f12ab5c4ad9c

SHA512
4c3958e7d09ff27e399be1aa8ce0f7310b0ecfa8890f43c09123effb517b13626d8f444ab02a26fe4145136595498af4908aef1dbb5a7a5c2c37caecbb4862d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
6f47d0cb959d28751be8b1ffb9874171

SHA1
7e2c9e3d4cf2473f69485f6bc9cbf0b1adfc3ded

SHA256
236f64f22f21f7b3a68265a13104af08e827c14de97b81b77a5526d59c712209

SHA512
d68950e74615167351dc0028de1f1dbf0b3e93b1a15135c1160efae8bd69df7e947c098199e99fb122cb1e8e9817e6863b4dee9ea4ceeded1b328e92576b1358

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
507db180179cbfb7d1f6ef7c79b0efaa

SHA1
f6e3cc2650cb438a8c96309a2908a587ee2deb71

SHA256
90d39c42fa4f929f0551cf872097962a62ea313cc29348e4dd2adb39f021ab8d

SHA512
413752fdb532d6d00010f383715b8326392ec5366cb660406bd654ca0370b7fb4ec5b251175b0a27eca22c485bb1234dad4a07c349deaab0d6966c5c6a07466f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
c900774e5d50b39761d77a8196ec1c03

SHA1
263d32393c5357c21d1332831d49cfc5eff18f17

SHA256
b5efab6dfcdc3671db8dbefd837d2d0bb02428dbed84bba244fd8d43b07c9b21

SHA512
056709e180657ac32f49cc23597f79159b05d88293ad6b04d34ee9e4fefb2ef27e3968572a7e8a213284ec817f8e429ec93f90faa30355da0b9329206a0f40dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b858c2eb6d731005b2aa88415aaf2cfb

SHA1
d5328fb2b63b5684530bfbffbc89ea9486ba343c

SHA256
3f678fe934dce53141c70229853cd123678552f82b1da3d42a2c46b8cfc48e6a

SHA512
b04bfc6a2e8a36b22fd3a60ba0c4032907ad458d890edd193b4e1c8308f75f112055a738044d30450b8b688f572218bc665b2d0adc56f8e18207afca05d83fdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
3c5405bf62668f5d989d82e78822a8c9

SHA1
117d757c5e4874131b449ec36d7dfc833ccc70b9

SHA256
9ea355277025dae6b01af06c23df37c93b1c81690117a05e78c6a336f073d08d

SHA512
95dbf904bf24e3b2cc5596d4b9aaaab232efb2abccf1211e2c225a8f0b3634f1bf4302c09cec7c7012eb0090bbaa7eec4d1ccc91e1f30f83ea914d3ff09f2fb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
e65dbe2424aed49320a376fd707c30b5

SHA1
0efa3d20594f9e2e66663d5618cf490d57819638

SHA256
ae08018956716db3245435665f7b72bb69384dc506abf518bd6b98c6be78750b

SHA512
1fae6b159cb367d21c5c33411157a436efb86ab99265fc165634be7c7076dbb7cf9261330f9ae1e951fd623a5a32bc7b04c0bb866ab182c9a12397e7bc778899

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
cb320f79b543e3e82d87056690ca9c53

SHA1
bd86d3966df9ecad66abdf62b92461a8c0cc1789

SHA256
da2510a8bb8c106e7e0af06468d6d53dd6aff5d285578cad65cb2fd8dc8d44ef

SHA512
e15c53f007c24651de276632412e069240a3d6399cdacc0c1e0b23040f19886e9f1fcda8a0e8afd41b6044d754ab9316aa3d1db3b28997de0980e17299722606

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
cbf26940864053a4a0d423c9d1adc064

SHA1
29d90e0a517bbb90b54eb9985992a5e53f6e64ed

SHA256
c79274f557f04cf0e4238e9fe877eae2ca2dc938968c83d894b5186e3a61f3fb

SHA512
2d89f4b73939d96daf3ef99238c79b7846162ad0e34606b07536a41b02cc03c374258450e4ef9115c733c445fd25b036615db145f9586e95b61e2177e5e11969

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
251b78bcf467328e046fc4c07dd56310

SHA1
e6652c415c6d89bf854b7cefa00689a31cff883c

SHA256
966bf7ceaa185b44215ede51ad09714407f8f9eb171a71e16b6a95641b9e7466

SHA512
ba8088d8353b548cc2a9cb165ead8e6e9d8488b0a9dbc37f070a30493020c777c255b2ea9f329c90deea3f4545d6ce8d3e6ff4d4f5cf0fcefd1840d8f4e50b2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
873e59624b42fdd3218ad199f721d5f6

SHA1
9e36ab746a7d04eac0cb0215ec7160bea639338c

SHA256
5033b646a34e0190116f5b8e089de92fa4bea144a36adb91d34e4c9812752bb3

SHA512
d99ee8096bb884cccb7c59e7d27be8104fd3b3189c5571b50df9f6343282888858657825c03aaeebc33cb870d34d806fdf107435b46977b2e7dc1b05dc781eaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c95a8cd79b94da2a22291d262be04bd2

SHA1
8b5388d9e53585c2cb00f73d74ed345e9402acbf

SHA256
b84d692bfdcd9925b9af815eb3a57d6b9f8fac3586c3af433b0e8ed0a551bdba

SHA512
df1c7b3ad0e70161d2c8e9718e2ef40c14e2250a154ddb700984912997307e205ff5d743e8bd98f1bdd353a9f2a56ef5a7a25b91cbe1146519980a0c7ff93f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
b12a64f1a049b8a46e96f5a06b2d336c

SHA1
de2e4a8a6ba47c72e17743dbc893b46626de066f

SHA256
404a9b8a85b882050dcca4a083cbc6014a0286977401d367f18db202cb904301

SHA512
b911664766502d60c5c0c0f4ca2d0fc078b4f8bc6f679d368532b7c480a64d5f9089353350126279c8392ffa7d9d633687b33ab98b006e1c562c9be4cdd01e3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
a010369b559fdd233643c7782d2b9f2d

SHA1
3ff72339149e828afffa13469489db687b2954e8

SHA256
ecfebc79e6af6c5b9b493bea1a6f6201198edbdcca62ac19424fdf6ba19cce14

SHA512
3a1f8c7609ca52a3dbc0af1d5ad04a3b67fdb5ba14987c3286e5b26924551824d25c66304a1a2ff5d3053f513e7d0fc9f67048eb74f58283e0900cec4be52cb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
eceaba356c920589aebd4e499046a6d3

SHA1
e9784b3e74064890342c5b50a2d8b0413f6b30c6

SHA256
9046235a23435706c5bae266ad2e3ac9cac9d7b20cbf81f92ce106c4389ae822

SHA512
94d1f12d0e86a71e3b4bbe3f02f84c18a05801a82abc450bb5f2658362ba8de9e8fa67f026fc5483ddf804c7c47bd2713dcdedaed2803d75594ca12b9bb555be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
5b8a5a488a9ea5856d660c2b08691da1

SHA1
99c928f644fd89ef9fc8ead07578f246c17b3841

SHA256
25d714a03f2e4a6238cd54cff554ab3be3677ea30d66d60f3bf4a91a7adb592a

SHA512
5a25e6dc00dc4920a66b6d37b5b055f25a6e524744772729f13b55e1a04fa5a90d7589b8f4aecd312d5c488c61cff79f3928adb5d268d537516b955132fc4d52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
f20f39334929d52cb4fafce6243477d5

SHA1
7ff0655e72b451e42dd5dc299acc8ff40cab6600

SHA256
fa7ca4e754e0ceee190d7f84cba688c75dbbd3cf2023a8ac2122b3e3475c0ca7

SHA512
2075f8576921546fa40f584f4e0407d868a266415c039eaafae48d5ad095bd4b28ff4caccc8c408fb73ce6c05885eff7fe50e0d88b030bb43919d8750f502fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
aefa06660d9dbe1d392da788efb8bf8e

SHA1
39daf18d5e80bd6238e6c4c2599e5ac80fd58ed8

SHA256
985459fca77e9deb4693ae32ac0a99b2b012cceef568c48eab4fb838bd0df009

SHA512
de66001ce75209c50c04e38fc6c77e54d31c5560eb578417cd1872fa115cd55a4505f80622e78e191c245f48790dee261a21b911719fa35af472d5c8cf3a255d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
85c692b81ca501bf243d0669cc4b0db9

SHA1
73eb5305289b067dbf9c3c8df3446f94507a1381

SHA256
da298673d38e2277dbea291931b3e7db40707c2a62798f15d3e5fee5015b084a

SHA512
b997591fb6d082ebbdcb1c93b7eb18ed9dc9ddaacf894100c296e2855efcaaddd1729f31075b5bef05984b4f1ea03f7c1f9015256104a704803e799280d58fb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
dd594978c72df3711faab8eb63bc7753

SHA1
a73e71c9405bb675fb6df32ad56c5e8a642ae24b

SHA256
da488d0257b656e8d544952eb593a9680bef24515f97418a2b1c4ada2b38869c

SHA512
0563132065119918153b4b24bfb9fd14dba68b3790e85cd5ebd3015db38a5b5a0342bb70af2a1a4ae15c282c3055d8bce38d38ef83aa2734c3739f14ad22e495

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
fcd61b7b79d39aa29d1e3f240d5192a1

SHA1
ded75015b028a82fdd432d53ba76a436c24386ad

SHA256
5cdeff015f0d898b13865606a56a6cd729883281b3421dda1fbf7181b70dd105

SHA512
e7af13ca3d73eae319a54e6466765a30ff034a27e57e920e98643aedb083c255421e656c9ece3b02f7d6502ee8db7ae8d08c9082d7a504f2b6597d5acd4f0504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c13fa73788c09678b28db5d14b78a26a

SHA1
700122d0a4c6b9eef997be6b642a3b6e33dd0f37

SHA256
2124bad339c40b17cc199d4cc2eec7d533affb807525164c858d8f3d335bb899

SHA512
94897f2e35f3a27df04e4e50c794298b68064472c07a01c22ad7d4a5c65dfd49e2e69fc7fabb45dfc19eb00337bd5d9ab1304a667d5987391d9afe9ac85c8462

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
74a4b50f74592bb712f13604f5c822fa

SHA1
f14b3c94ff4231b25d9f07acf45312b3bcec2155

SHA256
286f9a668bcad62a6dc69dab1c18b5b3b3e4ddaddc5aecc9ad4fad1b65c48b9f

SHA512
a6557cd1300aabf0109eefe2a22b0f9d45f9b5e24bf2d4c815de0c914aa56ad3411d698fb91d03c682ac9172463db4565d2ebabb11ba7e96ad4d00e48cb89d17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
f499c33b1192711065f2f1bfb2ffcea8

SHA1
3c6c9a7d9147c13e684948f7210121b08d4d8f24

SHA256
ddebd352afda6212d73dc676c9029b5af6e0981645270706ecc5fab56a5d907d

SHA512
cfa660b07f84a77d865128daf182085ea2fbb56f8b35c137c70981b4c73e88e03dcca5a58d8dc4f04a1a74794d56f61e6a1657cbf3551a261d13348786f29f06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
4d087a41a43ea355baf445e6bd308236

SHA1
f9cbc720a2918354fe048a98bc45b1cb67a6e45d

SHA256
553a041da9d546dcb788d9cec3dc2c5ae933f341246b636bcb5b4c6e0505caa3

SHA512
1cfd01f787b1946afc3823dcf38c2b67f55802dc3cb3c238de1403913894d0932af0b212666ce3d8791f805b09442e33c9799bb92c74a3438ca3d8eb251e2765

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
a5255f83a21ad9c6194a25baa23af1e9

SHA1
07d458501bcdea2d31885aeb166c3a29d3f83af4

SHA256
825e96db5bc214a2fd00cc65695960dc4088a32a834f9bf32a27a102cd0f88e2

SHA512
dbbf39db30e75423eabcf52671ec3e94959922ab6ad791b8305392f10ede4bae832bcea0b7484569efa893ace5b44c5aad9c4a85e8e6a78ce389c4d8dfad358e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
3376d45f05c95fc589fd9aafb6c5359e

SHA1
cb81eb81b63eaeace8478184ce6fe8ac0d160dbd

SHA256
8a02f192a490702e1051f2139c50bb7d97d20b379fe9ec288e7621c7071e768e

SHA512
f6e8035fe0bde1688ae27f057b5a17c053297b61f427dbeccc07fea3912309edf4faf83fa7edac84983f6c3e3f1606b2fd7bf43d8c5a16fe2a40e4d2c4dfb141

