wannacry | d666eaface8058116f1d829ee96bb5b1e9b1514ee589930309929093c14aaa0e

Analysis

max time kernel
309s
max time network
311s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
07-12-2024 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HIGH QUALITY Thought I Was Dead FULL VERSION ft ScHoolboy Q Playboi Carti (1).mp3
Size

3.8MB
MD5

3cffe7aa946d4783f9091302c190f0d7
SHA1

f42237ab85218a9a3839c577a475b67d493bc657
SHA256

d666eaface8058116f1d829ee96bb5b1e9b1514ee589930309929093c14aaa0e
SHA512

4025cf0866edf6411cfb4a2831e37d3887f8b1bf4bba92e3eaaa9ed2787ffb2db3762c3c08167f5c48e59d9580d1fa27b88e7b32e25f7125c54df69d4acdde05
SSDEEP

98304:eKUfE+EsAGhZv4XhHtZLk5f8EG5YFKUNhtXMLN/BY+DX:eKUfE90hZYHg5DFJlMLNe+DX

Score

10^/10

wannacry defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware spyware stealer trojan worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, wscript.exe \"C:\\Program Files\\mrsmajor\\Launcher.vbs\""	wscript.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\disableregistrytools = "1"	wscript.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD6E3D.tmp	WannaCry.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD6E54.tmp	WannaCry.EXE

Executes dropped EXE 32 IoCs

pid	Process
748	WannaCry.EXE
4312	taskdl.exe
4328	@[email protected]
3440	@[email protected]
3892	taskhsvc.exe
1660	WannaCry.EXE
5012	WannaCry.EXE
3836	taskdl.exe
2464	taskse.exe
1692	@[email protected]
3348	taskse.exe
2348	@[email protected]
3896	taskdl.exe
4428	taskse.exe
1524	@[email protected]
2332	taskdl.exe
4744	taskse.exe
4748	@[email protected]
1476	taskdl.exe
3392	taskse.exe
2760	@[email protected]
1516	taskdl.exe
4512	taskse.exe
1216	@[email protected]
3972	taskdl.exe
4692	taskse.exe
2420	@[email protected]
3036	taskdl.exe
2576	BossDaMajor.exe
2444	taskse.exe
416	@[email protected]
3776	taskdl.exe

Loads dropped DLL 7 IoCs

pid	Process
3892	taskhsvc.exe
3892	taskhsvc.exe
3892	taskhsvc.exe
3892	taskhsvc.exe
3892	taskhsvc.exe
3892	taskhsvc.exe
3892	taskhsvc.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3488	icacls.exe
4580	icacls.exe
4988	icacls.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico"	wscript.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tgikesyrkli880 = "\"C:\\Users\\Admin\\Downloads\\tasksche.exe\""	reg.exe

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
37	raw.githubusercontent.com
38	camo.githubusercontent.com
43	raw.githubusercontent.com
8	camo.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	WannaCry.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\mrsmajor\CPUUsage.vbs	wscript.exe
File created	C:\Program Files\mrsmajor\default.txt	wscript.exe
File created	C:\Program Files\mrsmajor\def_resource\creepysound.mp3	wscript.exe
File created	C:\Program Files\mrsmajor\def_resource\f11.mp4	wscript.exe
File created	C:\Program Files\mrsmajor\def_resource\Skullcur.cur	wscript.exe
File created	C:\Program Files\mrsmajor\Icon_resource\SkullIco.ico	wscript.exe
File created	C:\Program Files\mrsmajor\def_resource\@Tile@@.jpg	wscript.exe
File created	C:\Program Files\mrsmajor\mrsmajorlauncher.vbs	wscript.exe
File created	C:\Program Files\mrsmajor\CPUUsage.vbs	wscript.exe
File created	C:\Program Files\mrsmajor\MrsMjrGui.exe	wscript.exe
File created	C:\Program Files\mrsmajor\MrsMjrGuiLauncher.bat	wscript.exe
File created	C:\Program Files\mrsmajor\WinLogon.bat	wscript.exe
File created	C:\Program Files\mrsmajor\Doll_patch.xml	wscript.exe
File created	C:\Program Files\mrsmajor\DreS_X.bat	wscript.exe
File created	C:\Program Files\mrsmajor\Launcher.vbs	wscript.exe
File created	C:\Program Files\mrsmajor\reStart.vbs	wscript.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\WannaCry.EXE:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\BossDaMajor.exe:Zone.Identifier	msedge.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
2428	wscript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1028	2376	WerFault.exe	76

System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BossDaMajor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Control Panel\Cursors\AppStarting = "C:\\Program Files\\mrsmajor\\def_resource\\skullcur.cur"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Control Panel\Cursors\Hand = "C:\\Program Files\\mrsmajor\\def_resource\\skullcur.cur"	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Control Panel\Cursors	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Control Panel\Cursors\Arrow = "C:\\Program Files\\mrsmajor\\def_resource\\skullcur.cur"	wscript.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "14"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe

Modifies registry class 19 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-556537508-2730415644-482548075-1000\{C53D755E-EC0C-4141-BBEC-F9CFEB8B007C}	wmplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-556537508-2730415644-482548075-1000\{0985E5CA-8556-4B31-AE97-793A54DAFDB4}	wmplayer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon	wscript.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4028	reg.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 319287.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\BossDaMajor.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WannaCry.EXE:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1932	msedge.exe
1932	msedge.exe
4224	msedge.exe
4224	msedge.exe
612	identity_helper.exe
612	identity_helper.exe
1772	msedge.exe
1772	msedge.exe
1056	msedge.exe
1056	msedge.exe
3892	taskhsvc.exe
3892	taskhsvc.exe
3892	taskhsvc.exe
3892	taskhsvc.exe
3892	taskhsvc.exe
3892	taskhsvc.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2556	msedge.exe
2556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2376	wmplayer.exe
Token: SeCreatePagefilePrivilege	2376	wmplayer.exe
Token: SeShutdownPrivilege	2800	unregmp2.exe
Token: SeCreatePagefilePrivilege	2800	unregmp2.exe
Token: 33	2572	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2572	AUDIODG.EXE
Token: SeShutdownPrivilege	2376	wmplayer.exe
Token: SeCreatePagefilePrivilege	2376	wmplayer.exe
Token: SeShutdownPrivilege	2376	wmplayer.exe
Token: SeCreatePagefilePrivilege	2376	wmplayer.exe
Token: SeShutdownPrivilege	2376	wmplayer.exe
Token: SeCreatePagefilePrivilege	2376	wmplayer.exe
Token: SeIncreaseQuotaPrivilege	4852	WMIC.exe
Token: SeSecurityPrivilege	4852	WMIC.exe
Token: SeTakeOwnershipPrivilege	4852	WMIC.exe
Token: SeLoadDriverPrivilege	4852	WMIC.exe
Token: SeSystemProfilePrivilege	4852	WMIC.exe
Token: SeSystemtimePrivilege	4852	WMIC.exe
Token: SeProfSingleProcessPrivilege	4852	WMIC.exe
Token: SeIncBasePriorityPrivilege	4852	WMIC.exe
Token: SeCreatePagefilePrivilege	4852	WMIC.exe
Token: SeBackupPrivilege	4852	WMIC.exe
Token: SeRestorePrivilege	4852	WMIC.exe
Token: SeShutdownPrivilege	4852	WMIC.exe
Token: SeDebugPrivilege	4852	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4852	WMIC.exe
Token: SeRemoteShutdownPrivilege	4852	WMIC.exe
Token: SeUndockPrivilege	4852	WMIC.exe
Token: SeManageVolumePrivilege	4852	WMIC.exe
Token: 33	4852	WMIC.exe
Token: 34	4852	WMIC.exe
Token: 35	4852	WMIC.exe
Token: 36	4852	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4852	WMIC.exe
Token: SeSecurityPrivilege	4852	WMIC.exe
Token: SeTakeOwnershipPrivilege	4852	WMIC.exe
Token: SeLoadDriverPrivilege	4852	WMIC.exe
Token: SeSystemProfilePrivilege	4852	WMIC.exe
Token: SeSystemtimePrivilege	4852	WMIC.exe
Token: SeProfSingleProcessPrivilege	4852	WMIC.exe
Token: SeIncBasePriorityPrivilege	4852	WMIC.exe
Token: SeCreatePagefilePrivilege	4852	WMIC.exe
Token: SeBackupPrivilege	4852	WMIC.exe
Token: SeRestorePrivilege	4852	WMIC.exe
Token: SeShutdownPrivilege	4852	WMIC.exe
Token: SeDebugPrivilege	4852	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4852	WMIC.exe
Token: SeRemoteShutdownPrivilege	4852	WMIC.exe
Token: SeUndockPrivilege	4852	WMIC.exe
Token: SeManageVolumePrivilege	4852	WMIC.exe
Token: 33	4852	WMIC.exe
Token: 34	4852	WMIC.exe
Token: 35	4852	WMIC.exe
Token: 36	4852	WMIC.exe
Token: SeBackupPrivilege	3872	vssvc.exe
Token: SeRestorePrivilege	3872	vssvc.exe
Token: SeAuditPrivilege	3872	vssvc.exe
Token: SeTcbPrivilege	2464	taskse.exe
Token: SeTcbPrivilege	2464	taskse.exe
Token: SeTcbPrivilege	3348	taskse.exe
Token: SeTcbPrivilege	3348	taskse.exe
Token: SeTcbPrivilege	4428	taskse.exe
Token: SeTcbPrivilege	4428	taskse.exe
Token: SeTcbPrivilege	4744	taskse.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2376	wmplayer.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
4328	@[email protected]
3440	@[email protected]
4328	@[email protected]
3440	@[email protected]
1692	@[email protected]
1692	@[email protected]
2348	@[email protected]
1524	@[email protected]
4748	@[email protected]
2760	@[email protected]
1216	@[email protected]
2420	@[email protected]
416	@[email protected]
4584	PickerHost.exe
2576	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 4604	2376	wmplayer.exe	77
PID 2376 wrote to memory of 4604	2376	wmplayer.exe	77
PID 2376 wrote to memory of 4604	2376	wmplayer.exe	77
PID 4604 wrote to memory of 2800	4604	unregmp2.exe	78
PID 4604 wrote to memory of 2800	4604	unregmp2.exe	78
PID 1932 wrote to memory of 5020	1932	msedge.exe	89
PID 1932 wrote to memory of 5020	1932	msedge.exe	89
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4784	1932	msedge.exe	90
PID 1932 wrote to memory of 4224	1932	msedge.exe	91
PID 1932 wrote to memory of 4224	1932	msedge.exe	91
PID 1932 wrote to memory of 1088	1932	msedge.exe	92
PID 1932 wrote to memory of 1088	1932	msedge.exe	92
PID 1932 wrote to memory of 1088	1932	msedge.exe	92
PID 1932 wrote to memory of 1088	1932	msedge.exe	92
PID 1932 wrote to memory of 1088	1932	msedge.exe	92
PID 1932 wrote to memory of 1088	1932	msedge.exe	92
PID 1932 wrote to memory of 1088	1932	msedge.exe	92
PID 1932 wrote to memory of 1088	1932	msedge.exe	92
PID 1932 wrote to memory of 1088	1932	msedge.exe	92
PID 1932 wrote to memory of 1088	1932	msedge.exe	92
PID 1932 wrote to memory of 1088	1932	msedge.exe	92
PID 1932 wrote to memory of 1088	1932	msedge.exe	92
PID 1932 wrote to memory of 1088	1932	msedge.exe	92
PID 1932 wrote to memory of 1088	1932	msedge.exe	92
PID 1932 wrote to memory of 1088	1932	msedge.exe	92