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
659d5218b95a353eb0fb97e11d185028

SHA1
04151929253cf8a14c1cef953bafab513b8ab65e

SHA256
f6b77b61abcc2b87f60336bd59e37c4d46cd879f55f72ef775d0b21829054ece

SHA512
aa2f16b60f59ee9659f4d8cace25e0372a33331f39b16292bf497f47a4a9bf09ff979522429e500452fa43586d1907f36fcd2000407ce1ea63be6829e20e4e15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe61c737.TMP

Filesize
48B

MD5
5264b4c73a66f91e4c26eafc551f2357

SHA1
119ca762f7f46e1957ca336bf748dd029aab559b

SHA256
26cdc164cbfd9c4c7eb536e6159885c72ed5354f66651a32e0d519197f01cee0

SHA512
c857270018ff344f00095b0959bcfeb2c2d07cd9e366683d12c71bafc7be8d0f3242fc516f969fab242d275973279d1c5d6aab7d6de52ca47ba60745563725df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
b06dbebee36a310594e6b453b2b846e5

SHA1
5cf325fe2a89f9dd7d010900900e79b685c92f7d

SHA256
c4906afc88d26f99233d86772ce9b687053fe53f4b40a1f7e1c5ca61fdc50e04

SHA512
80d87fd1a05d97ac7c496f44d0fb70ef3ae44f302e46901b7aba8ea524e6a5ae2b59acb230861ffc84ad791a88838e9c631a35308e2deea58c8d424ea8c7d6d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
92df762c82860fba559c72dbf7a3abd8

SHA1
d207c2387507e677e6a8ca479c2409461a97bf4f

SHA256
35fe21fc108ab9d86a626eedd65ed1643062d5fb3f772ecc179edb562d8fb55a

SHA512
ff3ea69eca6029383981663937df8558dd126781674e65528297d9ef32850c5b6559b73579a622bea00d4c3e9fb1a17b063f66efbc493beaa2263ab89b4464ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
733f63e0574ec7d9468ec2d6851d266b

SHA1
9602cab35c18572bdc88c93a5a9f0d3c1705e4b4

SHA256
a92493596b5585234f99f4cc292f40c677c3e908fabad03c8a7ba67f05e38ac4

SHA512
0195f0df99dd05d390155c7c5f34164f0181f6bd00ee38c825a1a398b275e6c3d305ae30b94764064cbc4220860727dd5830cec0c8ef81e104c9189523140228

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dac1ee45c42fd43ddf107b3d5957b52b

SHA1
c3bbb19d849199e533a11e8757d32b7133dd0a8a

SHA256
3f5516b2a41e0ad5472973a01ec56f2f5a95794283186e5563915f7a9d2ac2be

SHA512
d93bed99a6ca3db8041fdd3099f83b6efea687b4f81ce37d28bb8fee04966412aaf8fddaf7188fce30d8dd754b6c72df1dfca964b8b07b71bee5478556a25a7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3f5e00fbdc693378ce70475bcdc86349

SHA1
9fdda4d998dc3ef23a9b7b6dd39ec5d8fb5caac1

SHA256
8e5a2181d7cbe095d3faa2332dc7c7db88f566cd5966d4a5d8369ca7a0935f6f

SHA512
f293edc1109f46120870fada2fbce73dd1ed6f61fe9063f3dbd05898df04626bb84b3ceb2de429b84ac006ee745fd7b8ef1aca8d4d2ba94db82ec975bdc1181e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5f45724130985c8d8868c4116b30889c

SHA1
a1f29f9e7729d0b8876971444ec3f947edc87ac8

SHA256
a2d6f675b527a682c72442249f7bb1b4b7c043782d087dbf05c8a370a79f1d27

SHA512
1dabe3a04e3357e60cbbf9c948e169b8f90fbea48d5e2d592f796357eaea057424395613b177f0b8116d22707ffa314cabe15ada6181d594426aa68cca4ed665

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
a90ebccf4ac053ef9405af5f9ab17e26

SHA1
c11d5dcb07a0a0cb5df169757ae5a6b3469b16b3

SHA256
733798da943058d05724cc556d7789484e4581dac74032730f9d0e56379f6f72

SHA512
16e04d7bb077a3ed0d5a9f87559dea9815b2dd5b36f5a346a9473c5fb0ff8d6c3cf62d4f1b59e0a58b386c5312523cc8f430aa8bcf1b6ed6c5c6f07c83d6c986

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
870410b001208068f96851e82e525171

SHA1
c40d1d90066e342ec47be529ea3144a2696e5f13

SHA256
8fbf10a55cc98bfc6dca592bd910b9360b7b09e7a0757366fda5e5ac1c411497

SHA512
5081b531dac4ed67a287be8a1e71d394f780333c42c7a3b928af90c5d439b8887ccf76997847acf0142c1c0c366fec7cf7c3ace76e43b6d227dbcf55f2978e59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1b4f2e4e87c53159b324acc5c3e92da7

SHA1
23c4fbff5f6af770fee8876573ff5203404f65e9

SHA256
74abfb3778e2d431d50c955694849b94b3783f62d6216e8edde354c61df752c4

SHA512
19d165cb0e048802751fb76c9d83ea012173ccab270505b7098cdc2e5549880ab91957109b732c1b40111f301f9a0fef41cb191d7227777bb384d390c6ad1153

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
24c8a77b0458e0ffe5d1dd71c883f114

SHA1
74072e1e978535be7613b7fe344dc645241f3eb1

SHA256
cd25b7936ba82572a42a3ab1bdf4e8fa480af133891de5939e6732b38f53880e

SHA512
0062c19b961a78be7faa1f4c231193e92c3e39e3a896d1255c4986dd07928afaafb1d518e368af775adc2710b9f302bd251a47415efd4e89f376024b22a54000

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3b4fb2d09ea8cfdb6c6d0d5c72c88fd3

SHA1
ce4629eb6f898ae39d191abe8390a852de22d356

SHA256
9ef68701e2fb96028aebcada29eb03f396fb898f53121e38374ac27188fee239

SHA512
a175be1af20f7d8aac00163d67c20cbcaab0ddf1fab8396e7ba030213ed634e84f8a713d9b30505fb2e287455314d5c6025c31d28bc4b91afa5f03cb7c2c42e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4a9349a0a7ec7d6a51db8a2868704ed4

SHA1
97ce6bbef0c092a90807e3abf27a5e9adfca2122

SHA256
35c3657971ed2a7e9f54ad8789cef24ab1e7cd8dfcc18f78740bcd5247767942

SHA512
7e4d04904fc93d6dfbfc3539be807d13f7553734ce2c23d05cd056398a47056e047a429be3868532dbc27a84209b264fc8e8e69cf680476b4fb4e3f5a5da7cd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
383b3fe0b0fefe71671a647ba056f10f

SHA1
0b58e48d0bb642be484c3902996ee5d5520e99cf

SHA256
14f25a8f3d48c7e85e9386b53b27f781512c5678373bf556eadcf22589f0832b

SHA512
940a497392876b9c92ed5df53244a81d493be5189d2c38f808d9bacd21e58e48c08cddd0609e1167995a5ad38441cc8711b58e85fa47d972cd864553f61d98ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
cb7991c4543e16c7756c976405c54027

SHA1
887bf736292ca3a71418e2a8412a15598f82c2f9

SHA256
a0e420c25ed58a3eb854619140987452cd8177fcb8096cff6e6e73e8f15f3dd4

SHA512
20a387c440c94607ae745115435d25163c2b1ea3806b29c9c3cd48e86e5a40cb87cc43040408dfb62626819c408d06f11cfc70ab433b191423ac18f7df6ead13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f2f8c4ad4de4c03fb753e4f845c54754

SHA1
6faad688dade689a1ed98d842e483401983f7785

SHA256
c78fe860dee3f49b6758ffcae952d8e28ce6596756c1f9c1ff4aa92f50731ce3

SHA512
eb10e08aa4b95344ea1eba4bd42cd74f54397096683444191004cca520201f5142c0f632d36aa88d48fb343910695b6dc16aa2b76e18962298f49f2a295d6675

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9682c442302ae482c2f11eaa74f02c59

SHA1
fe2a54b7edf77f0c071c4dbef0001ee062e0ef36

SHA256
e261d1a7fb280e5dcbe2da26196b317150d3cbf8fa3e0992e1e90963bf2fc7a7

SHA512
b342ef8ddf2f503ba5bd44aec47e1a6721481777de32cba69ff11a94dd6688a195774d0305d289bd9fa57579af74eb0ef62f0a0e5bc5dcf674be41da9c3f3f95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ddbb5f3a651c39b53c769c7183cb1dd3

SHA1
e1d911f5e51f420a0d3905b168642cb12d31cc46

SHA256
e8d1a0af5daa8cb184e0a611a45a9fe64932c3530c45b4a66c32d631e14aa63a

SHA512
3ec4fb9b00c9b8af976175dbe83b900d50c17eeb6c85882835890e0d3288e9eec07d697735441950b9d2cb83c2d8b821d0ea4e1b3d18453ed0a6636cb52cee46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a3ef49645c1f5a4b08d3637d005faaeb

SHA1
9ec2a3463ec4b11d87da0ab93321d7db2a853573

SHA256
c3a541bea74d2106415991fd408471cb73345160f618b5034be4b7c59afdf1ef

SHA512
0f6db232aa108bfe05e0354c98e37f1a1d63ce7b6ef1fbba69ec8a90a67ee2e003854aafa864378398b5a8d9050f7215ceec5159de9904c77661cf94fd1b0040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
e602f797e3c01611433f10af018eb542

SHA1
f9959b4df6ce5f1a5e6558387415a94a1aa2abf0

SHA256
42dc2999996d26d18f1a2aa39a123a106ed7a8d3f287471023363cbdd68914c6

SHA512
5d5136b1d63fcce3c1b93fffa941fa00860a169dfda28fc16bda3ace09a0b84b52fea7fc4c74755ec432b6e41482faecfb9a0661bbfc28af95abbef7ef9b52f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
af4cd6f098e5943cf30ca2a367cbf055

SHA1
3d515072d9698f1f550daa31aea3a27e63631ba3

SHA256
caaed35eb74ecce643d822b504c44b30b321175f464afd1577e048448b1bfa18

SHA512
147e6fbd26b45d36db998aeff3917317f82714c7c384088f56b6bfcbbc44598bbaa53004ea2bbe319a98e1a06dfa60242daab3e66d3881f53adc5dd389c07b62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
54b95913d0b5bcdd480d8af3c3a68baa

SHA1
a7b4d3743476825c65a48beace5e8cafbf8af280

SHA256
4043b003ab868666906d1408b3994b1cc143a693a7af5c791155df6672f18b9f

SHA512
30e87c558e53cae25e4051ea5ea77dc98c8c849dd491e461f73a44e15a31e24656fa2bd1da6b72c98246582ab576285e20f599ab67dd059b2eab49e00855f8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
61dbf890c361e46ec9dcad22d63f3fb1

SHA1
dd85b294bae38243ea980600fe8439824b3ca513

SHA256
fe64a2981f312837ceba42b01975fc3163d7d3ed040f80638ca56c1fcbd67d0d

SHA512
94e459ec7efcc6c329fe314591975c8e4954ec0b4a1275061b84f785f478e3a986b4c534622e9fa9f4840d997574ed2a58b996ee1089ff6bda1a3bdb793edef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
369e56aa6028cec4ad6ab62d2c3745b0

SHA1
9f3e6ca4c1f3f7aeed48acbf760eb5f03b2ac029

SHA256
5064600c8617f0acefec3f2f79700217ee334d4742ce53c67d4f47ff7535b496

SHA512
94dcb57f27ceb3c03fa81714d127332387d58866464008a7686e32edfd05aefeea2154cee083a7c74b3134fdcda9ee67600a04208a4e5b0be130051b4df0535b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
1ed80b5d7df8e9a9356169ba2fe03bbe

SHA1
1968e182ad50ba036fa94ee494d359f4d49a39fb

SHA256
3af1d973d3bb3b74ee0c9ba09c454de0634a325f3295fc790072bc417ca13d98

SHA512
7a5e82a90e423754b727f0412d91385f094c67bbf7ed45569157eb6f085ea2d0f5f001cadda057a251e1740a100d42ce6a604c1b7fa943568560776e916f85cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
20ce9128abfd0c32d0413361cab768e6

SHA1
80a8d45321efa44b8ec6243a475b9c6304e9f838

SHA256
ece618f8e56f74227020fe0e944b4227ede69be9a89fce109c7838588b630aa4

SHA512
6d1e8ebc23197500547eec67d84784b28dc34633570c5a17fffbdcbfab2edfcbb481673e3e716df5d0fd9cb11b5cd34f051f963ff21184981fe70cd202c6f896

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
08f2cdace1cf7632eeb15372be9c78a8

SHA1
a7726f7b5f0af3dad8f6a2112d9939118f8dffda

SHA256
33fd1947d9072eda46ff94620ab5461ea137d1ef5f1008d661bbb615c2739563

SHA512
996d3b0a714521cca83ce4c62bab6f20cbdcd2cde70b65c42d174bed05b3b9326747198366ece61f0d638b9b734a70d7eab1ee4ed0f0057d6243cace6d86d0a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
1f8653d2e6492b672143fefe22c8a901

SHA1
e9ccf2d761ad4da277cb596c8f296d5cde56ed3f

SHA256
4a820b20e4216e8b7778e9e014084588b752bb235a40896cbd25489f51905ccc

SHA512
bb6a642286b241083e7ea2413008d6cbacb9b90e593e289f8ee13a568315ad26ffd550e5d0aceb2f4a73d0fde922f8d04a66dc19c3e5d1018afd74142c6743d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
cc1a6c6c95e1f06a0e200309fa1514fa

SHA1
7641543dde964b6a5878ca69a0e34a7d197d097a

SHA256
f13c77dcdecb955972950b087c54a7c151f8fb5c9b0ca7aebaa1e0af33686b7e

SHA512
352eedcb2476d5922ae8b9270a8897aa198ccd4ff5b932a9e0dd9cb5d07d84788eefcbe850e52a1393f4a455d2304ea06f682bc23216361ac6ccf2e0e5d49cd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2a7bd8164364eb830270f322aabaa0e5

SHA1
ab4e3855024b99df4a95e6f4e9134e290e9665e5

SHA256
4477ff53f110d57f351c6fa017e6f0a1de3b39b94f1d89860245ed79789639eb

SHA512
ccf331d1c880b856e237f698a954e33b1608b35bf2f62cd2dd518140d1962c99c9a7b5ab0e5cf7a9279c7e9a590244b95c5658e48674238c1a8aae78135720db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
2052a245c4a347e427256ff1e7cf230a

SHA1
0ca52d8d2854f61a62aad8e4effd8fa7c4b7fe51

SHA256
d18a0ee913001feb476428c05095acbf710dcb94f1907cf0ac20782f97bb4d8c

SHA512
5cd7f1d1eef49161762b2c1fc79ffcff15b9c0ce55c4526d2b86c2f6233768889d73f0ae94cc0bf8914ffe0ab1e124c787f06a5b5ac247dbd20060a2a689f2bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
e2b2e5357efe185232f366d57ccb0f2f

SHA1
724767d1ee929d22b14f7302e85dfb8feccf8fa5

SHA256
d282dafb5e94aae0989c4ac66be7b4aaff177c563d69c972c21b1175b2115ee6

SHA512
383f1ebe208b8e4aaa1fa37723f5c955cdc429974d881b8d525b89b2167c40e3287990f6d87c6cffa219b3e31777e32ef1011519c618deabfbfd3a8b83f3a6be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
89cf0c15e3368f9dae68e3bff67263d8

SHA1
3210daa22ec177c6d556c1198461ca1695c6a8c8

SHA256
c990544ec4628abb7c97a7d59f38176248acf8cacdc61a21dd7162cad1a8e04e

SHA512
608dad149c36df785c140b64d550ea9ac1fe2f6621f85a1594cc50828222afd207092e5e8043a84fe26034997d1503d96e00ecc1e72448609311b8ad8b92ae5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
f584a407700c2f2bc54a9df2a200cd48

SHA1
65651fe287081af6b90b1423aacc28017399e1b8

SHA256
77e8fe3faddeb31c89672467d699fbe79741222a81f60c33a323212cdfc83b21

SHA512
9135845f9cf4a21e7bad9979a11bdf27519b45264207a692be982ac208faf33c922a1caa5f90c964f19ce33993995f196dde11efa4c346b10db332d6edbeb980

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
2fd608472e3470f3c9bb141d677fb2c1

SHA1
5b8d45ce1a11246c8dce71632834b0e44d697879

SHA256
dea7e85b9139621382249babb4602a271b9824f1703aad849c655cacbe98f352

SHA512
51a318782aef89986fd79b65e4d4e6b5c6c574e4cb6d994574d5cd1e83bb88f9881acea84661e3bc114ab99802b6f7ae1c32f8cf341c78de93905983342cef28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
f7400c12f2955d778d238f678d37be03

SHA1
8fb86f002f7b40809171948a839a4b96778e64eb

SHA256
05368b138cc7030cf7c10ec6ed4e522580d40e36800158002684342ee269d54f

SHA512
7b2183a5cb20305349c3ab7d4164bff6110ef6e21ed59554bf4d98cd69dba02d78160a77afe4b4d0a09caad527d95911f6c431c1d3eb5e471bf9f8f037d2cbe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
0dae9d835fe2d93a272ec76a388ea0d6

SHA1
d649294cf655f1e325f08b024542f879395c7b55

SHA256
43ad7a46440c56ce55b1a0496feb2740a1b67f4ef1dda711555674aba8e082f2

SHA512
0bf2c7ff5a9869bb4cb1b26a8cf645c47f5667da32ade18a429b211af46f428cc4143239d9d339521f8b290b118a994f0babaabb21c54520f4f8a10d8c482cea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
76de25f1620bf1ed797e571cbec88d30

SHA1
d387ea99f421b0f602fd54fcc4905301856b0535

SHA256
95de6e654547075390b97bc32b68dd3901a817cedcfd7b8a803a2a132d1e69d5

SHA512
703d3d74a8d912180c15ea563776ec5eefb42807f5ca62416d23b253ec8aaf1e788b87b35b8b97e1338c5b327b15cdb27188ed9bef92b8d6e959daf512f6df44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
1da0ad98a52ac9d0193ee19976e436b5

SHA1
fc006018797adf52fac0237a64301b2e98b63df9

SHA256
f2330606da711c89ff2b89925d01dd537a7408fc969a61e62b05fed955c3395c

SHA512
366d29dc70ad48ad8a282437f02e98771fefab7f67748bdea9130b14b07465b410bbc477318657d6877f391fe6f5aecd2b7aebb8716cf5476192244ecd86506e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
8ccd44a94c3cdf971c14a96e06b54ea9

SHA1
35f1b799b3eb562e1274432803be009b45fc727d

SHA256
d734dd676397b3dca0174cfdf0eb123f3ad18be062e8e1f0f1ad7ed37d0ab287

SHA512
cedd71d0fb1d03e5708b468ecb10ba97daab6eb1a0e2c6b7bc4b6562cbec65678a615910c7c35633d2fa7d449a3070776fa2afb65e8c8e6cde26365c93573e3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
4992672efaaebabee5696fe392678924

SHA1
af14d2b34dc960c9a1cba2c36f3c4b215fb68467

SHA256
74a7c18e4602218dea287978c67dacdfd38d09e422240bff27ea197cad76785c

SHA512
d2186d89b7b7548bb8f300d179587ae586efb74697719324ceb2b0e36731593ff4542ebd0ef5a082bc230514ed93aa688579dae70460f572ca81c2e8270eaa14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
aadc9c2bebb7492e20714e0ce6d02e60

SHA1
bd36e937ae4cb787e4becbefbed53961237ca093

SHA256
5ba21e2d0deeb84b6507a44a9ba967349a9a11def208c4c0b112f6c1a7d67c21

SHA512
b532e1520eb9fa5f8ada2496a7cf48b6f25e0045979a25d1725f57d952f876dc55cace4eb1ea35f7deaaf6ba5bcc5e3ab37b01ac37ea3b63837d72b70cbcb053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
ce750afdb275e0876efce3b2f170acce

SHA1
f3e5f91046f52f90acdf0d5fe752b13d6ed53094

SHA256
bc528cb53fabf2124ce0cdc721ef2a4a77147495ba35cf6d232bc207cc18a1fa

SHA512
8fc50e193736ddc637b1817cde1a3e484e185feab18d654235506b2e8f0d6e47f295d30bb8cd248aa9203a1b226987b78233b3d2de5df7519f78e7c485fa1de6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
bdca651cbc1691264130f49262681e7f

SHA1
41f4b5329aa1ac9d180246249c4b4792ef54abae

SHA256
41223ce2ab9dd4404850e561cca562e9b11ecde22a7cdcdd32d7f742cc15223b

SHA512
44cbbcf7c56a87af2a161cb273f2022a78d9aa46cc1f0d6555836226c4ca36e564f9e7ef3c8c677f3a1640c595d7508b13eb3ea530c751307b7f88dcd726ac1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
26184197be6f77e5c45cb0bb0e9bb2e3

SHA1
554e9348d24a0af5addec96368a0bbaf288f69c0

SHA256
32fe06ee0b2f26fd48fa3636ab68942ae6ed346b2d1e69cb43bd6f287959ac1d

SHA512
5318781039d53bd00054815bc6b503aa8e29e3f177257ebb662aa79d1ac75e5eb08185db7d3084dd8610b835be6dadb297edc47ed70f04f55dac4ff5e456bd30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
fef5e07394dd5db97b595ac78c885911

SHA1
0339095071c6c7a7be567de4d701a29b7dd7e113

SHA256
fa06a014d0ac33ab2b3f118d0390851f5ded56f12493dc05b51dd0888a040fad

SHA512
946293c16a611ac1ffbb390c1696731791ccc245b845e48f15fc960caf0368a3b2ac431b79b8d5d963923bc6b8151714d2d6b5eab41760bcffb067692f71ec20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
002050f873743f74406f65c24250b650

SHA1
87a2b8634a9dda1c8f3b44e70609b1d9c858d2c3

SHA256
90b68b63d97cfd022a949d594321c7baef91e7cf699c46643f4500cd4a193927

SHA512
10a5bfe52da593b4e9d9e65689e48df337e4681cf5c1a891a4389456cecf40a6c58d586031a1d917244654716bd3cc7dd31ec1395855f21aa42bb7c6f7f0e630

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe596f98.TMP

Filesize
536B

MD5
4ce696558ce3d7e3d90eb932479486ba

SHA1
885e8ae57235872488827d26ff2a2d063e88d615

SHA256
84b8ec03bcaa8b7458135d41d6335749ce8997f19e6cb896203e93d1a1edc3ab

SHA512
3cf2139025bebd105022d1d77d8b77d3195c16fd7464a40835a25d3f27dba9bcf2e102ff09474e340458b69e5f1c867894fb9d40b192b170814fe46b04cbf773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e61b3f98-5fe2-4599-b5cf-59fd4940e021.tmp

Filesize
14KB

MD5
5fbc1b68b192439dd84142ef104b9975

SHA1
feb595ba681d83c9752385ac5b3cfc165ea42645

SHA256
aa07e08bb5a98c8c4c494e72b4f492c0b2b7eed031c65f5ba6a59bb97400a8e8

SHA512
534879a0647d6fb83c5bacc8439a9ef9d6c465c78c806b8e0aef8325b637f5d376f9b1981b3d37b9ea9a701eb7ba9aa4733a735f091ef4783a5e87090907c46e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000010

Filesize
26KB

MD5
8235f98068f731038d8520df4727c625

SHA1
6ef1e3ca36d59de490e593ec195b632e8e09565d

SHA256
98280dcf81e7ed7a29b2d383c12027481bf771aa6358012ee5ffcc8b3af21e38

SHA512
d75d4b688898ee9c9ee07f7be6e9dafd0154518ac54042270666969dd15dbc3b7c8cf92997c510f42f20a5ad8270d5324dd8f2ef91666a9d6d0450d60bacfd83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a4bf8cb6fb868aea218f2ce263e19fb1