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3712	attrib.exe
3784	attrib.exe
2420	attrib.exe
3464	attrib.exe

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\HIGH QUALITY Thought I Was Dead FULL VERSION ft ScHoolboy Q Playboi Carti (1).mp3"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:2800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 1188
  2⤵
  - Program crash
  PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:2864

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004F0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2376 -ip 2376
1⤵
PID:3664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcaf163cb8,0x7ffcaf163cc8,0x7ffcaf163cd8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:3904
- C:\Users\Admin\Downloads\WannaCry.EXE
  "C:\Users\Admin\Downloads\WannaCry.EXE"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  PID:748
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h .
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3464
- - C:\Windows\SysWOW64\icacls.exe
    icacls . /grant Everyone:F /T /C /Q
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3488
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 281051733613756.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4988
  - - C:\Windows\SysWOW64\cscript.exe
      cscript.exe //nologo m.vbs
      4⤵
      System Location Discovery: System Language Discovery
      PID:5032
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s F:\$RECYCLE
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3712
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected] co
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4328
  - - C:\Users\Admin\Downloads\TaskData\Tor\taskhsvc.exe
      TaskData\Tor\taskhsvc.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3892
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b @[email protected] vs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1216
  - - C:\Users\Admin\Downloads\@[email protected]
      @[email protected] vs
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3440
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3496
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4852
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3836
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2464
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "tgikesyrkli880" /t REG_SZ /d "\"C:\Users\Admin\Downloads\tasksche.exe\"" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1200
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "tgikesyrkli880" /t REG_SZ /d "\"C:\Users\Admin\Downloads\tasksche.exe\"" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4028
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3348
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2348
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3896
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4428
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1524
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2332
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4744
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4748
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1476
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3392
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2760
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1516
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4512
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1216
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3972
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4692
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2420
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3036
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2444
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:416
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3776
- C:\Users\Admin\Downloads\WannaCry.EXE
  "C:\Users\Admin\Downloads\WannaCry.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1660
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h .
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3784
- - C:\Windows\SysWOW64\icacls.exe
    icacls . /grant Everyone:F /T /C /Q
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4580
- C:\Users\Admin\Downloads\WannaCry.EXE
  "C:\Users\Admin\Downloads\WannaCry.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5012
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h .
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2420
- - C:\Windows\SysWOW64\icacls.exe
    icacls . /grant Everyone:F /T /C /Q
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6668 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2056 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7372 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,11636329834520388432,3052769710574518104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2556
- C:\Users\Admin\Downloads\BossDaMajor.exe
  "C:\Users\Admin\Downloads\BossDaMajor.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2576
- - C:\Windows\system32\wscript.exe
    "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\EFEA.tmp\EFEB.vbs
    3⤵
    - Drops file in Program Files directory
    PID:3524
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:4748
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Program files\mrsmajor\mrsmajorlauncher.vbs" RunAsAdministrator
      4⤵
      Modifies WinLogon for persistence
      UAC bypass
      Disables RegEdit via registry modification
      Modifies system executable filetype association
      Drops file in Program Files directory
      Access Token Manipulation: Create Process with Token
      Modifies Control Panel
      Modifies registry class
      System policy modification
      PID:2428
    - - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
        
        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" "C:\Program Files\mrsmajor\def_resource\f11.mp4"
        5⤵
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4628
    - - C:\Windows\System32\shutdown.exe
        
        "C:\Windows\System32\shutdown.exe" -r -t 03
        5⤵
        
        PID:1644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3164

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3872

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:996

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:5088

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4584

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39ed855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Access Token Manipulation

T1134

Create Process with Token

T1134.002

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\@[email protected]

Filesize
585B

MD5
ab23a6c3fd43c11c8c433cee2a43805a

SHA1
291d0b363da71a8fc6b22cb40b51bdacea3df1bb

SHA256
d838ce724e83e96324362b8cd57e5cff5276e22d979f91f878aac578b236f50e

SHA512
2785d8b575d7b9165d27ca65d66f5bf02ba9c44d79b2fca36f3b9726d320312a5a6f7b868f4c0aabee9716b2ecf4b30154be820b80979c6c84d9a05aabd4abf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a28bb0d36049e72d00393056dce10a26

SHA1
c753387b64cc15c0efc80084da393acdb4fc01d0

SHA256
684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

SHA512
20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
554d6d27186fa7d6762d95dde7a17584

SHA1
93ea7b20b8fae384cf0be0d65e4295097112fdca

SHA256
2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

SHA512
57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
67KB

MD5
27d9344de055e50044e074ec3b54231d

SHA1
d07ff356acb90c9d4fa1c1e3e48188b1a2eeaf8d

SHA256
d5c1eb2d4d0a13aa42ee68f03218ae01f420003f64f572b77cbff7d61edff388

SHA512
ad045b2f4e6d58e43de1e26a1d5c0a46d912b65caed68ac4bc07f0c26223c5a9927a74ccc8956e074ee74db6e7b05415f3baa3634a714f3048278982bcddf26a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
47KB

MD5
831d28bc4bc17e94a06988e507edf030

SHA1
ca05af05691b8836a965fadaea1062f859e93edd

SHA256
a0fb3285e570b67b3760927e4bbb5173d7b43a691be7eee20ae8b33fd37d4742

SHA512
66aa3359136961ad695c6f673e343d1a8089b1102bfe7004bc28b64849debd5636780546ab6215fe414960556cc0d61905a9eb994e4993d8fb80d963b246616b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
67KB

MD5
b275fa8d2d2d768231289d114f48e35f

SHA1
bb96003ff86bd9dedbd2976b1916d87ac6402073

SHA256
1b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1

SHA512
d28918346e3fda06cd1e1c5c43d81805b66188a83e8ffcab7c8b19fe695c9ca5e05c7b9808599966df3c4cd81e73728189a131789c94df93c5b2500ce8ec8811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
26KB

MD5
5dea626a3a08cc0f2676427e427eb467

SHA1
ad21ac31d0bbdee76eb909484277421630ea2dbd

SHA256
b19581c0e86b74b904a2b3a418040957a12e9b5ae6a8de07787d8bb0e4324ed6

SHA512
118016178abe2c714636232edc1e289a37442cc12914b5e067396803aa321ceaec3bcfd4684def47a95274bb0efd72ca6b2d7bc27bb93467984b84bc57931fcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
38KB

MD5
4a6a239f02877981ae8696fbebde3fc9

SHA1
5f87619e1207d7983c8dfceaac80352d25a336cf

SHA256
ac546e02b937ee9ac6f6dd99081db747db7af6a4febf09cbe49e91452d9257b8

SHA512
783cf2ae4ba57031c7f4c18bdac428a1074bb64f6eb8cef126ad33f46c08767deeac51917bef0f1595295b9f8a708cb297b7cf63fc3f7db0aa4ac217ce10f7cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
20KB

MD5
e42ba21fc6ad46eef7210e6a17cbcf29

SHA1
65df7e97d6ec546a85a16beea1a8533788969fc6

SHA256
f41a6b281e24eebdca7fdd637658685e2c4159b9da7c1017e5b9bfafa6821d8b

SHA512
e9b1896224703b80e26411b65a418878d77713a023a8bfb49707f7569359246d9ce1e2307613a1ecae7bd64a78266916d4586aba1b30fda2ecffe05322427ef9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
37KB

MD5
0a76e38078a8dcdd5b13514986f0ac3e

SHA1
0e44055c6e8eea1ffd3ea3ab0abc4ac9d883ea78

SHA256
33c3379f8732377ef5d47fc4b6f845161296b41a907345b5fb05b84a1dd49738

SHA512
5cf1db1a21abfc95d4b13d7f36a565302d38adae405a68e75cdfaaa4e305c4776a79579a5e27147424926791e07a9859983e2b2725bd21ff7f81b9c63e7f3ecd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
18KB

MD5
01a1b982e5152d00e14d6166a6385b2a

SHA1
d9b47fb87245a5c25e954c2ac432c17667651b7f

SHA256
234d76379d85e1d0d1abada13eb9b0ad5f85c883cf3c6acd9e29e5495ec4444c

SHA512
0e5a63ce0f4e30e4f20813c4fdc60fd7a280f01da809a80b88f1c21bb0ee05fb7703b5397f37246498f73253274d003890ec9050703a7901aefd1c7d7cbf0f57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
24KB

MD5
c1f94d8904e7820c53cd287d2a385ba7

SHA1
b1f282f10fbe663bc982349fd74248957470724e

SHA256
14af31c6d3d2086f8474373ebd6742c55346d9ac178d430c22fb2775c3e0d460

SHA512
0ee70207cbacf90d1ce99706ba97465f3390e64614750c9120cd1384d6cb51cdbc3afdc7f97ffc0106b9b4068f6608dae2d370e4e8c0f9a6fe434e7dd404b129