SHA1
bf598768a62b29463563870d14dec8635a9f9a50

SHA256
0796b6cea39ee8c3426c71834e293d299686e414dcf61f63e84d1077d2504efd

SHA512
e5201549a4c2b75c13be8dd2f8a4582871c61fa4acff68db7d7f1dd0828886f73e222265a9bdcdc1edbb8d6e25ff4d0daa603ce82ae76516c8c847bfdf8e1084

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8bc55fb5b54caa1fa2d3b10843c9e220

SHA1
69812facf01bd4fca0e759cf490826d54e883d58

SHA256
6e8abeeb1f53241cf21f60d1b1f6e4e04a7eff5b65fc322cc92f3dd4573085c3

SHA512
c0d4819083e53698751d701c5ce2a1d018492f1c78792ea294d7cc7b6a56f8885ea9b16cc814269334d39b1411ced096da31acea2a83e47355534b46a64dc483

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9207f077896a52fd5db84dd1fb8733c6

SHA1
1772b854aff4a6d7da00b37ec445f76951ca6b33

SHA256
edc562ee2d027f711b59e04af6a088f3f3440471bf9a951a872030bbcd03712d

SHA512
91298ec3598483d1d37218bc141adda6ff134e87ffc283be210afaf94e94d328e6c978d5dd8c68da833d8da7e8dc266d151f023f7879fcc8d81bbf563769ab11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8424b8afd6cf83c4b274668271551f9c

SHA1
f85bfe8a62052e3e917714aaffdd6045369a6525

SHA256
bb3a4aeee07a6ac360342b8614bbbe71b7e8d1459052dfeca2468abbf625cc5f

SHA512
130bba854c3685ef6f06a3bb8f79ec7d88b8ec08ae0eb483b4389055f85649268c047f59eeca5715d950aeb0bb445268fb5f5d4704a9e2f000165bb45496d964

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4d7b06383405ad033329f804e2635ae0

SHA1
23bb20b6190e7eece3cd66a2738cd98884662c8d

SHA256
6118ba9f9470d05ad5b802d1a075c4b5117575e73e6880fb4fce38ff17233f58

SHA512
4f5f20f83b67ac8de88975b1b2cede2d17b77af1ae5afd8c579d20c4abaf4a979cf566556f4c06757d09af46a03b6db43a799a09a0b6e4d830967ddbd033b0e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4331bd8284c91841d97bb34a83c45b46

SHA1
8d7686906f003d6b53adc46cbc10a8bbcdc0dee2

SHA256
c9b66bb3bf3fb5ed637a2cb8e55d9d9c96b450f087d7beb524316aa75da82a1b

SHA512
43dcbc0d928ec08e4a8047479f9ba5a7b2c049265e1bafe3375d75049e2db0ce9521c5d394c2fad3b75d2950eb7931d1c6e71e251f685f4ce799d9cd79212fbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cf38854376a8f7f24368cbaca6e799b4

SHA1
f3f436cc7dee8566ff44ade5febaea544af2b8a2

SHA256
a29acff6f1e0b506c08d7a40ee1389b29aa87d7dfdc4b2380dbeabef297c58f2

SHA512
24f520c97d5599f457a6af8143719bfe5219098e9c9dfe2f012b20e459a9e2aab25167d2b07f00cea3133e9fba23b6cb351063d0633c66c7872420068f8eb0f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
10a5de026685fb1bab4c12433ad8a318

SHA1
d1a2bc7fea1bcc13ee5f186a7241b78c9f79cbc7

SHA256
e8bc1ca7e4e82b047e3170bc9ebf7e9833a8fbd8b6d2a688475f1cb18d8e0083

SHA512
aac2fdcd7e36abf8a1c958bb4bb2155da669b42b4b537ac5b0eb6e7090fbc210e736d0eb01e931123ffab14a9c219a6490c14f19ea71fe82d3d1cd7036aa9654

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0ca93f15b4fb09d7559fe1710faaeaa0

SHA1
c4b26afe33fe6c27bbfa4684571d07466babef93

SHA256
5ef64cc879c80cc5b52566ecd74108aa34a209e4821bb3132f044c9798c9c028

SHA512
f7de8c7ea6b605870666c5126ab88739f7d4c8d1be62d996d65ce1b7fc47ba1662f85c75411a44995f2e6e6865efa38c0ae5b88c16c98a8f82b915bb3cea18aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0289ec5b253ddd4fc8a46cd85fccb172

SHA1
4cfd84b7a0b239038d2191ef480cdb58ac826028

SHA256
eb4e5f464fc5120f13161807e1f84bfcf10a4e870fb8d8f509665c16d8b4ed46

SHA512
2066a765c9b4f0607323886e962fa0c19165970205ad5a34241d314a897ed872011d24a78895f57220bda8eceb5dbb39c079bd7295044a5a2551d9bc8875ae84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b6950e69da154db394421ba8ba97ce69

SHA1
85be8aafd3e568fe26847fa095fda95679af61f1

SHA256
b3fedb9306cfd0e0b50fb34938fb9845d2f1d7feca7b317e0a729c68e7ec83e0

SHA512
e13796d0a7b0e6b099854d4d31e40b3d10e8fa58aff78c33684e6d335abd48c2f8299d1f4fce6466ad612ca935dafe94a4608d9a414f04f693bec49719c98eb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8c68ef9977aa27fafaca9adabc6d2773

SHA1
69ed768071621e74f1fb4ecaef083dd94ddf3f53

SHA256
fc2157e0bc47455fb34d953c56d263f01b7de8481990b17d5b5853708cd318ed

SHA512
0adbd3a3aeb4f1f51eb2dd278da6d21774708d70fbf2eb7e0e6ae0157d9ca3c596d97c5f88461443723b25b3fe26071f9b524ab18a10ff763454fd7fc82bffa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
98b69f732305fb4adb11357c6ee2e663

SHA1
dfdbbfeabfe9c5c4c31632f23230e955730e1e49

SHA256
fcb8e5f10947da2cf12b8821fe35b4f2af0e5c622ae7a6cd751b193d7ea34e62

SHA512
b536abb99759e2fb1b8944b367f0c3e0a24cf1942239d80504a63eff4be5f38e73b5ca6d3741f3dbdb55a374e82577cfb45ad9f519ca3003b356bd5303acbb5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
06efe181c7b176179e2231cc923cde04

SHA1
6f0facca46d298654489ca7bf56a8479ee2cee26

SHA256
790a6546ec21fc3fa55c77920fb04ca62432cc4cdd0ee3e58b4b4ec501fd1b88

SHA512
02e1b4ca5fd228c6f5657c5ab1402184876ff8fd1c0ebb09930c9abef7a2416a4a589ffcd771e78c79a52238bcf07b7da40de96b6fbf117b90b68b03b1ed57bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b4bca4562812b7ff7212f27e05323d42

SHA1
652b5e2713f1ae6b8fd335a550c7b8afc419596a

SHA256
b3a34827b1dd1305e50461c696c09428f7416ea0faac31f652525408bb0eff7d

SHA512
5aff3c89b1eb3625acd7d31ca25a77fc2085916bd2ff36744e0c8a39830b5cc2e9c62f7c5e74c6f921f564efc1dfe9990ebc1d55160759c59707b1efa1fcd602

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8811ac65c38e09480cec8ec5f0f75785

SHA1
81163be208967f6c475fb85bfeb04d801aa87299

SHA256
db1d80ab6dd5002d95f01e3085b1e4de56333bfa836242c6a84a141e46f4603a

SHA512
76bcda13970a931efa945d764d60586d18458edce7447847d7376b334bedbb4496a249ba33c80f8d28a4ddf6f09a80a26430b1960442ac385673a73700519830

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a95f1cc7901fe9db1acccd22ae4a7117

SHA1
e4227a48b3c51bb4cd0f08d4566e4afa803eef62

SHA256
4385b208f519924f66b4a26c456089e4d860846c7cb456496cce5f5754a12944

SHA512
2f6b63288fd6b03e08bc3e92fa5266fe2a14837c826ee3c74763c34c2700bdbd4451ebafd5cb7386035345892ca728dba9437a08524da36b53699f9b322f568b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4674910a0ba0c8391139672a30197d53

SHA1
a983fabc307b98049efafb7af6b5545c0d011311

SHA256
f7b6d4e710c9d8bd87ca7a036c79113c820739dae829f1e1c49b5f4fdc0d826b

SHA512
5d3073737419a61242e05ac34309c301f510e1f8a5db00fcc1e641fc2a1f84c7874e804fa131a05f991fcfd09fe5fb5c577a8daa2a06f8be567a4014228d2377

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
33ee6e9f3935f01c2a9bf35d9cbb8880

SHA1
497b12c96166db2da7d85b586d723de40aa5d00d

SHA256
8584b2b7251adbc920f4dc0c6b6787e76ade4bffc53309b2df5fa0c0dc0533ad

SHA512
1bc0e3bc8a651b037a90d8b6bee2acaa4010bf82bcb28f68b8bc0ddc803f376429f402d4fae4d5bff55e63cb4167c3f116e41b2135d6cc4565fedd40c9965bcd

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\161be82b-f0bc-4cf7-bcf9-32890a900b34.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
711f1a880c08e1f7867f1bdd117320b7

SHA1
50c2d0859f6fd41024d486e2ab537507b975991d

SHA256
f868e98aa21c341e365d73e301d87c006b557033d8d7b2808fed207734fe5143

SHA512
885c2abd9047727b33ea760836cbbe4eaf5fddc08375a8b37840c99332131f0f7164f87c0abeb4523f42262349ab12a1c22c12813a9d81d6955c7d20b41a9a0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\$inst\0001.tmp

Filesize
8.0MB

MD5
8e15b605349e149d4385675afff04ebf

SHA1
f346a886dd4cb0fbbd2dff1a43d9dfde7fce348b

SHA256
803f930cdd94198bdd2e9a51aa962cc864748067373f11b2e9215404bd662cee

SHA512
8bf957ef72465fe103dbf83411df9082433eead022f0beccab59c9e406bbd1e4edb701fd0bc91f195312943ad1890fee34b4e734578298bb60bb81ed6fa9a46d

Download Submit
C:\Users\Admin\AppData\Local\Temp\$inst\0002.tmp

Filesize
8.0MB

MD5
596cb5d019dec2c57cda897287895614

SHA1
6b12ea8427fdbee9a510160ff77d5e9d6fa99dfa

SHA256
e1c89d9348aea185b0b0e80263c9e0bf14aa462294a5d13009363140a88df3ff

SHA512
8f5fc432fd2fc75e2f84d4c7d21c23dd1f78475214c761418cf13b0e043ba1e0fc28df52afd9149332a2134fe5d54abc7e8676916100e10f374ef6cdecff7a20

Download Submit
C:\Users\Admin\AppData\Local\Temp\$inst\0003.tmp

Filesize
8.0MB

MD5
7c8328586cdff4481b7f3d14659150ae

SHA1
b55ffa83c7d4323a08ea5fabf5e1c93666fead5c

SHA256
5eec15c6ed08995e4aaffa9beeeaf3d1d3a3d19f7f4890a63ddc5845930016cc

SHA512
aa4220217d3af263352f8b7d34bd8f27d3e2c219c673889bc759a019e3e77a313b0713fd7b88700d57913e2564d097e15ffc47e5cf8f4899ba0de75d215f661d

Download Submit
C:\Users\Admin\AppData\Local\Temp\$inst\0004.tmp

Filesize
8.0MB

MD5
4f398982d0c53a7b4d12ae83d5955cce

SHA1
09dc6b6b6290a3352bd39f16f2df3b03fb8a85dc

SHA256
fee4d861c7302f378e7ce58f4e2ead1f2143168b7ca50205952e032c451d68f2

SHA512
73d9f7c22cf2502654e9cd6cd5d749e85ea41ce49fd022378df1e9d07e36ae2dde81f0b9fc25210a9860032ecda64320ec0aaf431bcd6cefba286328efcfb913

Download Submit
C:\Users\Admin\AppData\Local\Temp\$inst\0005.tmp

Filesize
8.0MB

MD5
94e0d650dcf3be9ab9ea5f8554bdcb9d

SHA1
21e38207f5dee33152e3a61e64b88d3c5066bf49

SHA256
026893ba15b76f01e12f3ef540686db8f52761dcaf0f91dcdc732c10e8f6da0e

SHA512
039ccf6979831f692ea3b5e3c5df532f16c5cf395731864345c28938003139a167689a4e1acef1f444db1fe7fd3023680d877f132e17bf9d7b275cfc5f673ac3

Download Submit
C:\Users\Admin\AppData\Local\Temp\$inst\0006.tmp

Filesize
1.8MB

MD5
b3b7f6b0fb38fc4aa08f0559e42305a2

SHA1
a66542f84ece3b2481c43cd4c08484dc32688eaf

SHA256
7fb63fca12ef039ad446482e3ce38abe79bdf8fc6987763fe337e63a1e29b30b

SHA512
0f4156f90e34a4c26e1314fc0c43367ad61d64c8d286e25629d56823d7466f413956962e2075756a4334914d47d69e20bb9b5a5b50c46eca4ef8173c27824e6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL

Filesize
73KB

MD5
81e5c8596a7e4e98117f5c5143293020

SHA1
45b7fe0989e2df1b4dfd227f8f3b73b6b7df9081

SHA256
7d126ed85df9705ec4f38bd52a73b621cf64dd87a3e8f9429a569f3f82f74004

SHA512
05b1e9eef13f7c140eb21f6dcb705ee3aaafabe94857aa86252afa4844de231815078a72e63d43725f6074aa5fefe765feb93a6b9cd510ee067291526bb95ec6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTANM.DLL

Filesize
40KB

MD5
48c00a7493b28139cbf197ccc8d1f9ed

SHA1
a25243b06d4bb83f66b7cd738e79fccf9a02b33b

SHA256
905cb1a15eccaa9b79926ee7cfe3629a6f1c6b24bdd6cea9ccb9ebc9eaa92ff7

SHA512
c0b0a410ded92adc24c0f347a57d37e7465e50310011a9d636c5224d91fbc5d103920ab5ef86f29168e325b189d2f74659f153595df10eef3a9d348bb595d830

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTCTL.DLL

Filesize
160KB

MD5
237e13b95ab37d0141cf0bc585b8db94

SHA1
102c6164c21de1f3e0b7d487dd5dc4c5249e0994

SHA256
d19b6b7c57bcee7239526339e683f62d9c2f9690947d0a446001377f0b56103a

SHA512
9d0a68a806be25d2eeedba8be1acc2542d44ecd8ba4d9d123543d0f7c4732e1e490bad31cad830f788c81395f6b21d5a277c0bed251c9854440a662ac36ac4cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDP2.DLL

Filesize
60KB

MD5
a334bbf5f5a19b3bdb5b7f1703363981

SHA1
6cb50b15c0e7d9401364c0fafeef65774f5d1a2c

SHA256
c33beaba130f8b740dddb9980fe9012f9322ac6e94f36a6aa6086851c51b98de

SHA512
1fa170f643054c0957ed1257c4d7778976c59748670afa877d625aaa006325404bc17c41b47be2906dd3f1e229870d54eb7aba4a412de5adedbd5387e24abf46

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDPV.DLL

Filesize
64KB

MD5
7c5aefb11e797129c9e90f279fbdf71b

SHA1
cb9d9cbfbebb5aed6810a4e424a295c27520576e

SHA256
394a17150b8774e507b8f368c2c248c10fce50fc43184b744e771f0e79ecafed

SHA512
df59a30704d62fa2d598a5824aa04b4b4298f6192a01d93d437b46c4f907c90a1bad357199c51a62beb87cd724a30af55a619baef9ecf2cba032c5290938022a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTMPX.DLL

Filesize
60KB

MD5
4fbbaac42cf2ecb83543f262973d07c0

SHA1
ab1b302d7cce10443dfc14a2eba528a0431e1718

SHA256
6550582e41fc53b8a7ccdf9ac603216937c6ff2a28e9538610adb7e67d782ab5

SHA512
4146999b4bec85bcd2774ac242cb50797134e5180a3b3df627106cdfa28f61aeea75a7530094a9b408bc9699572cae8cf998108bde51b57a6690d44f0b34b69e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTPSH.DLL

Filesize
36KB

MD5
b4ac608ebf5a8fdefa2d635e83b7c0e8

SHA1
d92a2861d5d1eb67ab434ff2bd0a11029b3bd9a9

SHA256
8414dfe399813b7426c235ba1e625bd2b5635c8140da0d0cfc947f6565fe415f

SHA512
2c42daade24c3ff01c551a223ee183301518357990a9cb2cc2dd7bf411b7059ff8e0bf1d1aee2d268eca58db25902a8048050bdb3cb48ae8be1e4c2631e3d9b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSR.DLL

Filesize
60KB

MD5
9fafb9d0591f2be4c2a846f63d82d301

SHA1
1df97aa4f3722b6695eac457e207a76a6b7457be

SHA256
e78e74c24d468284639faf9dcfdba855f3e4f00b2f26db6b2c491fa51da8916d

SHA512
ac0d97833beec2010f79cb1fbdb370d3a812042957f4643657e15eed714b9117c18339c737d3fd95011f873cda46ae195a5a67ae40ff2a5bcbee54d1007f110a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSVR.EXE

Filesize
268KB

MD5
5c91bf20fe3594b81052d131db798575

SHA1
eab3a7a678528b5b2c60d65b61e475f1b2f45baa

SHA256
e8ce546196b6878a8c34da863a6c8a7e34af18fb9b509d4d36763734efa2d175

SHA512
face50db7025e0eb2e67c4f8ec272413d13491f7438287664593636e3c7e3accaef76c3003a299a1c5873d388b618da9eaede5a675c91f4c1f570b640ac605d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.DLL

Filesize
28KB

MD5
0cbf0f4c9e54d12d34cd1a772ba799e1

SHA1
40e55eb54394d17d2d11ca0089b84e97c19634a7

SHA256
6b0b57e5b27d901f4f106b236c58d0b2551b384531a8f3dad6c06ed4261424b1

SHA512
bfdb6e8387ffbba3b07869cb3e1c8ca0b2d3336aa474bd19a35e4e3a3a90427e49b4b45c09d8873d9954d0f42b525ed18070b949c6047f4e4cdb096f9c5ae5d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.HLP

Filesize
8KB

MD5
466d35e6a22924dd846a043bc7dd94b8

SHA1
35e5b7439e3d49cb9dc57e7ef895a3cd8d80fb10

SHA256
e4ccf06706e68621bb69add3dd88fed82d30ad8778a55907d33f6d093ac16801

SHA512
23b64ed68a8f1df4d942b5a08a6b6296ec5499a13bb48536e8426d9795771dbcef253be738bf6dc7158a5815f8dcc65feb92fadf89ea8054544bb54fc83aa247

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT20.INF

Filesize
2KB

MD5
e4a499b9e1fe33991dbcfb4e926c8821

SHA1
951d4750b05ea6a63951a7667566467d01cb2d42

SHA256
49e6b848f5a708d161f795157333d7e1c7103455a2f47f50895683ef6a1abe4d

SHA512
a291bb986293197a16f75b2473297286525ac5674c08a92c87b5cc1f0f2e62254ea27d626b30898e7857281bdb502f188c365311c99bda5c2dd76da0c82c554a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTCTL15.TLB

Filesize
28KB

MD5
f1656b80eaae5e5201dcbfbcd3523691

SHA1
6f93d71c210eb59416e31f12e4cc6a0da48de85b

SHA256
3f8adc1e332dd5c252bbcf92bf6079b38a74d360d94979169206db34e6a24cd2

SHA512
e9c216b9725bd419414155cfdd917f998aa41c463bc46a39e0c025aa030bc02a60c28ac00d03643c24472ffe20b8bbb5447c1a55ff07db3a41d6118b647a0003

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTINST.INF

Filesize
7KB

MD5
b127d9187c6dbb1b948053c7c9a6811f

SHA1
b3073c8cad22c87dd9b8f76b6ffd0c4d0a2010d9

SHA256
bd1295d19d010d4866c9d6d87877913eee69e279d4d089e5756ba285f3424e00

SHA512
88e447dd4db40e852d77016cfd24e09063490456c1426a779d33d8a06124569e26597bb1e46a3a2bbf78d9bffee46402c41f0ceb44970d92c69002880ddc0476

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSLWVTTS.DLL

Filesize
52KB

MD5
316999655fef30c52c3854751c663996

SHA1
a7862202c3b075bdeb91c5e04fe5ff71907dae59

SHA256
ea4ca740cd60d2c88280ff8115bf354876478ef27e9e676d8b66601b4e900ba0

SHA512
5555673e9863127749fc240f09cf3fb46e2019b459ad198ba1dc356ba321c41e4295b6b2e2d67079421d7e6d2fb33542b81b0c7dae812fe8e1a87ded044edd44

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msvcirt.dll

Filesize
76KB

MD5
e7cd26405293ee866fefdd715fc8b5e5

SHA1
6326412d0ea86add8355c76f09dfc5e7942f9c11

SHA256
647f7534aaaedffa93534e4cb9b24bfcf91524828ff0364d88973be58139e255

SHA512
1114c5f275ecebd5be330aa53ba24d2e7d38fc20bb3bdfa1b872288783ea87a7464d2ab032b542989dee6263499e4e93ca378f9a7d2260aebccbba7fe7f53999

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msvcp50.dll

Filesize
552KB

MD5
497fd4a8f5c4fcdaaac1f761a92a366a

SHA1
81617006e93f8a171b2c47581c1d67fac463dc93

SHA256
91cd76f9fa3b25008decb12c005c194bdf66c8d6526a954de7051bec9aae462a

SHA512
73d11a309d8f1a6624520a0bf56d539cb07adee6d46f2049a86919f5ce3556dc031437f797e3296311fe780a8a11a1a37b4a404de337d009e9ed961f75664a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF16.DLL

Filesize
2KB

MD5
7210d5407a2d2f52e851604666403024

SHA1
242fde2a7c6a3eff245f06813a2e1bdcaa9f16d9

SHA256
337d2fb5252fc532b7bf67476b5979d158ca2ac589e49c6810e2e1afebe296af

SHA512
1755a26fa018429aea00ebcc786bb41b0d6c4d26d56cd3b88d886b0c0773d863094797334e72d770635ed29b98d4c8c7f0ec717a23a22adef705a1ccf46b3f68

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF32.DLL

Filesize
4KB

MD5
4be7661c89897eaa9b28dae290c3922f

SHA1
4c9d25195093fea7c139167f0c5a40e13f3000f2

SHA256
e5e9f7c8dbd47134815e155ed1c7b261805eda6fddea6fa4ea78e0e4fb4f7fb5

SHA512
2035b0d35a5b72f5ea5d5d0d959e8c36fc7ac37def40fa8653c45a49434cbe5e1c73aaf144cbfbefc5f832e362b63d00fc3157ca8a1627c3c1494c13a308fc7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\andmoipa.ttf

Filesize
29KB

MD5
c3e8aeabd1b692a9a6c5246f8dcaa7c9

SHA1
4567ea5044a3cef9cb803210a70866d83535ed31

SHA256
38ae07eeb7909bda291d302848b8fe5f11849cf0d597f0e5b300bfed465aed4e

SHA512
f74218681bd9d526b68876331b22080f30507898b6a6ebdf173490ca84b696f06f4c97f894cb6052e926b1eee4b28264db1ead28f3bc9f627b4569c1ddcd2d3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.dll

Filesize
1.2MB

MD5
ed98e67fa8cc190aad0757cd620e6b77

SHA1
0317b10cdb8ac080ba2919e2c04058f1b6f2f94d

SHA256
e0beb19c3536561f603474e3d5e3c3dff341745d317bc4d1463e2abf182bb18d

SHA512
ec9c3a71ca9324644d4a2d458e9ba86f90deb9137d0a35793e0932c2aa297877ed7f1ab75729fda96690914e047f1336f100b6809cbc7a33baa1391ed588d7f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.hlp

Filesize
11KB

MD5
80d09149ca264c93e7d810aac6411d1d

SHA1
96e8ddc1d257097991f9cc9aaf38c77add3d6118

SHA256
382d745e10944b507a8d9c69ae2e4affd4acf045729a19ac143fa8d9613ccb42

SHA512
8813303cd6559e2cc726921838293377e84f9b5902603dac69d93e217ff3153b82b241d51d15808641b5c4fb99613b83912e9deda9d787b4c8ccfbd6afa56bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.inf

Filesize
2KB

MD5
0a250bb34cfa851e3dd1804251c93f25

SHA1
c10e47a593c37dbb7226f65ad490ff65d9c73a34

SHA256
85189df1c141ef5d86c93b1142e65bf03db126d12d24e18b93dd4cc9f3e438ae

SHA512
8e056f4aa718221afab91c4307ff87db611faa51149310d990db296f979842d57c0653cb23d53fea54a69c99c4e5087a2eb37daa794ba62e6f08a8da41255795