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
18KB

MD5
68b5f0a415fbfb22cfb4417ec1304c30

SHA1
e0fc1f02d74523ebc980e0dbe4aca39887c48d6e

SHA256
0763d5b662befc2cdee98fa50834fd86a950ff400c48bbe845e09bdba18c7029

SHA512
11db40f2b8af9f4691f70656439165a8617f36e0c3af56bf8bfc4e92b36cd124bf8541f20db6b9467bdb8dee0cc75e77d47f7cb608a8581487d9576ec716d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
16KB

MD5
b4bb2ffc47af4812c7c0cb9757b6928f

SHA1
b48608834a606066f3ff012ae4391b32a4113377

SHA256
f89fb8a26ae4b39c00b58305e1dd5bf032e096933a5fab350415388217f45c1e

SHA512
6bbcf637dfb86e35b5f7bd37f7666f9730b1e34a1878b3e5d03369414b62fdfa6f683cc98e653a10cee94b8dc784ca68d9fdaaffbe763dd0424689e9e0a567e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
57KB

MD5
47fdf5fe3e1e21c87897fb1cb35c783f

SHA1
d11fbce8062fc9295879ac0b1dc4c8215a302b0a

SHA256
cf6cf6d8fa5e46f4d51ad62216b7319fa0757554469b6ea490e495f24b6a0291

SHA512
8387ff8c74658023511ce90162ab2f5e8b7eb4eb48f405b303b350d7a57a39fd879360df41d9f80ca48b2a2b2ef9097fd8010b8d3956d83404a08bef85facfbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
38KB

MD5
d497cdac37c196ab6dce8be6104cef2d

SHA1
27976a1ceb0efcda33dff4af3597b866d25ee86a

SHA256
3caaa41cabc65d9d7331ba51e315efcbcd7aa92ae7027a89f847af1fb02a3988

SHA512
e8f12fdbd4cc8401d2a3c035600ab5c8938348e098ef6e48330e35de745fc76bf0f59eb051132471bdc71c21428a30044d65af9becc307fef4d2e1ed15d8c017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
53KB

MD5
cfff8fc00d16fc868cf319409948c243

SHA1
b7e2e2a6656c77a19d9819a7d782a981d9e16d44

SHA256
51266cbe2741a46507d1bb758669d6de3c2246f650829774f7433bc734688a5a

SHA512
9d127abfdf3850998fd0d2fb6bd106b5a40506398eb9c5474933ff5309cdc18c07052592281dbe1f15ea9d6cb245d08ff09873b374777d71bbbc6e0594bde39b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
19KB

MD5
7439f89cb7838939b685bc2bd352c0c3

SHA1
40af38e917b92d5b13f151ec162bf87848d3d2d8

SHA256
c82d262cd2ec9d85ca2dc55413af481fc0f7d6e2b828ecefd0eccbe47738f695

SHA512
bd1c139e48dee390579b7211ad26f2f820f189296a30fbae6d12a5f6ba1cd4908c8258ffd91611b2f9e932581bc7a4572fe1fa5786f714ecfa0a91f2f266f429

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
21KB

MD5
5bdd8ca5e9726d75782cb3595d093072

SHA1
2bc2e4614cf4a0e0ca4b034700bc569b6335384d

SHA256
21d06941e702b3c307a2f556a106aef97c7f9c321f70e8fb00966b90ff3b4a13

SHA512
bc682430eb9d5c502e105c9870261ecea82600b5e96e40ff46331b72f7c649c6bdf8edd3589ac102455e3ec6b7f45257698a8322de3e43425712d8d02e7678c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
88KB

MD5
76d82c7d8c864c474936304e74ce3f4c

SHA1
8447bf273d15b973b48937326a90c60baa2903bf

SHA256
3329378951655530764aaa1f820b0db86aa0f00834fd7f51a48ad752610d60c8

SHA512
a0fc55af7f35ad5f8ac24cea6b9688698909a2e1345460d35e7133142a918d9925fc260e08d0015ec6fa7721fbeae90a4457caa97d6ce01b4ff46109f4cd5a46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
106KB

MD5
2fbdc9e04b9db1b871ca0609e07b47a6

SHA1
8b9fbc6cb3d8cca66d1a7c0d61230ffdd4d6f8f2

SHA256
6039ab1f08c8518d732d199dbc03ab9d6caaabd2154e20a800b6431a36886fc0

SHA512
d8f02dc1367a1bdf8cf18efa39d4c06c2f8d6284983cb1282ad4b194cf2516e8900843d8237473c50209d15b6a6c5bdb4a9a0240313c76fdcf4297244ce15093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
16KB

MD5
06b438d5e1a8ac9850ebaa924c67684e

SHA1
943849718ba03f7788c14ec43fb29cf503a0b0e3

SHA256
406f8ac9d271e8e74ff9b7dd5bd4f36d6782cd3d036fb9f62f8a252a6050f946

SHA512
0d21fe32b24b27807e96ef5c963dd1e78a89646638217c37ae0075689ad6f683895f942ae3d9b0542e74a9af22bb3756a885606c70d7ed351385bb2770533ee3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\06cdbb7047afc473_0

Filesize
262B

MD5
13a20c3634c0ffabfcc7a9c799c154da

SHA1
aac6151861a12879350ee6c3fdf2c825929e8ba6

SHA256
3ac985e96d14d9a927bda65801e60ceef3bbe8ba1533a3dd9ff53a6e58d80653

SHA512
9c49e9c44a56adcd7cbf0c3f5b4226f5eaec0a31615a229f6f20ee1721b40dca26a5739ae594f3d9739774ca064f46114d7041bc5f8265c7be53540779fcba94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0720badf6795a0b6_0

Filesize
3KB

MD5
c45e3fe23190edd75724072752245db8

SHA1
c526768f9451bf53b2eac49fcca9c104f184f2d7

SHA256
4226e9ee41a8f3cf6d54844efa2fb7c44a4d3061fb9e5cc8546ea50373e51534

SHA512
8481e2799769421a4def94ac55edbaf7fddf6e29373eacdec873eb9104014657dbfcc3481c4b2397dadaa336f8d15946dc117d6a8981ce9fe7f85d2a010d4e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0bbe00d9bf7b798e_0

Filesize
5KB

MD5
8f8d367d27608eb31c244103b466cf3d

SHA1
588afc0e9d10750a4c0f80fac5eb5b45714d5604

SHA256
6dfeb4a9e97a153379f842b5dfb6542e1e98b0f8d2bf469060d504ab2390625a

SHA512
c00e686e0068c5d1a4d5292fb22ba2d9f98abab08aa67bef05036e57062f3c1567969adee47e61d2015d46e3adc03d0c30e6bbb6ce6a54676e50f67e9a8191cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\14ff8116b518ca2d_0

Filesize
2KB

MD5
836adb0d650b00541fb9f8bb8aa5f76d

SHA1
3844afc28008e0ccff72a9cdb75fd256a857ac80

SHA256
87d7dd9fd8cfb75248bf71e76bb4fb5211048be26caf9597e67d7225c0296551

SHA512
705d28ddca8bf5d6c53418a1e24abc330db19910b0825ab2363e63b4227ef621720ae4a2aa6a38d635ab0504fedb8c8f0db0d8d8ad39619e25f858b8cbbe70b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\235fb7e536d5b1ee_0

Filesize
208KB

MD5
d0b8b93a2021bb3ca34742885a95efa4

SHA1
8ecc771f79e19172f97f7de02111073d615441b9

SHA256
9862c31b67991a075ba58a649e3fc8d59fae068d59fb67aaf0900b19b4f179f9

SHA512
61ac1133164a1db580cc602a185433841ef048db0ded62f7367725a33168fabfd5def4ca5e0a64cb97eed16ded027c8d20f0adf48d78a342fa792f9f3be69aaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0

Filesize
1KB

MD5
903d52b56fc4acfdb1819f52bfea2471

SHA1
6f8e29a246d92f65745ee314aa30968a6e52093f

SHA256
9d2c58478ee51cd1264b36d2a0cd412d66c88dc246dd56fead42e4118f76d02a

SHA512
cf386dbec02d03d5fce142fc305296fca1b08fbe7a25106a9694c7ff9b9ba74b858caea1b885e29a91db0ff496f09567796cba924c9ac65f1cd2f208bcad7e62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2f4680e8f8f8a14f_0

Filesize
13KB

MD5
93175927ec50cf451af8d5f161754319

SHA1
8435b6563443bfb6297891c15cafd0aa6cb8da1c

SHA256
380707bbf2d63064eac9be4291a3194e4763e4e2d1f6816801c6b6a700a03396

SHA512
c4be9f4f0f68c715e3cde1cb73a1720196c25dd261d79ed1609cee3ae183b0d3406d4cb4ebe7059d5e6cb4c2f5ba7d87d8cb06dd41733f364a70e191706289f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3a4259a0181983ba_0

Filesize
23KB

MD5
9acadf3dd0f2470949637453626486e0

SHA1
80e4d5f6c184ba7f662135f8f8e80b80ba36d4b3

SHA256
f7aa7e07dcc18e18c28b8365a0e1c34e41cad58d16daa02980fddcd37f68c1af

SHA512
2bef6ca96f4ea50a977c5e82ca49d22a1a314c6462324471b31cb39bdd549ff91db27cf48aad53495b16a474acae161eaa8d8c0c721e25887369dca0e89171fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f139f229e6f0497_0

Filesize
9KB

MD5
44546386638b887b90813dbb40102d65

SHA1
acd7dd45d7256a03f9d2b226ec210afc40a1897e

SHA256
7f72b629ac754dc71bc3d926d34af6e707535b0147c0846f881dcb90dc1b3908

SHA512
0bbdf1c273330026cf9f99a948e36839488421d7ded96c92c299123edba09cf9e789da4d2bc4bdff34346eb4bdcd90d487ada31c8ad8968c91681adfdad1e8ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3fd2be14abb3904c_0

Filesize
1KB

MD5
0d6a634883dd8338ed1028712ee289a4

SHA1
1c9ded1a1f65a66fd36042a8e7285b704861d1c8

SHA256
c45849808610543382ba1b7edcd3bc97a65a46bc5342dae21b36886715610f2c

SHA512
4bebc79d78d478ad8b84dafaa4e76bd7e5614303d2ea796827f66159c5f673500ebe7345377d16662cd6a09ea65571d4435e034b8a655190599e02a3d0bcb8f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