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tvenuax.dll

Filesize
40KB

MD5
1587bf2e99abeeae856f33bf98d3512e

SHA1
aa0f2a25fa5fc9edb4124e9aa906a52eb787bea9

SHA256
c9106198ecbd3a9cab8c2feff07f16d6bb1adfa19550148fc96076f0f28a37b0

SHA512
43161c65f2838aa0e8a9be5f3f73d4a6c78ad8605a6503aae16147a73f63fe985b17c17aedc3a4d0010d5216e04800d749b2625182acc84b905c344f0409765a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\scary.mp4

Filesize
2.8MB

MD5
0d879ddf745b749cd646d34387bc4aca

SHA1
988205a7d8ad9d5ad3b095f80f550b541484331b

SHA256
1cd0120aff9faba941930b898d00ee722695270a11c999fa3af5301b68841a33

SHA512
ad840d5f6ff9cb28e6e5d7ae7cc2c1e3cd521aaa94415b84fddb4b6e4efbfacc90764b70acd5f533422406a6ed7c0018bc07148ca29d39250762ea4a223d3be6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe

Filesize
1.1MB

MD5
0de74c3cae12232bcf07e9aeb2d2f48b

SHA1
bfc9084d80b914a20abfc0c3916ff9794dfbb20b

SHA256
73bfc2bfaa15b4b701bd5b01516c3718e94cd20d1a9d996fec694c4ebe179390

SHA512
a9e5d74b896cc67be19b8e1dc9a5e31d659a3f47a2f259f73d821bbf48b154e2a446a20a7cf3a524cddcab0f88de8a66e11169aa9d4ac26a614bca7a719cd2a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31602\blank.aes

Filesize
78KB

MD5
ca82ce6b87ecced8730bb513faa685f0

SHA1
2f60aaa6902c91058ea217e4334c6e419455c5fe

SHA256
6e1a455f3d0263bcadd276a15ced9c078edd746397be72df602a6e71ce9740b6

SHA512
25ac361811da1ce6027c5ceb6edd3c0912be5ae1d7fa9452c51df1074b5114c6d450129ff6e933e213570f572bd62911677f7812db891d68a5ff040b70f1c859

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lqpipblp.kw5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\evbF985.tmp

Filesize
1KB

MD5
22e74d4f7319a0673ec1bfd6f4e4fcd5

SHA1
dc17e4e0be07e28c9bac057659802fbe0bf6f8e8

SHA256
198b62fa12febba6dda639b6d2029991328f520104187c28397d77f49ea53e03

SHA512
5abb6cb31374f4fa3769d1639bf7154e0a83eb87d9ad82f873e558316b4b50c35959766f71b1be9e8acdb9ae186ab0c7080b7342d2f3a58d5eaff4da9b7371d6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
f55f78fdca6966322de8a87ca5948fc6

SHA1
d789dd0f81e06336798c905803aa416401c68008

SHA256
14f6bb6aa8dd334ae3d8024cdc889c9d79bc911be7be4991761c08bbcce618c5

SHA512
7fa0874dbcc43e63d2e1f4c43b9f6605fce409ac06d435ce5f99a3528e9ae3110f8fc6eff4721578ebb4e47d303bda59f7c7c882a9e0bb321e9be6d46edd3a48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
d5926143f9f46ff072bb19db4b5f5bde

SHA1
8ebf66353cd76efa1e2b4c2603460da04b2e2445

SHA256
9372e33904d2f7f35db71d01afc39703d145a4404760a1dde379927494104bab

SHA512
9dea4d580419e8b45f0aa824eb2a2210a70cc63272c16ceebb1042d5cf628fd2eca48987d155084e5c7cc76e026dbbc053c35d9cec32a9726fa59dc9db50635a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
30a72d1952b1d60cc55c9fd3c7052562

SHA1
e9f5736b96059945e596844b0355c3b77bee6107

SHA256
93452f38c85e4157c762d379bc1867443e0a191e32d8aa5824f6e511352d248e

SHA512
6d3bc3109d6e9c991e1037718e5a3e78f6090db13fc8301d42d997e45061d8875a941ce949ec78b56d086e784d360c78b28293244cfbc0b747df3e09e36de07a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
15KB

MD5
009172b7d709dda9c55fc6d8194ef834

SHA1
fec41b7c639ca303c370480f96402fedfcfe83db

SHA256
4e98be6eab9c6eccc6f22262796eaa8589164604315217fb362f24c1847d39ed

SHA512
c4175b545ce769bfaaebce231734734148a0defb88a97211391b2e38af2907905f78d148c1a959d192241969c43895436eeb35b5d5c0ad938cb6703c630264a5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
3f50eed985952e1f8b2fcade378b008b

SHA1
a96915e6988b2774eb3ed88ccb78e39d400b01e9

SHA256
d47bbf899a7f09528c511407c8864649550e6f5617d5fca8a7a129cf9b329829

SHA512
a86027b709c3bf6a83a0751332fda63852b4436465bd612e01645387258fdd2be7a93cae6f486e9596ff9d4ccbb0df23c052b4b7ee464293122ac82e28f19e4d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
6bd149128d972c7eb837924ca183fd31

SHA1
bcb2c74fa8c621ee220cfaf02b0c962e727e1276

SHA256
0790bf53b885c5a2cd43feec214f50c7c12c10f64eaeca359fee26afc4f23650

SHA512
5b7098a91cdd0bc1690d1a295abcba935102284708bb1c6d80f17f8bacfd934c7d6f93600136a45ca6236b5d491db3ebc91a2906fd5cb7d013d74567c971212a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
551d9ef735ce7d418d0aec858d1994d3

SHA1
5fcf93e43b39c516c3830f2f17b456916a52f41a

SHA256
4d271fbe6defd2ac8bf7b8e47304bc1ea425283f2c597750dc1a52ffeb7ef6f6

SHA512
7b326ca6330e6b41b2b4001c347d733e6783af15699e9166f237ee8e3826e609756dd988cebc416762f03da911e7ff26a7b7a0742e09ec49ff05eefd3e6f1fb3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
533878ef6fe766278afbe739f658dd93

SHA1
bf35eb4b70e828cc08c8e3c6ce2bd3ac691222e1

SHA256
a7f475e625b85039a08920845bef165b3a80c7091cec3ef0426f182e67cfbcab

SHA512
4e8ab12b5e8e2f9c5f16d61f5d5eb669a606ae4665bfefaa5f28ec0be6a5851ff5ec4d0fd31706033f3d279b48331278f2011f555a43931edb6197ebd01ebd83

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
10a178a977f3b0b9db595a6f0feb2e74

SHA1
ea85a63de1c59ca7989f6d7e54f1fe139f291e08

SHA256
7235e0431b11657995649f21fa3b040793b05257d79e1e983aab6eb44c1adcaa

SHA512
583a51db4a80ab634d63156ce8b123597d3297a3ccce1f16d62862e11428d0a65d50f85aef566095db9b854c3ba9aa9b9be786adcbf9ca50033c52d22f2f3abe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
4fdac313617ce424f3b0bc4fb3d178a0

SHA1
1e28c6f0422d6db4194748a9b367d5805aa30542

SHA256
4de8ad1afa367e8ad5512ce4d781ae22b1b13241c55c77661c4bca5a74035821

SHA512
7680c952fc27eded60c3fcb7b78a13b97dc48df5cd62e8f1c5ea21ef8e4fe498d52b4dce90336da6760f37fb98206b9e76b7984083df5aaa5d6db0cc158b9987

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
15KB

MD5
6d7132cd1d31dd1109022af99b3f401e

SHA1
d337c7062df6d93950134df40555afcbb6b5a3bb

SHA256
ea60ff0c6f79742800d3ad82317c69661042de718b9c54b1264cae2c8461c4ad

SHA512
bf354cdb865e7f208bb388054531c292b07429268092d8641151daf905f331d1dff9768484a3664b0463476ac6c81a69e142b9f996ffdd07eddbe28063f5e776

Download Submit
C:\Users\Admin\AppData\Roaming\appverifUI.dll

Filesize
560KB

MD5
65e4debe62b078db156e5cfbcfc7276e

SHA1
6b03fc8a55f196485a04657d23ab8d81ca882651

SHA256
d22152e04c83d5adad05d5b1226f9f514e5c764263b5fe06d91c55afc050b50c

SHA512
5aa4f93030c71043041a01f188da104dd2c00cdd975662e298e42ed526f0dfdc0d672b111b15fdfa23a6ed2f34f2eaccf93b22c5ae1d4bb400796d5b71ca4618

Download Submit
C:\Users\Admin\AppData\Roaming\conhost_syn.exe

Filesize
2.0MB

MD5
3f60f69797ed77920b88b343fb5fdef4

SHA1
0b7d8a7dc3595bdb830489590f17c1a1279a64a5

SHA256
3a520c9e66fde0c75db090107b371d044e34d416a0ab8ab24d85b1e74b9cfd3e

SHA512
efdde3e098fbc27441d0b24528b3fb2eb257ba53bedd159f90c6ed51f4143fe00d6b808d58e9d9cf7aa2832c56a84003496bef6820124a5a57fe0c3fcbd498b7

Download Submit
C:\Users\Admin\AppData\Roaming\msvcp110.dll

Filesize
560KB

MD5
96ce24dae3de04c480fafa0bffc1fd1e

SHA1
cc4fff43302f874cb13f65b865b6cea6a7052870

SHA256
b0acc95efc739700f2580763f03163eae1cd89db98483097c6989556af13f241

SHA512
af8b567246c7ac329fe0ca546d0f4d13106327a4e713f933208120eaec56acaf1218649ff71ae0034313dbdfb6a883597fded430d44aaedf34e8a6df4cc7429b

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

Filesize
19.8MB

MD5
3ab85ece190bc1319b573603bc4b69fb

SHA1
96241221ea6ade478c7d00abc4c4190e41bb3ba1

SHA256
774d057eb26eccbd81b7154c65efb6a415ccd2553ca5d24fe233f1abbeb6075d

SHA512
5ec0606605107f143e678b8bf6127c6fc4c378581e222f8a9a0ff653ec70a502618537c135f73d49fbd79569f487f70ebbf9381e3745928bbc255c1e79bd8eff

Download Submit
C:\Users\Admin\Downloads\@[email protected]

Filesize
933B

MD5
7e6b6da7c61fcb66f3f30166871def5b

SHA1
00f699cf9bbc0308f6e101283eca15a7c566d4f9

SHA256
4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e

SHA512
e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3

Download Submit
C:\Users\Admin\Downloads\@[email protected]

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\Downloads\@[email protected]

Filesize
592B

MD5
d8bd793047941bfa9243fa52b0386a3a

SHA1
b1cc6adb0e432a531267b11941b7f0245961605d

SHA256
f606ae9e3549aaa6d25e7f5e3c968011e9e417cb6f9000d55fca2b3bf1b5177a

SHA512
34c55e06fc329b8492659c01c4645e8842b5a6e331298f3649b212e731ad74f7d3da9d831b5db6fca0d163a4d72291f6ee9fd26c66f8a6273c7664b65b1f6c65

Download Submit
C:\Users\Admin\Downloads\Electron.rar

Filesize
7.2MB

MD5
bfd191a3113a5771c09ee16379311bb0

SHA1
0155f01c7fec7eb242057426859d32cf47336b42

SHA256
0589e2b862392465ef056a9c21a84566ef39bc33c9bed2831c5bbeaf6fd659a6

SHA512
e7f34854a9e87ce92f2c5a47165bfe1122ebfb2747497759c14fc9fed8b8d3eb0ab1b19a7629355422f2d61ed7087e6aeed446cd74d707c42bae6270264da3a7

Download Submit
C:\Users\Admin\Downloads\Electron\@[email protected]

Filesize
585B

MD5
1c63b01d639e7b27bab6d0e500e3ab99

SHA1
0ae8d1bebd24bfe45c607915ef825c1e53d424b7

SHA256
a92f26536e441c2dcb9403ca09a024cc359553439f938fefac28e17705a7f947

SHA512
7471d6f3e8eab201eb05428ba2e408c3678add95cf872ece0a0f994d3ebdb99edb8b144b3d26263267f46986952d38c21f7f18a7b5258a59403980c53457d9b7

Download Submit
C:\Users\Admin\Downloads\Executor.zip

Filesize
506KB

MD5
1dabfa5490611bca7f979cdd97ea57b3

SHA1
772c1007727904e63468bf9f3f56932c7ae0dfda

SHA256
63f61021a8f7de69c34ac16bb3f758f305a704484b67bf98f61964339e7fdf3b

SHA512
5a940585a3590c6aba4f3f61d08b59be236b8dd25789db63c53a6bc822ebb67d4adf61ca590d0c503c9396e907fd1f0b6c7a25cba461464d833130256b24a5f8

Download Submit
C:\Users\Admin\Downloads\Executor.zip:Zone.Identifier

Filesize
616B

MD5
c3bf1c8dfd4026f4c29665bd5df02fed

SHA1
b63cf4f33cddac2296f42a12b089a484dfc652af

SHA256
f34b64cba24f57179edc8e3a2fa127c9d5e28bea47cdbf127d2f5884cc7c213d

SHA512
ca58e543f15f4bda33c6a4cd543dbe9c2c8e7e8a6becd1da0f363a38162b17475d6458388c343ec16bc6870d2206918abc8ebcc2eb51d3c3335fc51e5b8d0a7d

Download Submit
C:\Users\Admin\Downloads\Executor\@[email protected]

Filesize
944B

MD5
f536c46d9857335f84bb1d47f585c63a

SHA1
a36ac93b3ef97907ad37aab86a7bb644aafdea22

SHA256
54747856671235f7e8fb211ef4fb630dc0c434b5daaf9ee84fb0d05448967e98

SHA512
d939fb0beda7b8fcd77c14da2ff14eea8210b85b575f3b134941e1760bb96b6f8ece0fb544d11c287b5faa87b6b4dd20f1e1c51ffc96aa09d7ca7111b895357f

Download Submit
C:\Users\Admin\Downloads\Krampus.zip

Filesize
390KB

MD5
5ffd58d551c8e43ad90a68dd58ab617e

SHA1
10a6ff99eb062f89d2622398ec3602799833abb4

SHA256
f42c39305ae9cce6622a173a9d1a2b0886ff9edef2cd0957bc111d8a17062ecb

SHA512
f21758e744dedb2c8395dea47b28c6f903e026c5da8614c28719a80d11d24674580c9ea939dc7fdccc31b46d7173d49c36f0072e09b104fd8713e74cb3d221a2

Download Submit
C:\Users\Admin\Downloads\Release.7z

Filesize
10.9MB

MD5
5e1210702cb0718f351a0f50a9d61b16

SHA1
7da7dd1876be62d1f07cc941923e288c4642b8f6

SHA256
e15a215103f8e6c76d048f96a9db5388bc21c7c53b04558db2874a9380ed7007

SHA512
e89b2b320ddd6f66ef1e268b4bb49c92c5097c0b409f6bcfc521a1560003921b9d76873d268995e8c2956dcbb5823c083b673e5bc5930feb063806b98bd283ae

Download Submit
C:\Users\Admin\Downloads\Release.7z:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Release\Mint.exe

Filesize
1.3MB

MD5
f6811eb4a872b2ae55f0e855d6be1494

SHA1
aa69d76a379ba9fd9004db7d67f1c68da66eb27b

SHA256
b3a4cd415ee92b8a0a0a220a85db16f813c862140b5f4a10469cae50f334da18

SHA512
99a0a44fe934bb1efc4311a333ff7e885053498e283180b2a60fa62b40a1aeeca9baacf5875c1af86487ff5486316d4145dc289ba22c8b942fbfc2264280ecab

Download Submit
C:\Users\Admin\Downloads\Release\MintAPI.dll

Filesize
9.1MB

MD5
e85dd2a288a92fd71561a9b4e6873d66

SHA1
d7937e3cefa944cdba4b42c962309e99976d88e6

SHA256
0f5eeebf502950582757fb36cacdf16b7b0f6c482f95ca2a2068523ab2f0d74d

SHA512
384df0becc41033ac45625d4d26898ecf92f8af2139e0de4943a53bef1ac2c47ec0a8e3067bb7e29c1a079ed1b9c0b9840863b3ee71d236bd333fb970a94b1b5

Download Submit
C:\Users\Admin\Downloads\Release\libcrypto-3-x64.dll

Filesize
4.6MB

MD5
2b29fefde1095bad70504c82d37f8323

SHA1
2e2cff1ab2b229cbc0f266bf51a2c08ce06f58e9

SHA256
5527ff18dd749687d886ef7f383463b6ce7bca66c773d6ff94f40190da853ebe

SHA512
c3d52300cad66daa405a4ca44d55708131f15e32a1948018aceae1e6345d56a7c8c130f09e2b035ec8442c4070a040f6f377aea44d9e714c54c673c0d68b7c6a

Download Submit
C:\Users\Admin\Downloads\Release\libssl-3-x64.dll

Filesize
537KB

MD5
5ae31cfaf71fb03d07a2caa4f5f80ed0

SHA1
a9dec69c227ef1c6b3fb6c5296695f7f03fcd46d

SHA256
96dde73df4a2df72d5fc788e1ad99c6adf388cd42c2f874cf8d6a883a3654bf7

SHA512
8c571de5bf27e8ac83be213aa290128db95039dfeaa2fb80698e77ba0a2b3b6630b4aa08a3402585891923b162824b5227b28372a47c9a84de5f9fd0ba2b4f86

Download Submit
C:\Users\Admin\Downloads\Release\mintUI.runtimeconfig.json

Filesize
386B

MD5
186a65581e2f29258f54d396660409fa

SHA1
6f998d3be2e85cb5419205f867135874f27c0a3a

SHA256
e1e0974d0e8833375024eb7c78521b3b5cad4228aad22b23d506cbe702445844

SHA512
7dea87b523aab01ea3c794779b71bc0b52179e1d5e7b9a45539ddd39c775969ef22853c4c193699aec1e3fa3cbe26e90e3a4881226c52a3aacae1eac260ff896

Download Submit
C:\Users\Admin\Downloads\Synapse X Crаcked v3 [new update]\Synapse X Cracked\bin\ace\ace\worker-html.js

Filesize
329KB

MD5
9b72ecdeddb846d5647a815c13516e8a

SHA1
20d5c8dbd11c71497bf675a518f0b370df6d71d3

SHA256
875094b00677b6d9c4b68bd2a8123348ed20965fd55b7d9226cc996e588e4de7

SHA512
83e0cc90195b353d523a708576def71aaf650436538ec6515e58cbc12fb4ea1c143ff1f29fad644a949f1cefe261ddbd482329f2998415f667e89740380ac288

Download Submit
C:\Users\Admin\Downloads\TaskData\Tor\tor.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 417578.crdownload

Filesize
3.0MB

MD5
6dcccbbaeb58c9c1b3fdc5561bbe8d77

SHA1
3cb01dcacd0bb09f02b71ad9b5e3efe7036549a9

SHA256
1a1a3d98457f6243d6e58d2e4493ac40a0bb75eb1f5b8412539a85ccd04028b1

SHA512
048356c36c84eef580bd5a12682fa5dcc9e0da6a13ad5987483c5678fb1e17fd30c5d8ddf49d45040b93a4be876e8963bbd2e07c40eb40a7c7f81cf4558d0f1f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 662388.crdownload

Filesize
15.9MB

MD5
0f743287c9911b4b1c726c7c7edcaf7d

SHA1
9760579e73095455fcbaddfe1e7e98a2bb28bfe0

SHA256
716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac

SHA512
2a6dd6288303700ef9cb06ae1efeb1e121c89c97708e5ecd15ed9b2a35d0ecff03d8da58b30daeadad89bd38dc4649521ada149fb457408e5a2bdf1512f88677

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 817737.crdownload

Filesize
5.0MB

MD5
b837d10b9a71425dbf3d62b2cc59f447

SHA1
85c9ba3331f7eb432c28365b0d1f36a201373a72

SHA256
76c83d1bebd6b01bab76d9a94f223e1a3cf20f2040b8d58a12625074e2936f7c

SHA512
f20999d19c470941c85912725d6f89c5073d475572ece92ce5b8e5425cdf012950f230c353870d86469ab6658bdc504abbb41260cb676f109551860433bcb405

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 886677.crdownload

Filesize
1.4MB

MD5
a141303fe3fd74208c1c8a1121a7f67d

SHA1
b55c286e80a9e128fbf615da63169162c08aef94

SHA256
1c3c3560906974161f25f5f81de4620787b55ca76002ac3c4fc846d57a06df99

SHA512
2323c292bfa7ea712d39a4d33cdd19563dd073fee6c684d02e7e931abe72af92f85e5bf8bff7c647e4fcdc522b148e9b8d1dd43a9d37c73c0ae86d5efb1885c8

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 886677.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 925392.crdownload

Filesize
338KB

MD5
04fb36199787f2e3e2135611a38321eb

SHA1
65559245709fe98052eb284577f1fd61c01ad20d

SHA256
d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9

SHA512
533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444

Download Submit
C:\Users\Admin\Downloads\WannaCry.EXE

Filesize
3.4MB

MD5
84c82835a5d21bbcf75a61706d8ab549

SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

Download Submit
C:\Users\Admin\Downloads\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Downloads\msg\m_finnish.wnry.ANNABELLE

Filesize
37KB

MD5
802369ce2d1888806c51e1fbbb8116be

SHA1
d713556339297ec4c5d2e9d71434552271756105

SHA256
55dca32761e55ef883e953e3599ba53197b186b7babcbf8a339f7e8237cd40d9

SHA512
d9bd3da3d87172df0836a21d090771a6bb6ad0a89dd95684f2e8c498132c1584d92ae3a8f258caa8f843a976daedb20f81935bfdc08c38186c521c84b4c36aaf

Download Submit
C:\Users\Admin\Downloads\u.wnry.ANNABELLE

Filesize
240KB

MD5
773a6cdf6436d31d3ba318ee5b155818

SHA1
2412a78f4b86cf3638f08b37f72026fa956af003

SHA256
f01ea739dc675218e0f942c659f8ee9b8a32f220855df89acb348b41c34c41e2

SHA512
6d50a1207657a2362b637b303ada9c9dcbb681fd3dd85c72f97e4ba96185a96d741caa0843db360bd9fa2fb00a8d96e9b3d2b26861cfff855cbce163c82305d1

Download Submit
C:\Users\Default\Desktop\@[email protected]

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Windows\msagent\chars\Bonzi.acs

Filesize
5.0MB

MD5
1fd2907e2c74c9a908e2af5f948006b5

SHA1
a390e9133bfd0d55ffda07d4714af538b6d50d3d

SHA256
f3d4425238b5f68b4d41ed5be271d2f4118a245baf808a62dc1a9e6e619b2f95

SHA512
8eede3e5e52209b8703706a3e3e63230ba01975348dcdc94ef87f91d7c833a505b177139683ca7a22d8082e72e961e823bc3ad1a84ab9c371f5111f530807171

Download Submit
C:\Windows\msagent\chars\Peedy.acs

Filesize
4.0MB

MD5
49654a47fadfd39414ddc654da7e3879

SHA1
9248c10cef8b54a1d8665dfc6067253b507b73ad

SHA256
b8112187525051bfade06cb678390d52c79555c960202cc5bbf5901fbc0853c5

SHA512
fa9cab60fadd13118bf8cb2005d186eb8fa43707cb983267a314116129371d1400b95d03fbf14dfdaba8266950a90224192e40555d910cf8a3afa4aaf4a8a32f

Download Submit
\??\pipe\LOCAL\crashpad_600_BYAJYBSRXHEJKIAK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2344-2759-0x0000000000400000-0x0000000001207000-memory.dmp