Filesize
1KB

MD5
353d3a8e92923a1773275158c018990f

SHA1
72ce4d4c20110bbeaf1c4e8d6caf8c0b5ac6ab1a

SHA256
4ed4384d502a4cffb52eb9abde67f56ff751c549276dd98bfc39aa58c61c8e69

SHA512
3bd6bb4885887b9c57a5967cc0ff536f38001eac706c88670692388d9ca709ae1bbc293c4c65d302602b16d505d58070ee0bf485a637b4b20ef46414af2013a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4e9b18b0f66a7183_0

Filesize
1KB

MD5
7409c1a37396b2f6e7320120ae185d50

SHA1
1d669f3ea15cc37dfe6cadbfba83b2c27c9d545b

SHA256
a55fcde903e937052df811ad3f83a18914ca655549b9faf1f765d50c4e8a1007

SHA512
14f22380febd29ca13d2d1e82b5281b82b2a4d926ec71b328d3ce8948528029f58321e2b6ef44360970cbec6de71f9d3f48beedded3efc342dd11d70fa24cd77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4ff4b179c1c05fed_0

Filesize
3KB

MD5
8cadc27f03ab17f3b956b26b60ff443a

SHA1
b467b83ed01cbd1eb69e064f580d68ba9382a260

SHA256
b19f5caaf60db2241fa3e9bc0bdf87c0c3ca308dc281d6e741ed053c7ac8c388

SHA512
8ce56c5f72c648a7dc71e18849ece4be41cb7613c98df1435ef39aaae63e7f71f69ff9e8aa9a8f62487b1c9e59c5daeb32498d1d46546034e97da8a6facf81a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ac5abc87e80789_0

Filesize
3KB

MD5
25b4b8983e45e5e515610ced6f8a4cce

SHA1
b50f180f3bd6758e147c5d667635b85928646d8d

SHA256
5b171f6ca1c1d66e29c84109e1c3585469c9940b0f7313934c15dc24f159ff60

SHA512
78217afa919e0b9738b8c2880c62aaeb8efc53aaa579acc258633be907d3363d6162c57e9983a31b47b748c3b2e998c1ad384a245f69221e912cb0c6f710ef37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5dd1e579c9681f95_0

Filesize
2KB

MD5
82eaa83e2ea3702e1fe22b6217d04e0b

SHA1
d20d7d7062a98f9e919c9103da3c56d0fed47950

SHA256
4cd2127cdf636b47048a93e7b88aef1674792c35fed6835b234415a5caa7efc0

SHA512
46fbe38af8bb9dd17e21794ba1a9ec097e56eb00ef5b4e61b18d7ff0f457632c26169b1f2ea9d2eefc9fe6f608f6616916a73fb147358b7418c971832cb0420c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\61a0b4d20ae0e222_0

Filesize
15KB

MD5
3ed4df10557533826095fc21b8b00c66

SHA1
8b3729e1e1d5236c35e8d3720ee84f4bfef62487

SHA256
e6d250739e9772f8f8313ccd21f5a59e1aaba3c2ed43827ca9da35c4a08ccd02

SHA512
df2ae6bae8e9cb83b1e636b7eece11a834fd992f67a618f1d509420f8c71bc40e682ea1b4ba469821eba081588aaec2759e00f314edd5d3fcb97509bc9d82b34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\635e64b37935c888_0

Filesize
1KB

MD5
4f3f5f632564c0b8b481d87811ceaf0b

SHA1
09c02067ebf36c6a2734e0b4ab062feb6aad0314

SHA256
490e65a2010d949dd3d0d73c277886a6e10a725bd3565e209b1ce22659a9ee40

SHA512
cd089ec6748876f23fd2a2d3cf5929b9064449402c14db84dad7c3bfc8eacf1d657dc7b9ccc3ed29c878f4bc70ecebf628c1cefcbf2227c1aa36bae84d8a9735

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6a5e8bb53a565b9f_0

Filesize
3KB

MD5
8cb5576c73c9f270ce9444260f8b0233

SHA1
89c3f1181910d56f4808827e19bbb6b9660040a2

SHA256
e4b0ddd9817960ee8b7d839aa2a430166f093c8cdc06c460a6a16398c52c5d60

SHA512
20f072f098ab11013b6879da690b624d52ea081d598e0c8931aa8d2fc8b00c8c999e3fb6f6a9135e0fd8feacbae85e1bee508aa24090edcd32867f469b3b440d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6aa9a2943612cce1_0

Filesize
3KB

MD5
13c04d549c94bd792b9862a753af00a1

SHA1
02d72ee90447e65c750ea1d77fafe89c1d4eddae

SHA256
678ab603b113a2741617075ec66ac13b79b00941717ea7b6285b3c9609ac8680

SHA512
16f8cd81062cdde9d92926e75381567260e2c70c6f302192a7ed2f4d2c1508d7e0c597a94f4af357d5b1d3bc782a738b0b9566e77ca9d3dccd03acf49f8035d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6b1c3d6d62495ca9_0

Filesize
4KB

MD5
2533d286f32d224fc03fc7701d626080

SHA1
31d81b5cc265b28c05c30f33ab72ae8cafdde190

SHA256
b2eeede927fd22eea5a78dd661087fb0f0098bb6ac4c9aa8b53aa3b594907960

SHA512
986a62eedcb6ac53bf9375180e78e0386d98b21ff387f9b8a68e5dc73a615f94e45df74ffba9fa7886f7257f96fd274f20ee396fc5c3f72622ae8952cdda393f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6db290dce274a012_0

Filesize
4KB

MD5
ebea3c764ca7c9b936a0a960195e92c5

SHA1
7e39aab7d609c355ed9464b71a8c3ad4e971fea8

SHA256
2ee0f8655bdb5cd5abdecbcf578f625889920d3f05dc81ce6cb73ca537463660

SHA512
63cd09101e73b21db0f96bb0b1bf3e566b180a7883665597a939e22cff9e7fcaf670023cd50f0910a9749f0734eec8e13b5c8aa39135f5ffefc2a0ab20bc8039

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6e1427d19ff38087_0

Filesize
5KB

MD5
8994b930d1059ddcd685915dcecbaf97

SHA1
fc95b1ab8ad20efc764e53d8a2476a237afe8a59

SHA256
abd8001c0f16abc027d6ed1a3efad20d6597710dcd6b9e9d477b0dfa6a246e52

SHA512
9479097bffee7c6c3ac9ecf6ca601dd42ba17a11e64ebefb0eb633ef6931546035b1ed9219bc79cbce9e8eb595c549276f326acd58a8d65ec2c1f79e16dc1adc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\71d68e68ea4089fe_0

Filesize
6KB

MD5
cae3416b64335c5063760e6f6728013d

SHA1
912bdd7ed1df2b947f381f5f7961c63fe4543290

SHA256
7d8fac684bf527c8daba820ae988f0a7212f1d09e35f0ede8671896236c004c4

SHA512
3bd30fed088a521cf32db70435092f6e40bae1298310ba7fc27b8257245b7ca202353c39b075bf7ab50aadc0e3a4bf9e0e83b7208f8591fd173330a283f61bfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74b88724f60b0383_0

Filesize
2KB

MD5
346e740f32ee51520e7b3ee25badd07a

SHA1
cee57730fdea98499f4172f96f357f10e2e6416d

SHA256
2ec31190eaf477b9887558437d5db846f143d40cd6f3254e7e96672b3f64b8e8

SHA512
df0968c0da927eb619bb896db23879455cdc5c267c5fe0014e2a8b6fb2970b08205114453725de2a4e21856baaa5ca15f4d143aab5b174c6c29c7d9d423cd2c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\766094f4b47e839c_0

Filesize
11KB

MD5
128cbe3151109c7afbdc9803b72f45dd

SHA1
d5818718276fbe4ccf1b23dc853b66a245a83b92

SHA256
1d3ada4d1b53cb11b990d024604907c9fd6f2866e5c71ed6c53bf1f594b36520

SHA512
a7767918c42e8c47c60b508745789d5a78c18ccd2fe34e0a63af16c16c5e4c09e661013cbe29eed667a8fac6ae4ad0102193f93a2392673e5b523de9129d95c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\782d018d3f59e184_0

Filesize
38KB

MD5
84cfc7265c3b90dc7010a687d4140d38

SHA1
41668f71d4fe50c87c2e5fbeaa87504408c4326b

SHA256
adb5da885f30ce5ba629b9f04a96e353b7ac014a3345a5b26c3a0871086914ee

SHA512
2f7dade2e9ba692c17d380bdde16aec4712140cbd6f3b5089a5124738522022be65d7284beb2932b7e89f1deb863ef42671bc94ab4fe4c2ef3b1c0d151f4629e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\78bc646c0524ce58_0

Filesize
2KB

MD5
dee267904c37f25e41e4f0d003a59067

SHA1
38793084a7684d30c43dd74adea6cbb0416c6271

SHA256
7063b6cbf26edec00a58372747c6e1f29586d6b63d82991708970c849bf476fd

SHA512
6efa1f441591d386e42253ae3c655b5cfec727fbe879183a1562da775076a7b4483f68929328806fd969cc9779ca265d34b43c437beebc419c650434107cadf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7d07dc3a67fdc3b2_0

Filesize
9KB

MD5
3e5a4689ee051f90c000f1506d151399

SHA1
a362bcdad970c0dc3e33613c40fc7566842ee402

SHA256
fcd79e9340710e51392b95f019b1829e2aa971c86982df74479cb9410a151dd5

SHA512
002dbef7cd68eb6831bb7d9b5fa9f2f54745e25ce172b606034dfd4544292537247c04ce53190fb8ad5b824af548e1ad9207112f485d28494f1daab69a57cdad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7e528f4467b3d2fb_0

Filesize
113KB

MD5
7495d44f10f1b96f38520339b513f5f4

SHA1
1ec84e24334f6adc5757be79aa5f30788d6b414a

SHA256
6643c82f1fa7b5e5a6f9e6d7d6ad1e3bca32c161b9494dd0ab3e165e20b00186

SHA512
93a582076c0c2be4988e45289b08c10967dbfce06a206e9d1a3972581afc828f96dee3fd06baea5031f27f0f4024fee6083600ec983fcf430355b2bb720c2df0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\86b9cbd77d05d034_0

Filesize
9KB

MD5
dbfa931a37c52c9b5a1076925829bd22

SHA1
755002bd13495475c9140290b2c3ed4c85788747

SHA256
1a32ef4354c81a816b0a108bf87e1c50e2a32ea626b99253b38c01faff00df44

SHA512
aecdf0fd105b4d55864806e53208ae3daac8aed372426505e5d2a8ad9c28bead70fba34d5b7e6054c7f3329e76530d4a8479c601d6ae9b1edd6632b32aa803f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8af246396026ba94_0

Filesize
64KB

MD5
65456d16d5955edf8ce0d5064902bfb0

SHA1
cafd2c3d1003087d74ab98cdbdc67da9ed576f83

SHA256
bf68b7ba9dbb387973137c7231b00678298795b8aaf5818559f8a5bed46161e9

SHA512
3be9373a4dcce1240aa4aef2d1b2da49d80ed5ce91b059dfe05826e67738ed059a795f3f546580bf6abc85a4b5a9d1e5ea0349e94e59a84396fd288475e9a7f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8e5987d08f7b6e11_0

Filesize
1KB

MD5
82bce0cea020e1633ba446c42bc5a0d8

SHA1
a0904be46b724332c2142be4746ebc6b03d4ce51

SHA256
f9bbbda332cacf22803120ac587104dea0379ebc7064531af2378fe6dba8164a

SHA512
8eeff154639a7229114efba67d2e6bbe0071371fb955b7611a2f8647f36f2bc21867254107551b209ad77ab605dfb8f0e65313a9c18cc7dcbdfbf1a989c598a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\90d7d7591a1b39bb_0

Filesize
262B

MD5
ed4eb53ee7350846ea8fc6ac567b6d1e

SHA1
5f9d40570e684c751f020180dbb9631fe99b967a

SHA256
cdbd2b40a189a63696cd8e4a5f325c1fae7a8f290b4597031022b243e4ddff9b

SHA512
75ec0ff6bd19b42582db1eabf1ca3c2be55554a48b842bc11c480e2926547489a93aa4361232f76556369b2d0c2b17049838d874484bd87e52736511a3a5cfff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\96bc766215a93e35_0

Filesize
3KB

MD5
c962f1b5c6f22f758e48b3889d674844

SHA1
0e8a19292a680d43cc3d301ab124991acfd385e9

SHA256
9876719ed416764d07bcc81c3ba194389ef8902c645969bec2bbbae0a8a369fa

SHA512
fe5a9367737312976549d641ad6f669b3d9b36804ef77d298a742e85b31f45ec227a35d0bf61d22c23133b71a50fa54e709050d6e96c68db63a6d5788b16c6c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9dbb949d27873cbc_0

Filesize
2KB

MD5
5560f4828f0de8bd360dd0449e812119

SHA1
5bfa07e8d990ac2081b744441e88ca6d8a2a7937

SHA256
14f546441e450c3cef8b0977ea7c335bd6f5aa127efaf838df1b51c68c302e62

SHA512
acefa9fe8d0a37725ac593a43700123259920ae3d7c30c573adfb9f91cd324148d611b947fc7964534ae761c236de3b3886fc830c91a4e2c6b4fabbc822bbb0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b1d693ac0f52716b_0

Filesize
10KB

MD5
1d066bbfc932828f4f862bd0c8d7712c

SHA1
6f100a03e2932bb385f80b0c7c3d525fddd9ef9b

SHA256
8ee75472912e4f877b6fa181363d5df399f5b6f77df38d5acdb908d1514953b8

SHA512
1b62c63c9bb71bbda1a2313eb99871c4b908bacaa6860aae5f4608ab2bcc5096c3dad2c02716f17ce8338f71206edeee206c39171b37156d9317b3094ccc13ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b3e82669a81c981d_0

Filesize
2KB

MD5
c90f5159cb9c38b1241de30f0cd0ca27

SHA1
2b331039858daaf062554a998655ad3110944780

SHA256
e0269107df3ef29d14978f61a2d0b787c7fe1e4e9d4655a88c8329f5ba7e121c

SHA512
cd4f165cbdc47df09fb6919f183e7363597b71ddc1f685663e242ce9b1adbd59b558104bfcfc610791eaa803ca3e8d73e8270c30d1f4903f755a902578f80741

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be6d12311ce2b399_0

Filesize
2KB

MD5
173870e3e2f3ae4ced52b9bd3f185fb9

SHA1
6f7101b2a6ae63866f931a29adc544b2b886729a

SHA256
f1a8bbb5f7b6b26c0f00e46af25401d50491ac1d89918d5d8251126ff3aa9040

SHA512
e1821b9563c07bbf8ffcdaae12a99dac2e869358af42a794c456874471a00bc52f400dfcbbe7a42118c238c9ef34b31d10aa25402c17a7d8542a078161cd1f5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c211c9dc68f4bf01_0

Filesize
5KB

MD5
5f959e98242e0b033ba62c1c3761c868

SHA1
3c15b849094f8039e2ea7e556f7d52f84dad92dd

SHA256
7a044d548aedb360b1092db8ac4ce5fb0368c84ac090b1934193c928d357b0bc

SHA512
f2e3442776be944377553a8ef3221020b870ed7049cc6a733678f47b3cceb16971e60663cef4eba515486cb7b1f8f05cf2e185ca59d0ef404352bc1a76127c49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c91c845c83814759_0

Filesize
43KB

MD5
f885e5a270fc573443d09e24d08613f3

SHA1
db04f944b477db902b40cce289daebd185cbad99

SHA256
e8134577f0030068863717f0e813ecd91bef7776890775fe57fac9fdd5246aae

SHA512
bf665adc92e4cce9389034f1e2dc1f006ca91a6fb97e862de3c8f3baa05465e94dbdfc2e7e18ca8ea6afe902db732a776bf3889ecdf294aa69c8238396794ae4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cd9a47d844308cbb_0

Filesize
6KB

MD5
09a4cb842b7b4a6465a95d11ac346bbd

SHA1
c96282d12661a2167e8dc85f781e83e0f2d39009

SHA256
33f5da4160cc9f91c72b9af9d665f221cd40c21aefca61dbb30ae3d5113581c2

SHA512
71315594dadcc8915fc37e472022d173b8fc1aee3fcc748b7b5e1e9f30a1d06dc0c41da158cdcb7d3d5c5de2730097f66b2efe1246c0bd1fe328ddb28df4735d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d79e0a2891fc014a_0

Filesize
262B

MD5
35f466674b87e6ee19e13b8dd7e732d8

SHA1
7e4ac00680685a2d994f2c478b8182f62a2f8fc9

SHA256
437eb6b2de4fd5f6ab91005f100bff77924c5d9350cac08e9d4b8bc3b2cd17cd

SHA512
1ac3bdb576cdb748f8766c39d12f8c10ec6fedf1e83dd0a89f742c36ffcdf909833b346e53fa1f97d3cab462faf6be2ca85bc5db9252d4db985b3e10d064062d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\da82014a94532e8f_0

Filesize
33KB

MD5
6dc55fc18e481b0e9c4536da45d17abf

SHA1
9daa6c7c6f82a37352e7e599da4fe15786ca786f

SHA256
1264740800ee66f75c24ca03500ab6b60d1fbc410629550a4d4d9b48da7ab671

SHA512
007b0852f83cd084c92fc22f0db02165d88d011301cad27cf6f298da11fc705d0aef1dd06a0caab47195ab80d95ab3d93928887537599b1f27267b1326a0be6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dcbc045b56c6cbd2_0

Filesize
175KB

MD5
b84517e92265d14fb4ee6752be94afa2

SHA1
496f309bd6d2c94f445ef3e2251e88ae7cceddeb

SHA256
489308002906e22474364e660c57f01fd5fdd2d75a0824f73a59ec00a58810db

SHA512
5b2c593371f1d43c17930610573652af6adf70ac3dc8d34c1c29cc9aee857bc820d4142a7a19b6f403c9f244d72e68861f0262405f43604acb01a1c2177f35cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ddf1762c73ab47f3_0

Filesize
291KB

MD5
d966363f226c4bae83d1a4d7ce406236

SHA1
1a1180235e22775fa844346c53f267d1c792c8e4

SHA256
8783a51f09fcb1b396f85ff188f7ae87dd9680b528682270b7dd6118b1708ec6

SHA512
bd360fb520e1e970ec949cc7a619f9fa4b46b138ae5d6107f2e92e4469df548e937b65f88159372e3b72e5c828c7f03b4a9a5776e9f1ebb0726bb91364bd8000

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e146fd968644d345_0

Filesize
10KB

MD5
9b37c75f5e18f506d46d101b54fead29

SHA1
e9a348d96ca442bbb4104f47b0f166fcba6cad75

SHA256
d4973a6a4c7990e50ef54a198e3878d8fa78d52635c8ff413685ffede5ecb758

SHA512
0f0b30311f4215927da4fb7989be13d452affca950b9b8944d96a228994156c9db0f3d4753c1ac42cd1625fa2b634db916456e9d57e41b9cc0ce90dff9de4076

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9c7e700cc3e33cf_0

Filesize
48KB

MD5
306310ae027c9251035d4a926f7b2185

SHA1
7c19a515bdf37406c0a9bb19648746b9fc86f12f

SHA256
5d87313f143675b40b351825ae7a1ff4749dfb03db345ade5da2759847ea163e

SHA512
6eb8633ce20678945839d438ccee6e156aac056cab42287249b1109e10d4fc802fecf3da0b613c35154f3d99968f22f4ccfb5c665a23d03b44d1db08f2934dc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2e4bbad99a372cc_0

Filesize
2KB

MD5
eabbc72e05cdc334f5d4eaeafc1d9d23

SHA1
3b40690c557bd5eccf46003b735844d2d8bbd63e

SHA256
4b73ca29a248c314223037beec2d1d8ac81ba6ae9d205c3c2dd484ccb4cd22bf

SHA512
bc60c381e13d7e0ae5bff2d65bab7aea3829f3d21e0b68e21d2a3da1fc57b2c5dd4355d935b005490b03045070d63a0b75df290d5ea75f4860689c53d5342ed7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f42c9cfed4a6704d_0

Filesize
262B

MD5
b84b5f82a483c30bfb7f50b293776881

SHA1
13b6f583dca7d83c8b466df7ecfd9cc4435f8d13

SHA256
d78646fad47f79186104c7decbcbe2c451032a1faeddab1cd12946879b8464af

SHA512
7413068427772834416e26e6b4819de6c17b786c3055a912070a3bb94ebfec7413fb97b2b2b34e193ac3be94fa3a43a84df572215de3344ddc7bba4737e9b1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f82eb14bf14a7040_0

Filesize
294B

MD5
b4651ab6d1e55f6ee3b29eb044218a21

SHA1
dd83066a9754c85fb5f4f1cd7efcb9a08ba4c97b

SHA256
daafa80a5e8ff5093338c1d8549a853318ecd1543d5218b09ec80a36275cd588

SHA512
8764cd2eb88b74c8c4ab0a888d24e6f6ceddf354119d14607afc3cca85b626130662a7e57f416c06ac0a8ac0179252f81ab43fa9e818bede4e66ed4bcc6c6f1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fbd11ea5cda006cc_0

Filesize
28KB

MD5
35da87f42d6ac7aaf9245391e2edea8a

SHA1
8c4f50f6b5d224cd75fb9cb79fdcb309d8129881

SHA256
ab39e0a229325fe48efcfd573fa0ddb1eb9c072992bd58e18cfcd98da7ced065

SHA512
2b650356826a56395ccdb7be882a1fa699356dbf25cfd96d4dfb4639c4c9c3f21cea1f6dab1a1766b5fd5da7cdbae5f2e022905f7e2e146ccc185812501d3598

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
97fadd525136e9c1cace882ec9a9d714

SHA1
e87e065f08589496f0665fe1e6a7125ee1518fd9

SHA256
291a8e27db2ee23ff8a1d01c93217a6d16c5fd5c774ec568a59888a114001171

SHA512
6b690673a871d8eeb7e78298b9ca9ca690a2fe27454167b87c8eb05cd99e83a192f537557ab87ce4ff61217f8ad1977608597e6a3546306a3c31f2be69fd53fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
316a5253dbaed2d4ae592997e8ce0b98

SHA1
e775cfd8ab7339acdc930addcdf7bb65fcf3d4d4

SHA256
f95fc90c9b1d3d870085621c6ed75a8f43583b6db7eff37154d87b63da53e500

SHA512
8277779a2cf01ffbec382ec53a77b9f1be6321c6b8d33658051ada8d397e53f58ca4b4514f711cb08e437f2ab5b9873914cec5ec04c6f3760931f63287c06fb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
a1730344f2898f93d77a09860fe14412

SHA1
b2c2f4c77d3d56d58f6fdfef303f3eefa66e92eb

SHA256
eca2392c05db83ff1fa28b7e321b5301971bf0cc41c52569527c9ccc56e4e2f7

SHA512
fbe5dd0a4cdbe373146e2f16097313abd4f185b01491c7a6d7cd249932a753139e426b2b43a0016a1635f6e49e535ba1b2446679b2358119b778544db5bac718

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
1479a65ab8f92b6ef382787a1ae58105

SHA1
66dffe1239d76472a799f73aa921920319f39cb3

SHA256
706fdb79c5a894d12d3b5826802f6c7681129adfb3e9468bc586d1fc85be1acb

SHA512
3f67d089b03c3dc4ecc13f66b872f2b16c25986d2bbf427c430dffb89a313e162056a29812b34d33eaaf6c23a13ed7d50ce5164fdbbe58e11562e427dac1f26b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e6841a1b8de4eda9d644ed1b94ba118a

SHA1
7b7c0f5c991e7e4234ca311f7a19ba63fcca9171

SHA256
640359d4b1863084d0e41857a07cdd1e19c31afac76eed0d68b603814f833af1

SHA512
f9fbedff137498a352e09b37451d9ba23f429254f2607b1b71f45916c184c4dbffbb4546535fd4a73d3925e7fd35b958abdb11da3404b4fc010176bd1eee561f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9efebd023b7e111b1e0bfdd6740d3501

SHA1
d6065d794c85ab0254e9b7bb8c045bdb4e1939f7

SHA256
9327cd1fd2e99c3ff7fbe5e1920f363c1fdf2390553f2886e3806720693a84e5

SHA512
2a544cece883c02bbddf064a84294bf7a742505bf35516319e0ff4542073a45b5fe0e8fb88ff9d002d64364b42df414ca9db15c8dcbe230ce5cb05aa66211072

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8f14c6c7fd95b3384c9dedb8ab17a47f

SHA1
5d24bc18f89ab60f1931a590476cba4cc0a3ee01

SHA256
4724349244a52559fa74b60d0a3f7489bec1724c8425d0a00adfaa842fbdd00a

SHA512
42abade5502e905e32af846768ac1db778bab4b1d8891ac4d5bb330113c8a0b97fa8081d3fc4326122136f1984fcdada4995f3fcda1303e4a5598178110187bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3c575581d2b9be2d70159cd8cd8357fb

SHA1
85652d1fc0984d7405d0c06f998c796ac343174f

SHA256
47f70c20159c1f6d26fa80eb1c4ff0a699f52362b6f85e82611c9f4c460be39d

SHA512
08c0f8131c70fd3c4dd6b9bf2896cb7c5554320c877f7a4b6f9475d38acd55ab0b5efb94a2a3ff4ce70bb4406e3ef200fc9165c79de3efec7eb704c9f1ec0e92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
546dd4bbf690f4f9c7da8851ff994837

SHA1
e7d11e2e2b7f7e3de69151e8e24ce906df0d0d06

SHA256
7f0bd1d5e767fdbc3202990afe1e7a8242aa1fce12d7ae140dbe5ae1aad66329

SHA512
91319906881b8d125da2b7d0f2baa8e5ec738261750d9f04a30d18b89281df66b2ebc16b3b573808dfd8110635abc55f07f43cd2b196d8fe7b53b1457ec4dc6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
806d2fe6678bebaee7a02a2d1d904992

SHA1
26f994f1bc20f034be3fbfac39c0b6dc5907c5ec

SHA256
b1d7fc32878dfdc4bbeec9bdd05f9bca93ca84b74ef551bc4f77308671966b0e

SHA512
7f75681c7580615df81e07945140d54d491c5f5d0efd588aa8c7139d8d47609bcb6edd102d8b224c5dc19031db6eeeba696e313e16b2b24ef72f917b13f956ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a065fc8880bd624b61e1cb0c6bc91964

SHA1
0be0e0f762f6129c73e94d3bfbeedaa0431b609b

SHA256
81fd022b9d54777528fa8cf7e15d5fa3957b1d138c70a36f1586bd79724fad36

SHA512
37a4e9e8d0fc1e612564b17ca82985d1ac7673f0ccec050f47f996767e127846fed317d065b08e63152e088065fa2efc201fa2bb732c255b515a0d4f097738f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
14a55c5b667f99d71bba71f93e86b7c8

SHA1
99323458c6842ab3cd669dc47c8015e97d044dd8

SHA256
00bfb85306b2f702b8cf493646a682afaaf7b54998d1a25494d93244c01b8fb2

SHA512
de5b5378a829479d455146862ca4c4cf799f54195914f12632faf6912b5af184e3ffba3621aa22bbeb440659748b0b9fa588401da9848125f01d6ab5312214af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
50784a703ef6fefec86719c21a9ce635

SHA1
2c918d0f293f2ceb7c259fd2fc424627c517ba65

SHA256
883ce936f6dc1e1d1e04283f23ec8df70d4143b07f9a2e94d29980dc076a3d44

SHA512
b97964e373c8995c8b8e973c7e860b4b696ddeb4e85da8030a53a32d9e90cd604df0ea6d64eb4026449d210c0127bf20619f81f47f2c219e54bac225ed9db7cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2a7aebb63ad9e6163c1347204d730e1e

SHA1
c257182e90f6033bf29b8d1234f4e4c3bd1a4ba8

SHA256
48831f8b1c42f559dae69e2840bbe8e34d944c243cf2c5705af3aefcba7f711b

SHA512
2939bba04c6fedc6582878ca1f642a61668cae846fb6b0489fd06609a8fe29350452e2cea1048dffddf05e2015dea522ee497b950f606b78053375de5d4bc99f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
054e23b66b8f92af5c5b192721066d3c

SHA1
b4f9ffb1000d86a760297fdbbfbc2c86f30c3f88

SHA256
93c37324b0b1c7f15670439f07fb012b904f63402f6b57fd5344a42b5ab333da

SHA512
113d4f35de4422a05deff0889c83993a071dbeb21b4a408d3f55d5de3d03e595a9fde0548010197929515bf66031283381081b7f9ba7d102e18703fa57c38894

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b66f2a859e7d5dff7efb8c071e1c0589

SHA1
ebbf25a0de1141f2eb6722f215342eb5103a3672

SHA256
5ad8cea95380cb83198726b32deac60a92c217a9185cf0ce5c8ccf7105c9eff8

SHA512
1047d838f39bcd330c19e641c0179a9b0b40013e5339f3122e8844b51c22a96772cfb7df9cf58cd03c38e2ea8460521212978381112041151dc42da7ffcd034e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b53339e41833050032a39113e0bf4b19

SHA1
edb9898e210d9b41a5c9f0bc3d12e1c8cab9acef

SHA256
100ec327ed919faffc3031b50882385fa773c9ca115404e7ef61c9833669d6e5

SHA512
92d895aa901d52ffb946928817c855e251d1c88b6f3d137cfc0ef9e9b59dccb7000471e698f8e5f0b4547bb3c7642cd82389d7470f3099f8737b140c2fb47bd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2066e993150c9d8152504046f9c2b4a7

SHA1
2d9526b2503ef06b3866a720abda1f74b84aedb0

SHA256
be0107f914c1f9c96a706b1eb3515f9cad624fca767a8080d6234444a2ad571a

SHA512
3ae710f033bb4a1f7441c00e124a1feabe52640b5e23cb449e25490c77e400943ce0c7139026bbed89635d0f985dff2f3be21d36fa1e2e79f260f54d40d86259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5ff773f8286cdfb81d6ec79e12dcbfd1

SHA1
1b79f98c2f9ec458c409b4a83fd1db3f154857e3

SHA256
a016b730c2bd641359d9d7a78c82f96575d8251d135b570b5fc7e66f3c8726f3

SHA512
3ed7d5a0204b4ef2a37a267559fa52b16c93de22d12e81505b83097c18313b6d81800e48197cf1145a7ccc725438da3921ce757fc53febd29675b720a398dd41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aa9fe34782f9111c8ab6c6940c0ae9d2

SHA1
ddf3896e8f59efbd2f54cca30dcff1ce1b08ddb5

SHA256
7c3962b9956fcdd01c0d145c00a75f5a408793c3215d842cec9dcb3280351bf6

SHA512
5ed838451259760c9b2cf488b8262817bf8c779f53fb544909584fe5b67628ba027e4bcfbe87bbb0ace70ad56321df26eb41146da3ce85e6b04d95ab47921978

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4446a7f7f1eafd331960c7b79d4641c2

SHA1
710e6b33e3fd5f82f696aab3296f82d8ca61d6ec

SHA256
e39723f2eb04b7c3d7ef8f9affd4cb4ada0314fe9d64480c463de8a2cab0be3e

SHA512
8e0b3e7601ca75e1b0c16ab83554941c97096f8c9f2aae44dcb36d60bc910ba4a0ab4a7474bc3b54ab3f3c02a8aed8f2bc0c0f3509e40f6cc02c27449f7811f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c4a3ab96c2e81d4b13a3e63aa3d39650

SHA1
56e252628d718288f06cf3a04e1234594335dd3f

SHA256
61dadc1c45370df53001d051a7c03ae8f014e148310d21a0f11876aa8e188503

SHA512
af39f473fbcc2050787367dc3e41f3506b98cc54c0fbee70c87abe7f5f3fa241c8f56322b2ed1c06bb4b6a5aed30fa459c81caa7cc006d638aa2a1fbec31f3ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f34617ddd9121b8e16ddac1b867ce4f4

SHA1
ad18028f77590d71e6e469180cac04e1507ec244

SHA256
2bcbc01e293fa5399a358e8ccdcce55fc4b0398837086f4c455e6740f722e7f4

SHA512
4040ef0d631b19cb6225ebfae55bfd629d2be563bec4ecb06274bf9aa86cc045883a01957fdee47334355c51801cab1e2b68c828da6ad146b80d1b7979c07b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6b640d2e29db113c4af6c3c3ef59c4f5

SHA1
3366f083bd087facadc2ba3ca835dbd612bd3594

SHA256
51c23a58286ad2dcd95b412a5baf0bd0f9b7f4c6f1f85fafb0de7fa1f4332b6b

SHA512
f9327b68e61c44b7f27b77bd306eb9aa4f262a953274e6669f2ddb2b1b192db06c30b93726e3b7e8ae0052c70c454a8d674ffa895bda3d3d510a1f7a5262c1cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
882c663d0a35c980f996d3a20ce0b06d

SHA1
226860c4e69f2780ebf14c651920a30d6abae73f

SHA256
ac3d7727a1a882aa0f15d413506ea16f668ff63d1fc90c6337c8a90ba58b0a55

SHA512
eda9e6bafd60d9e272ce4db9ca9df46f142d12d8fa7041ab0af35796f9200e4a5d132e77f0f05f28bebc1ffa6810747223d121ddc086150c854bf2c91c252f94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0b3066834d2dfa7ff0d2385c3224277d

SHA1
0f4e6b7ea47685dbbb3077bcaa352ed72413d0fc

SHA256
3393356bf1d6003a922ff40c18b27a0f98699553403acd509184ecef072fb21b

SHA512
c3495da5a2e1ac726f13905a0703179969872e1f18b04583f82c125e3769028725a7de776d7b8168a8960693edbcb9f9101c6d4359c61748a1d307d4859b08f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5832c3.TMP

Filesize
867B

MD5
055aac2c404c503a13b2035f75c1273d

SHA1
9b04e6141124b20b4a72d878d9617ab086453c06

SHA256
2bdc7c0a6a758e10f5618500cb114d7bb7bdfea5f06e4b2be549f1daae671071

SHA512
6a2536498663b63ece9880e5d87462641390c993e59c5bf2116d5e0706506fda6435c41c7296a8fc8f656c55c35b1ddaa1df4a083d6863e05f48ac517c1f6d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1ba78a0edddf16e866089fb730919cff

SHA1
38393a53ee86b60088306d596e44bef587135473

SHA256
4449f3d9e9720a5f56f73e3cf660a435745d09881d04b1d15b514f7bc24733c6

SHA512
243be894a4ff496a6521e3aaf541bd7d79593bef7977d68a4b0414291f0209792154fdc6ef3c18c3b4ca011a79c0316b718e4fa22ebf06a9d64aef6bae1ac1c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ecebbf296cc397dee60e130a94cace1e

SHA1
7f5604902460aa51982d47d374bed79e62d4dbb3

SHA256
a431781a7f1d1d220804681e3a0f2ee7c384b3dd0af091de7f7af839fb8de046

SHA512
83b959caf08036df126a78ee4b66beb029d03477d84fcd1626fc442908fce5059d7bed47bd6c4e1094ab81c3e453a1699cda9a7d89ee917ba219ef013780bf86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9f923daf430d10ea01abf2b7583f8b58

SHA1
174dee9425f6ac5335f32cdad2b1544c0477d120

SHA256
c9278743974d5b38428c9ddbeb19224b47d2cd39a1eb2da649136e11f3ae6e9f

SHA512
4c92617360446ef283877cb04ce03b9189ddc8287a73b35bdfab6959caedc521744544d1022d7dd9b7c98ac7be2ec6f268a82831c4efd594b31251a785c12e3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
02cbcf0c4d2b49c2b2fde819447e5997

SHA1
d4a8406cced7e66011ac3c93d264379936b58c8d

SHA256
55b853b85461958ccf67144f74241ad09139770f1f7bd01bc0b057817b532bcc

SHA512
f0f23031185949d6c6db4f92f62b1254e6243aca3c5ec2457c453a0c25a552fc5a522d181e9455c90d0eb0fc3b01815354a3af8eca78395af219681404ee505e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
76c7e477bac97dbc042d6671c94d72a7

SHA1
93de5cde47f8394c0a47ad6cee55246208d70ab3

SHA256
42389cd5848125acb52f7755370ef20326bfca052ccf4de2b7c3e2eae484b2c5

SHA512
a9baacb6fae53aba737fe588bb6b866dbda6b666355364ccf0ca03d43d02d4bca5d77b88389a20f1cef1a4efb971718e21de86ebacff3390ddd2339348168aa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
512KB

MD5
184b90df1e8797a11ee3c2657ebd1184

SHA1
b30dcfa1aa137b4cb18cd98cbff2f5bd94bd1bed

SHA256
753eaf1657a1f1473b0d4895f8caabf96bddf16bc782327fb0210012aea69098

SHA512
3a08ac6a5c7e28af5ed8c30def7e6c2e42c35178d6bd1c8ab8145de500a4052e3da6eb158d5514a376768d6e3b7ecc326194456e939d3841ed91626dc43e335b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
ef64de10be62f0976b9e9223373fe6a8

SHA1
b04fa39b43c5f1bd1b9a612904e3fe49eef4f8d6

SHA256
1e80475b719d6a9ae591cc8c6feb811ca58476c65afbd8b85bec7af7f55ca5b8

SHA512
ee11fd7b4383630e79b464fd7aabc0e2f01e5da512e9985567a9ee31ce0690426e554e86ae75a102ed9e40c0262b1d9c65ed5d1b4c3aa49a7476b88101d52040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Filesize
68KB

MD5
1d0c704446711e10b08a113ebcc4d325

SHA1
a7b0eb67480e44daf07660c2a732a122a1585701

SHA256
2d64a540ad6cb34e0ddedc3bfd15dafb1d625450d0bb68c14d5cb57027d8b4e1

SHA512
d400aa0cfed2ffd01e1b82402c801c7ded636ab86a97db223956e539fb5b2954692a6e036e707e8b4ea9dc55eb8b390c7ba47f559279cb1ae59858b4f0233222

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Filesize
498B

MD5
90be2701c8112bebc6bd58a7de19846e

SHA1
a95be407036982392e2e684fb9ff6602ecad6f1e

SHA256
644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

SHA512
d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\5bc5ff6d-df5a-4f1c-925c-cfad4bd712d9.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
4c030a9ba44fe8fe2e593e43acb8cf3d

SHA1
324306bcf1e447c12d19430b192be90c88d15781

SHA256
6b113ef60e331fcb1517ad6977ced22d188ab4b84f3ddcadef9024cbfa5b2354

SHA512
4587dcc6be11df4fee2318e5b344675e548af159b535437bdcb31eb850d8854b9b236db4fa93ecf0fce3104a35f6531a446b1d68bce18013cba134e73020fb04

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
3KB

MD5
f3ed049f8f0885f8e08d93563848c0f3

SHA1
27a51d57e4a8f1b983745fd25e63f739abb367e2

SHA256
a4c3b2fb8cee25b822334459e62f70053b6401798d45fc327912d8fcc1935729

SHA512
96992e3b23bf512f0571ee5ab76b3f43405da459930c4e0f5f482e07b364cc5da96d57e054c05d4f1796404f8bf09af12ae98c234cb9491d12b8512f34e7d770

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

Filesize
13.0MB

MD5
07b2240f2ab9e34fff70c57014c4980f

SHA1
f2caa2faf51a3b456c7a26d6c3d1ae129c485980

SHA256
1013f524434ee6f555d8328a349cd898df3e302d45d23f3b82aa9e8f8b53de3f

SHA512
57326b823379fdc5a04d61cbe8cbb304f5f12810367e2b9fe777df4305c286f1d396595be3116491e89af56c1175a3ed4394625d531e03e72dfea76bd2668138

Download Submit
C:\Users\Admin\Desktop\MRS MAJOR WANTS TO MEET YOU 6.txt

Filesize
27B

MD5
e20f623b1d5a781f86b51347260d68a5

SHA1
7e06a43ba81d27b017eb1d5dcc62124a9579f96e

SHA256
afeebe824fc4a955a673d3d8569a0b49dfbc43c6cc1d4e3d66d9855c28a7a179

SHA512
2e74cccdd158ce1ffde84573d43e44ec6e488d00282a661700906ba1966ad90968a16c405a9640b9d33db03b33753733c9b7078844b0f6ac3af3de0c3c044c0b

Download Submit
C:\Users\Admin\Downloads\@[email protected]

Filesize
933B

MD5
7a2726bb6e6a79fb1d092b7f2b688af0

SHA1
b3effadce8b76aee8cd6ce2eccbb8701797468a2

SHA256
840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5

SHA512
4e107f661e6be183659fdd265e131a64cce2112d842226305f6b111d00109a970fda0b5abfb1daa9f64428e445e3b472332392435707c9aebbfe94c480c72e54

Download Submit
C:\Users\Admin\Downloads\TaskData\Tor\tor.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 319287.crdownload

Filesize
1.9MB

MD5
38ff71c1dee2a9add67f1edb1a30ff8c

SHA1
10f0defd98d4e5096fbeb321b28d6559e44d66db

SHA256
730a41a7656f606a22e9f0d68782612d6e00ab8cfe1260160b9e0b00bc2e442a

SHA512
8347782951f2647fe433482cb13186653afa32ee9f5be83a138c4ed47ff34d8de66a26e74b5a28ea21c1529b2078401922a9a26803772677b70489967c10f3e9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 930980.crdownload

Filesize
261KB

MD5
fc933d271c0608b1a91e04887b9f50b1

SHA1
f7603497354d987c6375fa60fd12645813ec4737

SHA256
d53f4591e1f09a37e3b235bba1676c9f0402c436abf26707496b027a26858b16

SHA512
464d840784e2b6f7ff7b79b781dd0ea924ea9971e55dacee1d9b9f1f94186af9c7965f71847491093b58f050d6a09232e1f430eaef17285ae807fcc2ea874dfb

Download Submit
C:\Users\Admin\Downloads\WannaCry.EXE

Filesize
3.4MB

MD5
84c82835a5d21bbcf75a61706d8ab549

SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

Download Submit
C:\Users\Admin\Downloads\WannaCry.EXE:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\b.wnry

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\Downloads\c.wnry

Filesize
780B

MD5
8124a611153cd3aceb85a7ac58eaa25d

SHA1
c1d5cd8774261d810dca9b6a8e478d01cd4995d6

SHA256
0ceb451c1dbefaa8231eeb462e8ce639863eb5b8ae4fa63a353eb6e86173119e

SHA512
b9c8dfb5d58c95628528cc729d2394367c5e205328645ca6ef78a3552d9ad9f824ae20611a43a6e01daaffeffdc9094f80d772620c731e4192eb0835b8ed0f17

Download Submit
C:\Users\Admin\Downloads\msg\m_bulgarian.wnry

Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\Downloads\msg\m_chinese (simplified).wnry

Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\Downloads\msg\m_chinese (traditional).wnry

Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\Downloads\msg\m_croatian.wnry

Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\Downloads\msg\m_czech.wnry

Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\Downloads\msg\m_danish.wnry

Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\Downloads\msg\m_dutch.wnry

Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\Downloads\msg\m_english.wnry

Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\Downloads\msg\m_filipino.wnry

Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\Downloads\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Downloads\msg\m_french.wnry

Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\Downloads\msg\m_german.wnry

Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\Downloads\msg\m_greek.wnry

Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\Downloads\msg\m_indonesian.wnry

Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\Downloads\msg\m_italian.wnry

Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\Downloads\msg\m_japanese.wnry

Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\Downloads\msg\m_korean.wnry

Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Users\Admin\Downloads\msg\m_latvian.wnry

Filesize
40KB

MD5
c33afb4ecc04ee1bcc6975bea49abe40

SHA1
fbea4f170507cde02b839527ef50b7ec74b4821f

SHA256
a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

SHA512
0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

Download Submit
C:\Users\Admin\Downloads\msg\m_norwegian.wnry

Filesize
36KB

MD5
ff70cc7c00951084175d12128ce02399

SHA1
75ad3b1ad4fb14813882d88e952208c648f1fd18

SHA256
cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

SHA512
f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

Download Submit
C:\Users\Admin\Downloads\msg\m_polish.wnry

Filesize
38KB

MD5
e79d7f2833a9c2e2553c7fe04a1b63f4

SHA1
3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

SHA256
519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

SHA512
e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

Download Submit
C:\Users\Admin\Downloads\msg\m_portuguese.wnry

Filesize
37KB

MD5
fa948f7d8dfb21ceddd6794f2d56b44f

SHA1
ca915fbe020caa88dd776d89632d7866f660fc7a

SHA256
bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

SHA512
0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

Download Submit
C:\Users\Admin\Downloads\msg\m_romanian.wnry

Filesize
50KB

MD5
313e0ececd24f4fa1504118a11bc7986

SHA1
e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

SHA256
70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

SHA512
c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

Download Submit
C:\Users\Admin\Downloads\msg\m_russian.wnry

Filesize
46KB

MD5
452615db2336d60af7e2057481e4cab5

SHA1
442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

SHA256
02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

SHA512
7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

Download Submit
C:\Users\Admin\Downloads\msg\m_slovak.wnry

Filesize
40KB

MD5
c911aba4ab1da6c28cf86338ab2ab6cc

SHA1
fee0fd58b8efe76077620d8abc7500dbfef7c5b0

SHA256
e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

SHA512
3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

Download Submit
C:\Users\Admin\Downloads\msg\m_spanish.wnry

Filesize
36KB

MD5
8d61648d34cba8ae9d1e2a219019add1

SHA1
2091e42fc17a0cc2f235650f7aad87abf8ba22c2

SHA256
72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

SHA512
68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

Download Submit
C:\Users\Admin\Downloads\msg\m_swedish.wnry

Filesize
37KB

MD5
c7a19984eb9f37198652eaf2fd1ee25c

SHA1
06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae

SHA256
146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4

SHA512
43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

Download Submit
C:\Users\Admin\Downloads\msg\m_turkish.wnry

Filesize
41KB

MD5
531ba6b1a5460fc9446946f91cc8c94b

SHA1
cc56978681bd546fd82d87926b5d9905c92a5803

SHA256
6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415

SHA512
ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

Download Submit
C:\Users\Admin\Downloads\msg\m_vietnamese.wnry

Filesize
91KB

MD5
8419be28a0dcec3f55823620922b00fa

SHA1
2e4791f9cdfca8abf345d606f313d22b36c46b92

SHA256
1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8

SHA512
8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

Download Submit
C:\Users\Admin\Downloads\r.wnry

Filesize
864B

MD5
3e0020fc529b1c2a061016dd2469ba96

SHA1
c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade

SHA256
402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c

SHA512
5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

Download Submit
C:\Users\Admin\Downloads\s.wnry

Filesize
2.9MB

MD5
ad4c9de7c8c40813f200ba1c2fa33083

SHA1
d1af27518d455d432b62d73c6a1497d032f6120e

SHA256
e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b

SHA512
115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617

Download Submit
C:\Users\Admin\Downloads\t.wnry

Filesize
64KB

MD5
5dcaac857e695a65f5c3ef1441a73a8f

SHA1
7b10aaeee05e7a1efb43d9f837e9356ad55c07dd

SHA256
97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6

SHA512
06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2

Download Submit
C:\Users\Admin\Downloads\taskdl.exe

Filesize
20KB

MD5
4fef5e34143e646dbf9907c4374276f5

SHA1
47a9ad4125b6bd7c55e4e7da251e23f089407b8f

SHA256
4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79

SHA512
4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5

Download Submit
C:\Users\Admin\Downloads\taskse.exe

Filesize
20KB

MD5
8495400f199ac77853c53b5a3f278f3e

SHA1
be5d6279874da315e3080b06083757aad9b32c23

SHA256
2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d

SHA512
0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4

Download Submit
C:\Users\Admin\Downloads\u.wnry

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
memory/748-587-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2376-35-0x0000000006420000-0x0000000006430000-memory.dmp

Filesize
64KB

Download
memory/2376-34-0x0000000006420000-0x0000000006430000-memory.dmp

Filesize
64KB

Download
memory/2376-33-0x0000000006420000-0x0000000006430000-memory.dmp

Filesize
64KB

Download
memory/2376-32-0x0000000006420000-0x0000000006430000-memory.dmp

Filesize
64KB

Download
memory/2376-31-0x0000000006420000-0x0000000006430000-memory.dmp

Filesize
64KB

Download
memory/2376-36-0x0000000006420000-0x0000000006430000-memory.dmp

Filesize
64KB

Download
memory/2376-52-0x0000000006420000-0x0000000006430000-memory.dmp

Filesize
64KB

Download
memory/3892-1989-0x0000000000B50000-0x0000000000E4E000-memory.dmp

Filesize
3.0MB

Download
memory/3892-2274-0x0000000073C70000-0x0000000073E8C000-memory.dmp

Filesize
2.1MB

Download
memory/3892-2114-0x0000000073FD0000-0x0000000074052000-memory.dmp

Filesize
520KB

Download
memory/3892-2117-0x0000000073E90000-0x0000000073EB2000-memory.dmp

Filesize
136KB

Download
memory/3892-1988-0x0000000073E90000-0x0000000073EB2000-memory.dmp

Filesize
136KB

Download
memory/3892-2116-0x0000000073EC0000-0x0000000073F37000-memory.dmp

Filesize
476KB

Download
memory/3892-2115-0x0000000073F40000-0x0000000073FC2000-memory.dmp

Filesize
520KB

Download
memory/3892-1985-0x0000000073FD0000-0x0000000074052000-memory.dmp

Filesize
520KB

Download
memory/3892-2335-0x0000000000B50000-0x0000000000E4E000-memory.dmp

Filesize
3.0MB

Download
memory/3892-2118-0x0000000073C70000-0x0000000073E8C000-memory.dmp

Filesize
2.1MB

Download
memory/3892-2156-0x0000000000B50000-0x0000000000E4E000-memory.dmp

Filesize
3.0MB

Download
memory/3892-1987-0x0000000073F40000-0x0000000073FC2000-memory.dmp

Filesize
520KB

Download
memory/3892-1986-0x0000000073C70000-0x0000000073E8C000-memory.dmp

Filesize
2.1MB

Download
memory/3892-2112-0x0000000000B50000-0x0000000000E4E000-memory.dmp

Filesize
3.0MB

Download
memory/3892-2113-0x0000000074060000-0x000000007407C000-memory.dmp

Filesize
112KB

Download
memory/3892-2140-0x0000000000B50000-0x0000000000E4E000-memory.dmp

Filesize
3.0MB

Download
memory/3892-2268-0x0000000000B50000-0x0000000000E4E000-memory.dmp

Filesize
3.0MB

Download