Filesize
14.0MB

Download
memory/2344-2788-0x0000000000400000-0x0000000001207000-memory.dmp

Filesize
14.0MB

Download
memory/2344-2760-0x0000000000400000-0x0000000001207000-memory.dmp

Filesize
14.0MB

Download
memory/2604-106-0x0000000140000000-0x00000001400D9000-memory.dmp

Filesize
868KB

Download
memory/2604-104-0x0000000009200000-0x000000000AA78000-memory.dmp

Filesize
24.5MB

Download
memory/2604-103-0x0000000009200000-0x000000000AA78000-memory.dmp

Filesize
24.5MB

Download
memory/2604-105-0x0000000009200000-0x000000000AA78000-memory.dmp

Filesize
24.5MB

Download
memory/2604-96-0x00000000007B0000-0x00000000007B6000-memory.dmp

Filesize
24KB

Download
memory/2604-108-0x0000000009200000-0x000000000AA78000-memory.dmp

Filesize
24.5MB

Download
memory/2604-110-0x0000000009200000-0x000000000AA78000-memory.dmp

Filesize
24.5MB

Download
memory/2604-109-0x0000000009200000-0x000000000AA78000-memory.dmp

Filesize
24.5MB

Download
memory/2604-115-0x0000000140000000-0x00000001400D9000-memory.dmp

Filesize
868KB

Download
memory/2604-111-0x0000000009200000-0x000000000AA78000-memory.dmp

Filesize
24.5MB

Download
memory/2604-102-0x0000000009200000-0x000000000AA78000-memory.dmp

Filesize
24.5MB

Download
memory/2604-116-0x0000000009200000-0x000000000AA78000-memory.dmp

Filesize
24.5MB

Download
memory/2604-89-0x0000000140000000-0x00000001400D9000-memory.dmp

Filesize
868KB

Download
memory/2796-1218-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2796-1217-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/4476-2960-0x00007FF76E000000-0x00007FF76E213000-memory.dmp

Filesize
2.1MB

Download
memory/4476-3014-0x00007FF76E000000-0x00007FF76E213000-memory.dmp

Filesize
2.1MB

Download
memory/4748-2758-0x00007FF66E8B0000-0x00007FF66EAC3000-memory.dmp

Filesize
2.1MB

Download
memory/4748-2736-0x00007FF66E8B0000-0x00007FF66EAC3000-memory.dmp

Filesize
2.1MB

Download
memory/5040-4697-0x00007FF99AFA0000-0x00007FF99AFB9000-memory.dmp

Filesize
100KB

Download
memory/5040-4698-0x00007FF984520000-0x00007FF984638000-memory.dmp

Filesize
1.1MB

Download
memory/5040-4731-0x00007FF992EF0000-0x00007FF992FA8000-memory.dmp

Filesize
736KB

Download
memory/5040-4732-0x00007FF99C330000-0x00007FF99C354000-memory.dmp

Filesize
144KB

Download
memory/5040-4728-0x00007FF9974C0000-0x00007FF9974D4000-memory.dmp

Filesize
80KB

Download
memory/5040-4716-0x00007FF982EE0000-0x00007FF98334E000-memory.dmp

Filesize
4.4MB

Download
memory/5040-4691-0x00007FF99FF40000-0x00007FF99FF4D000-memory.dmp

Filesize
52KB

Download
memory/5040-4692-0x00007FF982EE0000-0x00007FF98334E000-memory.dmp

Filesize
4.4MB

Download
memory/5040-4693-0x00007FF982B60000-0x00007FF982ED5000-memory.dmp

Filesize
3.5MB

Download
memory/5040-4694-0x00007FF99C330000-0x00007FF99C354000-memory.dmp

Filesize
144KB

Download
memory/5040-4729-0x00007FF99E020000-0x00007FF99E02D000-memory.dmp

Filesize
52KB

Download
memory/5040-4681-0x00007FF982EE0000-0x00007FF98334E000-memory.dmp

Filesize
4.4MB

Download
memory/5040-4682-0x00007FF9A0DE0000-0x00007FF9A0DEF000-memory.dmp

Filesize
60KB

Download
memory/5040-4687-0x00007FF99C2C0000-0x00007FF99C2ED000-memory.dmp

Filesize
180KB

Download
memory/5040-4688-0x00007FF99AFA0000-0x00007FF99AFB9000-memory.dmp

Filesize
100KB

Download
memory/5040-4733-0x00007FF9A0DE0000-0x00007FF9A0DEF000-memory.dmp

Filesize
60KB

Download
memory/5040-4734-0x00007FF99C2C0000-0x00007FF99C2ED000-memory.dmp

Filesize
180KB

Download
memory/5040-4735-0x00007FF99AFA0000-0x00007FF99AFB9000-memory.dmp

Filesize
100KB

Download
memory/5040-4736-0x00007FF99AF80000-0x00007FF99AF9F000-memory.dmp

Filesize
124KB

Download
memory/5040-4737-0x00007FF992C60000-0x00007FF992DD1000-memory.dmp

Filesize
1.4MB

Download
memory/5040-4738-0x00007FF99AF60000-0x00007FF99AF79000-memory.dmp

Filesize
100KB

Download
memory/5040-4739-0x00007FF99FF40000-0x00007FF99FF4D000-memory.dmp

Filesize
52KB

Download
memory/5040-4740-0x00007FF997C60000-0x00007FF997C8E000-memory.dmp

Filesize
184KB

Download
memory/5040-4741-0x00007FF982B60000-0x00007FF982ED5000-memory.dmp

Filesize
3.5MB

Download
memory/5040-4730-0x00007FF984520000-0x00007FF984638000-memory.dmp

Filesize
1.1MB

Download
memory/5040-4690-0x00007FF99AF60000-0x00007FF99AF79000-memory.dmp

Filesize
100KB

Download
memory/5040-4689-0x00007FF992C60000-0x00007FF992DD1000-memory.dmp

Filesize
1.4MB

Download
memory/5040-4696-0x00007FF99E020000-0x00007FF99E02D000-memory.dmp

Filesize
52KB

Download
memory/5040-4695-0x00007FF9974C0000-0x00007FF9974D4000-memory.dmp

Filesize
80KB

Download
memory/5320-2724-0x0000000000850000-0x0000000000968000-memory.dmp

Filesize
1.1MB

Download
memory/5320-2725-0x0000000005370000-0x00000000053FE000-memory.dmp

Filesize
568KB

Download
memory/5320-2726-0x0000000002D20000-0x0000000002D26000-memory.dmp

Filesize
24KB

Download
memory/5616-2742-0x0000022072260000-0x0000022072282000-memory.dmp

Filesize
136KB

Download
memory/5736-4637-0x00007FF99FF40000-0x00007FF99FF4D000-memory.dmp

Filesize
52KB

Download
memory/5736-4604-0x00007FF99AFA0000-0x00007FF99AFB9000-memory.dmp

Filesize
100KB

Download
memory/5736-4573-0x00007FF982EE0000-0x00007FF98334E000-memory.dmp

Filesize
4.4MB

Download
memory/5736-4574-0x00007FF99C330000-0x00007FF99C354000-memory.dmp

Filesize
144KB

Download
memory/5736-4575-0x00007FF9A1770000-0x00007FF9A177F000-memory.dmp

Filesize
60KB

Download
memory/5736-4580-0x00007FF99C2C0000-0x00007FF99C2ED000-memory.dmp

Filesize
180KB

Download
memory/5736-4636-0x00007FF9974C0000-0x00007FF9974D4000-memory.dmp

Filesize
80KB

Download
memory/5736-4629-0x00007FF99AF80000-0x00007FF99AF9F000-memory.dmp

Filesize
124KB

Download
memory/5736-4581-0x00007FF99AFA0000-0x00007FF99AFB9000-memory.dmp

Filesize
100KB

Download
memory/5736-4638-0x00007FF984520000-0x00007FF984638000-memory.dmp

Filesize
1.1MB

Download
memory/5736-4639-0x00007FF982B60000-0x00007FF982ED5000-memory.dmp

Filesize
3.5MB

Download
memory/5736-4640-0x00007FF99C330000-0x00007FF99C354000-memory.dmp

Filesize
144KB

Download
memory/5736-4641-0x00007FF9A1770000-0x00007FF9A177F000-memory.dmp

Filesize
60KB

Download
memory/5736-4582-0x00007FF99AF80000-0x00007FF99AF9F000-memory.dmp

Filesize
124KB

Download
memory/5736-4642-0x00007FF99C2C0000-0x00007FF99C2ED000-memory.dmp

Filesize
180KB

Download
memory/5736-4643-0x00007FF99AFA0000-0x00007FF99AFB9000-memory.dmp

Filesize
100KB

Download
memory/5736-4644-0x00007FF992C60000-0x00007FF992DD1000-memory.dmp

Filesize
1.4MB

Download
memory/5736-4645-0x00007FF99AF60000-0x00007FF99AF79000-memory.dmp

Filesize
100KB

Download
memory/5736-4583-0x00007FF992C60000-0x00007FF992DD1000-memory.dmp

Filesize
1.4MB

Download
memory/5736-4646-0x00007FF9A0DE0000-0x00007FF9A0DED000-memory.dmp

Filesize
52KB

Download
memory/5736-4647-0x00007FF997C60000-0x00007FF997C8E000-memory.dmp

Filesize
184KB

Download
memory/5736-4648-0x00007FF992EF0000-0x00007FF992FA8000-memory.dmp

Filesize
736KB

Download
memory/5736-4624-0x00007FF982EE0000-0x00007FF98334E000-memory.dmp

Filesize
4.4MB

Download
memory/5736-4601-0x00007FF9974C0000-0x00007FF9974D4000-memory.dmp

Filesize
80KB

Download
memory/5736-4602-0x00007FF99FF40000-0x00007FF99FF4D000-memory.dmp

Filesize
52KB

Download
memory/5736-4584-0x00007FF99AF60000-0x00007FF99AF79000-memory.dmp

Filesize
100KB

Download
memory/5736-4605-0x00007FF99AF80000-0x00007FF99AF9F000-memory.dmp

Filesize
124KB

Download
memory/5736-4606-0x00007FF984520000-0x00007FF984638000-memory.dmp

Filesize
1.1MB

Download
memory/5736-4603-0x00007FF99C2C0000-0x00007FF99C2ED000-memory.dmp

Filesize
180KB

Download
memory/5736-4587-0x00007FF982EE0000-0x00007FF98334E000-memory.dmp

Filesize
4.4MB

Download
memory/5736-4588-0x00007FF992EF0000-0x00007FF992FA8000-memory.dmp

Filesize
736KB

Download
memory/5736-4590-0x00007FF982B60000-0x00007FF982ED5000-memory.dmp

Filesize
3.5MB

Download
memory/5736-4591-0x00007FF99C330000-0x00007FF99C354000-memory.dmp

Filesize
144KB

Download
memory/5736-4589-0x000001E63FAD0000-0x000001E63FE45000-memory.dmp

Filesize
3.5MB

Download
memory/5736-4586-0x00007FF997C60000-0x00007FF997C8E000-memory.dmp

Filesize
184KB

Download
memory/5736-4585-0x00007FF9A0DE0000-0x00007FF9A0DED000-memory.dmp

Filesize
52KB

Download
memory/5776-5236-0x000000007F760000-0x000000007F770000-memory.dmp

Filesize
64KB

Download
memory/5776-5231-0x000000007F760000-0x000000007F770000-memory.dmp

Filesize
64KB

Download
memory/5776-5237-0x000000007F760000-0x000000007F770000-memory.dmp

Filesize
64KB

Download
memory/5776-5233-0x000000007F760000-0x000000007F770000-memory.dmp

Filesize
64KB

Download
memory/5776-5232-0x000000007F760000-0x000000007F770000-memory.dmp

Filesize
64KB

Download
memory/5776-5239-0x000000007F760000-0x000000007F770000-memory.dmp

Filesize
64KB

Download
memory/5776-5234-0x000000007F760000-0x000000007F770000-memory.dmp

Filesize
64KB

Download
memory/5776-5240-0x000000007F760000-0x000000007F770000-memory.dmp

Filesize
64KB

Download
memory/5776-5235-0x000000007F760000-0x000000007F770000-memory.dmp

Filesize
64KB

Download
memory/5776-5238-0x000000007F760000-0x000000007F770000-memory.dmp

Filesize
64KB

Download
memory/6072-2723-0x0000000000400000-0x0000000001207000-memory.dmp

Filesize
14.0MB

Download
memory/6072-2702-0x0000000000400000-0x0000000001207000-memory.dmp

Filesize
14.0MB

Download
memory/6072-2703-0x0000000000400000-0x0000000001207000-memory.dmp

Filesize
14.0MB

Download
memory/6480-11226-0x0000025E703E0000-0x0000025E7196E000-memory.dmp

Filesize
21.6MB

Download
memory/6480-11217-0x0000025E54B80000-0x0000025E55B74000-memory.dmp

Filesize
16.0MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads