wannacry | hxxp://gfdgdf

Analysis

max time kernel
1049s
max time network
1053s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
18-01-2025 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://gfdgdf

Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Downloads MZ/PE file

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD5C8D.tmp	WannaCry.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD5C94.tmp	WannaCry.EXE

Executes dropped EXE 64 IoCs

pid	Process
4800	WinNuke.98.exe
2632	WannaCry.EXE
4764	taskdl.exe
2880	@[email protected]
3316	@[email protected]
1572	taskhsvc.exe
4660	taskdl.exe
3112	taskse.exe
2064	@[email protected]
3264	taskdl.exe
4892	taskse.exe
4176	@[email protected]
3300	Notifications.host.process.exe
3736	taskse.exe
4996	@[email protected]
2436	taskdl.exe
1160	taskse.exe
1928	@[email protected]
1500	taskdl.exe
484	taskse.exe
2564	@[email protected]
2196	taskdl.exe
3592	taskse.exe
5044	@[email protected]
2784	taskdl.exe
2328	taskse.exe
3336	@[email protected]
2416	taskdl.exe
1500	taskse.exe
3080	@[email protected]
3820	taskdl.exe
4660	taskse.exe
1332	@[email protected]
2176	taskdl.exe
2556	taskse.exe
5116	@[email protected]
4640	taskdl.exe
5100	taskse.exe
4064	@[email protected]
2984	taskdl.exe
3736	taskse.exe
1940	@[email protected]
3364	taskdl.exe
1812	taskse.exe
4812	@[email protected]
2700	taskdl.exe
2780	taskse.exe
2928	@[email protected]
3400	taskdl.exe
920	@[email protected]
4880	taskse.exe
2508	taskdl.exe
880	taskse.exe
4952	@[email protected]
5076	taskdl.exe
1616	taskse.exe
5048	@[email protected]
3048	taskdl.exe
4840	taskse.exe
4256	@[email protected]
2424	taskdl.exe
2700	taskse.exe
3360	@[email protected]
4068	taskdl.exe

Loads dropped DLL 8 IoCs

pid	Process
1572	taskhsvc.exe
1572	taskhsvc.exe
1572	taskhsvc.exe
1572	taskhsvc.exe
1572	taskhsvc.exe
1572	taskhsvc.exe
1572	taskhsvc.exe
1572	taskhsvc.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4624	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aptiorhqd785 = "\"C:\\Users\\Admin\\Downloads\\tasksche.exe\""	reg.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	Notifications.host.process.exe
File opened (read-only)	\??\L:	Notifications.host.process.exe
File opened (read-only)	\??\V:	Notifications.host.process.exe
File opened (read-only)	\??\T:	Notifications.host.process.exe
File opened (read-only)	\??\W:	Notifications.host.process.exe
File opened (read-only)	\??\A:	Notifications.host.process.exe
File opened (read-only)	\??\E:	Notifications.host.process.exe
File opened (read-only)	\??\I:	Notifications.host.process.exe
File opened (read-only)	\??\J:	Notifications.host.process.exe
File opened (read-only)	\??\Q:	Notifications.host.process.exe
File opened (read-only)	\??\R:	Notifications.host.process.exe
File opened (read-only)	\??\X:	Notifications.host.process.exe
File opened (read-only)	\??\H:	Notifications.host.process.exe
File opened (read-only)	\??\O:	Notifications.host.process.exe
File opened (read-only)	\??\U:	Notifications.host.process.exe
File opened (read-only)	\??\Z:	Notifications.host.process.exe
File opened (read-only)	\??\Y:	Notifications.host.process.exe
File opened (read-only)	\??\G:	Notifications.host.process.exe
File opened (read-only)	\??\K:	Notifications.host.process.exe
File opened (read-only)	\??\M:	Notifications.host.process.exe
File opened (read-only)	\??\N:	Notifications.host.process.exe
File opened (read-only)	\??\P:	Notifications.host.process.exe
File opened (read-only)	\??\S:	Notifications.host.process.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
14	camo.githubusercontent.com
85	raw.githubusercontent.com
13	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	WannaCry.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\WinNuke.98.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WannaCry.EXE:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Notifications.host.process.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Notifications.host.process.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinNuke.98.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2253712635-4068079004-3870069674-1000\{7C23DB48-F967-47F7-A58D-1C3849592D64}	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3424	reg.exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 192307.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WinNuke.98.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WannaCry.EXE:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 785196.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Notifications.host.process.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
3280	msedge.exe
3280	msedge.exe
4880	msedge.exe
4880	msedge.exe
756	identity_helper.exe
756	identity_helper.exe
1976	msedge.exe
1976	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
4856	msedge.exe
4856	msedge.exe
2976	msedge.exe
2976	msedge.exe
1572	taskhsvc.exe
1572	taskhsvc.exe
1572	taskhsvc.exe
1572	taskhsvc.exe
1572	taskhsvc.exe
1572	taskhsvc.exe
4080	msedge.exe
4080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	4864	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4864	AUDIODG.EXE
Token: SeIncreaseQuotaPrivilege	2172	WMIC.exe
Token: SeSecurityPrivilege	2172	WMIC.exe
Token: SeTakeOwnershipPrivilege	2172	WMIC.exe
Token: SeLoadDriverPrivilege	2172	WMIC.exe
Token: SeSystemProfilePrivilege	2172	WMIC.exe
Token: SeSystemtimePrivilege	2172	WMIC.exe
Token: SeProfSingleProcessPrivilege	2172	WMIC.exe
Token: SeIncBasePriorityPrivilege	2172	WMIC.exe
Token: SeCreatePagefilePrivilege	2172	WMIC.exe
Token: SeBackupPrivilege	2172	WMIC.exe
Token: SeRestorePrivilege	2172	WMIC.exe
Token: SeShutdownPrivilege	2172	WMIC.exe
Token: SeDebugPrivilege	2172	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2172	WMIC.exe
Token: SeRemoteShutdownPrivilege	2172	WMIC.exe
Token: SeUndockPrivilege	2172	WMIC.exe
Token: SeManageVolumePrivilege	2172	WMIC.exe
Token: 33	2172	WMIC.exe
Token: 34	2172	WMIC.exe
Token: 35	2172	WMIC.exe
Token: 36	2172	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2172	WMIC.exe
Token: SeSecurityPrivilege	2172	WMIC.exe
Token: SeTakeOwnershipPrivilege	2172	WMIC.exe
Token: SeLoadDriverPrivilege	2172	WMIC.exe
Token: SeSystemProfilePrivilege	2172	WMIC.exe
Token: SeSystemtimePrivilege	2172	WMIC.exe
Token: SeProfSingleProcessPrivilege	2172	WMIC.exe
Token: SeIncBasePriorityPrivilege	2172	WMIC.exe
Token: SeCreatePagefilePrivilege	2172	WMIC.exe
Token: SeBackupPrivilege	2172	WMIC.exe
Token: SeRestorePrivilege	2172	WMIC.exe
Token: SeShutdownPrivilege	2172	WMIC.exe
Token: SeDebugPrivilege	2172	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2172	WMIC.exe
Token: SeRemoteShutdownPrivilege	2172	WMIC.exe
Token: SeUndockPrivilege	2172	WMIC.exe
Token: SeManageVolumePrivilege	2172	WMIC.exe
Token: 33	2172	WMIC.exe
Token: 34	2172	WMIC.exe
Token: 35	2172	WMIC.exe
Token: 36	2172	WMIC.exe
Token: SeBackupPrivilege	680	vssvc.exe
Token: SeRestorePrivilege	680	vssvc.exe
Token: SeAuditPrivilege	680	vssvc.exe
Token: SeTcbPrivilege	3112	taskse.exe
Token: SeTcbPrivilege	3112	taskse.exe
Token: SeTcbPrivilege	4892	taskse.exe
Token: SeTcbPrivilege	4892	taskse.exe
Token: SeDebugPrivilege	3300	Notifications.host.process.exe
Token: SeShutdownPrivilege	3300	Notifications.host.process.exe
Token: SeCreatePagefilePrivilege	3300	Notifications.host.process.exe
Token: 33	876	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	876	AUDIODG.EXE
Token: SeShutdownPrivilege	3300	Notifications.host.process.exe
Token: SeCreatePagefilePrivilege	3300	Notifications.host.process.exe
Token: SeTcbPrivilege	3736	taskse.exe
Token: SeTcbPrivilege	3736	taskse.exe
Token: SeShutdownPrivilege	3300	Notifications.host.process.exe
Token: SeCreatePagefilePrivilege	3300	Notifications.host.process.exe
Token: SeShutdownPrivilege	3300	Notifications.host.process.exe
Token: SeCreatePagefilePrivilege	3300	Notifications.host.process.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
2880	@[email protected]
2880	@[email protected]
3316	@[email protected]
3316	@[email protected]
2064	@[email protected]
2064	@[email protected]
4176	@[email protected]
3300	Notifications.host.process.exe
4996	@[email protected]
1928	@[email protected]
2564	@[email protected]
5044	@[email protected]
3336	@[email protected]
3080	@[email protected]
1332	@[email protected]
5116	@[email protected]
4064	@[email protected]
1940	@[email protected]
4812	@[email protected]
2928	@[email protected]
920	@[email protected]
4952	@[email protected]
5048	@[email protected]
4256	@[email protected]
3360	@[email protected]
4376	@[email protected]
2988	@[email protected]
1008	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 2832	3280	msedge.exe	77
PID 3280 wrote to memory of 2832	3280	msedge.exe	77
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 4372	3280	msedge.exe	78
PID 3280 wrote to memory of 408	3280	msedge.exe	79
PID 3280 wrote to memory of 408	3280	msedge.exe	79
PID 3280 wrote to memory of 1588	3280	msedge.exe	80
PID 3280 wrote to memory of 1588	3280	msedge.exe	80
PID 3280 wrote to memory of 1588	3280	msedge.exe	80
PID 3280 wrote to memory of 1588	3280	msedge.exe	80
PID 3280 wrote to memory of 1588	3280	msedge.exe	80
PID 3280 wrote to memory of 1588	3280	msedge.exe	80
PID 3280 wrote to memory of 1588	3280	msedge.exe	80
PID 3280 wrote to memory of 1588	3280	msedge.exe	80
PID 3280 wrote to memory of 1588	3280	msedge.exe	80
PID 3280 wrote to memory of 1588	3280	msedge.exe	80
PID 3280 wrote to memory of 1588	3280	msedge.exe	80
PID 3280 wrote to memory of 1588	3280	msedge.exe	80
PID 3280 wrote to memory of 1588	3280	msedge.exe	80
PID 3280 wrote to memory of 1588	3280	msedge.exe	80
PID 3280 wrote to memory of 1588	3280	msedge.exe	80
PID 3280 wrote to memory of 1588	3280	msedge.exe	80
PID 3280 wrote to memory of 1588	3280	msedge.exe	80
PID 3280 wrote to memory of 1588	3280	msedge.exe	80
PID 3280 wrote to memory of 1588	3280	msedge.exe	80
PID 3280 wrote to memory of 1588	3280	msedge.exe	80

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3148	attrib.exe
3260	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://gfdgdf
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd73293cb8,0x7ffd73293cc8,0x7ffd73293cd8
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1636 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6464 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1628 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7164 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4856
- C:\Users\Admin\Downloads\WinNuke.98.exe
  "C:\Users\Admin\Downloads\WinNuke.98.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:4056
- C:\Users\Admin\Downloads\WannaCry.EXE
  "C:\Users\Admin\Downloads\WannaCry.EXE"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  PID:2632
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h .
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3148
- - C:\Windows\SysWOW64\icacls.exe
    icacls . /grant Everyone:F /T /C /Q
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4624
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 26141737235441.bat
    3⤵
    PID:3192
  - - C:\Windows\SysWOW64\cscript.exe
      cscript.exe //nologo m.vbs
      4⤵
      System Location Discovery: System Language Discovery
      PID:1628
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s F:\$RECYCLE
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3260
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected] co
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2880
  - - C:\Users\Admin\Downloads\TaskData\Tor\taskhsvc.exe
      TaskData\Tor\taskhsvc.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1572
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b @[email protected] vs
    3⤵
    PID:404
  - - C:\Users\Admin\Downloads\@[email protected]
      @[email protected] vs
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3316
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4868
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2172
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    PID:4660
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3112
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2064
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "aptiorhqd785" /t REG_SZ /d "\"C:\Users\Admin\Downloads\tasksche.exe\"" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5020
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "aptiorhqd785" /t REG_SZ /d "\"C:\Users\Admin\Downloads\tasksche.exe\"" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3424
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    PID:3264
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4892
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4176
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3736
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4996
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2436
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1160
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1928
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1500
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:484
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2564
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2196
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3592
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5044
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2784
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2328
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3336
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2416
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1500
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3080
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    PID:3820
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4660
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1332
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2176
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2556
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5116
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    PID:4640
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5100
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4064
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    PID:2984
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3736
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1940
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    PID:3364
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1812
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4812
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2700
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2780
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2928
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3400
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4880
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:920
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2508
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:880
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4952
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5076
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1616
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5048
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3048
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4840
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4256
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    PID:2424
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2700
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3360
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4068
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1416
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4376
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4560
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    PID:3116
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2988
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:740
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4356
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1008
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7424 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,14850065985967575623,9067601861579030394,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Users\Admin\Downloads\Notifications.host.process.exe
  "C:\Users\Admin\Downloads\Notifications.host.process.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2860

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:680

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\@[email protected]

Filesize
585B

MD5
1d029e21123c185829c73aaf361a728c

SHA1
9203de1c6d5e6145f0d075ba6ce21f3994343406

SHA256
2b09ef895985d0fc09cbccd1c262b0859e5fd3519ba169c3c66e4ad4c54848a2

SHA512
c4700581c83c8a6b9d22b07bbd281b441d931a4985413f133d6f6779267465338bdfd65aa5ffd3d82cbf57a6997b505fdeea509a14efbe9f77d14066e15b48f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1544690d41d950f9c1358068301cfb5

SHA1
ae3ff81363fcbe33c419e49cabef61fb6837bffa

SHA256
53d69c9cc3c8aaf2c8b58ea6a2aa47c49c9ec11167dd9414cd9f4192f9978724

SHA512
1e4f1fe2877f4f947d33490e65898752488e48de34d61e197e4448127d6b1926888de80b62349d5a88b96140eed0a5b952ef4dd7ca318689f76e12630c9029da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9314124f4f0ad9f845a0d7906fd8dfd8

SHA1
0d4f67fb1a11453551514f230941bdd7ef95693c

SHA256
cbd58fa358e4b1851c3da2d279023c29eba66fb4d438c6e87e7ce5169ffb910e

SHA512
87b9060ca4942974bd8f95b8998df7b2702a3f4aba88c53b2e3423a532a75407070368f813a5bbc0251864b4eae47e015274a839999514386d23c8a526d05d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
47KB

MD5
0d89f546ebdd5c3eaa275ff1f898174a

SHA1
339ab928a1a5699b3b0c74087baa3ea08ecd59f5

SHA256
939eb90252495d3af66d9ec34c799a5f1b0fc10422a150cf57fc0cd302865a3e

SHA512
26edc1659325b1c5cf6e3f3cd9a38cd696f67c4a7c2d91a5839e8dcbb64c4f8e9ce3222e0f69d860d088c4be01b69da676bdc4517de141f8b551774909c30690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
26KB

MD5
8ce06435dd74849daee31c8ab278ce07

SHA1
a8e754c3a39e0f1056044cbdb743a144bdf25564

SHA256
303074dab603456b6ed26e7e6e667d52c89ab16e6db5e6a9339205ce1f6c1709

SHA512
49e99bffcdf02cfe8cef0e8ef4b121c75d365ab0bbc67c3a3af4cf199cc46e27ab2a9fdf32590697b15b0a58ee2b7a433fe962455cf91f9a404e891e73a26f59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
20KB

MD5
0b17fd0bdcec9ca5b4ed99ccf5747f50

SHA1
003930a2232e9e12d2ca83e83570e0ffd3b7c94e

SHA256
c6e08c99de09f0e65e8dc2fae28b8a1709dd30276579e3bf39be70813f912f1d

SHA512
49c093af7533b8c64ad6a20f82b42ad373d0c788d55fa114a77cea92a80a4ce6f0efcad1b4bf66cb2631f1517de2920e94b8fc8cc5b30d45414d5286a1545c28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
38KB

MD5
adf2df4a8072227a229a3f8cf81dc9df

SHA1
48b588df27e0a83fa3c56d97d68700170a58bd36

SHA256
2fd56ac4d62fec83843c83054e5548834a19001c077cdb224901237f2e2c0e4c

SHA512
d18ffc9a41157ea96014a503640b3a2a3931f578293e88cc05aa61c8223221d948c05637875d8e3ee5847b6a99341ea22b6a1aee67c170e27bde5e154cf1b9ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
37KB

MD5
83285c0f09ac865af1341a877da170b7

SHA1
b4bb4604cafbfee4be8a3338a402f066e25eb785

SHA256
84fe2df4a392f96823bdd0bc333c72a774154fdab3ac7d1c5a55248685da80f2

SHA512
19198d23ad6e9120b5453e7e0b370ad7d049401d407ffb2325589ea733cffa0f2ecd62f06d6fb1decffa8b275aa13fec132c1be7498e3e2fabcd37c2fd03cd6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
20KB

MD5
7247e91eedf36d653790d6d0a1c8a4e7

SHA1
88281d63857f377a82426d9ab6963249c37443c7

SHA256
bd6e42e520f77a213daeee8749872b2ef6b220f7864e72c90f78fdb916861e5c

SHA512
7780717bfbb9661b6715f46c89b81e0241d2a7305893ffed317b0ad5ebf57548552b6ad11ce1518f6bf20aa5671bcacb77dbd86f9b484abe4b7dc2071c4c42a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
26KB

MD5
525579bebb76f28a5731e8606e80014c

SHA1
73b822370d96e8420a4cdeef1c40ed78a847d8b4

SHA256
f38998984e6b19271846322441f439e231836622e746a2f6577a8848e5eed503

SHA512
18219147fca7306220b6e8231ff85ebeb409c5cc512adff65c04437d0f99582751ccb24b531bbedf21f981c6955c044074a4405702c3a4fae3b9bf435018cc1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
18KB

MD5
8bd66dfc42a1353c5e996cd88dc1501f

SHA1
dc779a25ab37913f3198eb6f8c4d89e2a05635a6

SHA256
ef8772f5b2cf54057e1cfb7cb2e61f09cbd20db5ee307133caf517831a5df839

SHA512
203a46b2d09da788614b86480d81769011c7d42e833fa33a19e99c86a987a3bd8755b89906b9fd0497a80a5cf27f1c5e795a66fe3d1c4a921667ec745ccf22f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
18KB

MD5
f1dceb6be9699ca70cc78d9f43796141

SHA1
6b80d6b7d9b342d7921eae12478fc90a611b9372

SHA256
5898782f74bbdeaa5b06f660874870e1d4216bb98a7f6d9eddfbc4f7ae97d66f

SHA512
b02b9eba24a42caea7d408e6e4ae7ad35c2d7f163fd754b7507fc39bea5d5649e54d44b002075a6a32fca4395619286e9fb36b61736c535a91fe2d9be79048de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
58KB

MD5
df9f046f50e7936fee38774af18721cb

SHA1
9788f8e7d7d6de8e203849891c0b8dc1e6eecebf

SHA256
0d88aa7924fb18c6e96cc43900be8b61ff14d5561dd1f9934168fe85b38e8967

SHA512
96415f9f1e90e00e6a7a6a0cd06b38be9a3ec5c29ab3018e8b47301143cb83bdbe18f0976dc3766e6dadc7dce01128ccdf7039446ce5c5371a40bd5c61991d9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
53KB

MD5
2ee3f4b4a3c22470b572f727aa087b7e

SHA1
6fe80bf7c2178bd2d17154d9ae117a556956c170

SHA256
53d7e3962cad0b7f5575be02bd96bd27fcf7fb30ac5b4115bb950cf086f1a799

SHA512
b90ae8249108df7548b92af20fd93f926248b31aedf313ef802381df2587a6bba00025d6d99208ab228b8c0bb9b6559d8c5ec7fa37d19b7f47979f8eb4744146

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
107KB

MD5
5229229ea75490496d7f8a86d5c2860a

SHA1
f2deb6d9b43e811f486fac1fbee1d9517ce9b0dc

SHA256
487cfcbffcf804d2965bc4d45d846acd8724562714ceae80bfe1ca78534aea58

SHA512
9b42f14e130181117e2379ff23d6e08bfe739e27b0756785d6f20669139d870d4f73d03653d820f278a71f2371213a0104158d791ab867622014b1ab8d637520

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
40KB

MD5
01c37712c53beaec90552077a4235057

SHA1
0a1b1f47f36052ff504431b8cc75aab470ef2b70

SHA256
aa3bfd95713e4d5c76703b2ef5267b94dded413f000ba3a46ac391086831b38e

SHA512
be81978f7854a3100ec49d4c12a730af96df1e97e35fe182fddf8db6124c6780913a17210e4b268d261a9e107ed75811833d698e85d6ca325847a1ffad895b9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
18KB

MD5
3bdfb3c6756778ebe8831ecd1256ebef

SHA1
7d7bb7c73976f5d48432d92ac7c58143a94e686c

SHA256
5234f81b6e3656dbeac1b845c77aa32511d880af982ecdfad1dc3cce73f12b2c

SHA512
45046c4f0ca6c133be9d1181f03e5d41ff11914ed0663667a4556d700d392da4c261844b3d90bc979e6ee7e07cef3561b5d85c4f98544bbca853f77cc397fbfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
87KB

MD5
65b0f915e780d51aa0bca6313a034f32

SHA1
3dd3659cfd5d3fe3adc95e447a0d23c214a3f580

SHA256
27f0d8282b7347ae6cd6d5a980d70020b68cace0fbe53ad32048f314a86d4f16

SHA512
e5af841fd4266710d181a114a10585428c1572eb0cd4538be765f9f76019a1f3ea20e594a7ee384d219a30a1d958c482f5b1920551235941eec1bcacd01e4b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
18KB

MD5
19dd33cae92e87a940151c76fb5e08cb

SHA1
e1c9a78b75a9f8ec6fb186373b6d2c31bcbc1422

SHA256
0aedb31d5cbefa50961b46741db98438fdc12e9d0cae950c0220e74f82b88d15

SHA512
f0ec17c802274442054877d436a302086f8f08cfd47a1df61db7c8cfeca78a1d28e5f507843154b10e4cc8e0e20339322cf72c25e82103e65abc6f4d24f04744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
16KB

MD5
cd4e82b46e4da434142a43b103c70d82

SHA1
c90880a374cca87c8db41b629e803cba3412f14b

SHA256
7fac6df5eda28d747100a7de800f01581d46fc81adfb53e5f6597e81ced06613

SHA512
89d38702ed8b7eef95f287012b3de691cca0c191c673ecb7be8aff9481f38e6669ff9b3b422b4e92b1d4bebac4d4e67811cde421b422728930c75962f989a6ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0bbe00d9bf7b798e_0

Filesize
5KB

MD5
c56aae877b8295fce4ab27c27dc7506a

SHA1
f7780deba06f4fc382bd70319eb14c7851b6f5f4

SHA256
e235ddd9d8ae942beb614f140ecad0d2b3fa5ff97ca062c90bb7c96c5338c7ad

SHA512
1fc5b36df5cdddd5a6cf1202ece4acfe191d7a3cec24d036b95edb38f0a20c06c40bd0d72dfb892c86343797700de3fc68c462251dd91922de05e75411ba50e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1a914eb5fc51fb84_0

Filesize
9KB

MD5
6a2caf3f8eb4b20850a524e18adfd367

SHA1
1a78b827012e2b665fbefaac5405e4d7c667a165

SHA256
f87aaf57740059d9bf5bdcdd46a6d4eaa9e640e29323d44595b87cc392a353a1

SHA512
82f848539d67d93e8248472b541105233e9a638b91def6c3dd6061c1c23c9261612d87a4ec76ad0b3b9f1017be00f87e8e2328468541963a3bbe3dc3049e32ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0

Filesize
1KB

MD5
7e300b066ecf9b36ab4d6b9ddb53d36a

SHA1
46fb3d708ad32e9ec3178fa3e2442f18b271ddb9

SHA256
3bb22eafb92ccb8dd9052e3b3f08864e4e5c1515c8fddb23d5ae415944a18216

SHA512
1bf7c4cc01b65d0b3ed09baced45e0835c45bbf70e66b21c04f18d9a7dbc901aa3225ee1f42a48867d4b34133e8b35722d6304a158f56236974bf3ba2a40f3a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2692617678c042d9_0

Filesize
10KB

MD5
b9d7316fe07aa02198b7a855f14f1f58

SHA1
ab7ee9eb2058e230e2ee353ab828f48b6e2705f9

SHA256
28338418be7611e0036ccede253120e160451aa9be63914520e9903335ccd2a6

SHA512
5fd693d4f14f9e1a08bfa5fb37cbd02573c08444495075be0de156382af33375b308a5c8cc523bfaac10727a0d16dc5baf6294ac38e065f3d8551c2980e54d3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2706d8cdbf00fd1a_0

Filesize
262B

MD5
89573d635b8dfc54ed266127a07218db

SHA1
2f7790a0803f5ba839f105ea3c4d0f79d7ac1455

SHA256
c30700f5d9d2032160245118c703366016690077a4f666a274af19d8ebaa33e2

SHA512
318a051c14077cd35bd97aa76c121d4e108067c43915aec0cecc2f921a8f7058d517d21070c183a89ffd244b40b02b35288b67b8f03c26b7b8b79701d6a6fee6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\288cd79ce6414b4f_0

Filesize
294B

MD5
80f9170c377efd8bc51b4fe231a3d3d0

SHA1
ad605e3a17dcb59dd589a369978800fdcd1ec528

SHA256
06a80e137eb18dff0f5bca5ec7271add7e7ea2b2b0c44eeb3800f65ba58335e3

SHA512
546b804086a19f1612696650679d15905a1b335fd36a64f584943259402269409857495123ed825c3e3b6a9ac0f82ee35c3b4efbf272e129b4d704c4feeb106f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2f4680e8f8f8a14f_0

Filesize
13KB

MD5
dcd48eb38122f9756fbe2388120d8e7a

SHA1
af8e7211ad138048ec88d36c6900618f64271cf0

SHA256
51e856fa90a16a101f2bb0aed7e00034a0f61abadb14eb66b3611eb263cb9a93

SHA512
0f484fc223d49c6a0f69a8ef2036956e1135d2bb41cc3228fb44d7d541a47cf9c4f0ee3e762dc270502d5b7541e07ba9fb658eb9abe6726b77037720f16f17f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\37afe38eb817b647_0

Filesize
38KB

MD5
b85ad0573a3cea6802e3e3962a467fbc

SHA1
1b926e9766131a43d0c502ca2ab37b50faf55913

SHA256
2e54e7a6ceff1a19d6548a95b9b611aa56a01e089db70c4f3897503968a55de2

SHA512
72985eef20817e4664c517dbab3ebc4ae0505e73848acb349922c3ab8f58ec7303cb24ce132a71f3f2a115d94aa7fa5023ed6e02237849dceb177406be23f3b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3a4259a0181983ba_0

Filesize
21KB

MD5
45e2af12a75fa57317c93b58b7fe6db7

SHA1
1d734b8a39a88e26b2d00cd1b036c0605878dd77

SHA256
b3fcd7bf2f868a76662d09ee85e7d46945e66ca758ea7a5baf8c4517b7af4a07

SHA512
d0ea13b9acf9c5862f5c85e045910128790e232896d12b4150822664feaecfc0465d6f82d2879ef81ed45927ec050a31ffc1468d1edbe4ff18bfc13a3c878f42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

Filesize
1KB

MD5
6b30607d76396c9f64375828025fe77d

SHA1
772e70d29718d9cdd6343c188837a7716eb6ae3d

SHA256
9b5ca6a10e0ccaef9cc6d191e0d237fb6e7bfff83898fd8fb52b83890551c3b2

SHA512
771efc9a2820beedc91fbc3f4a678699d90f04c931214bcfccf41f44d1239228e00acce92e8d22f0d49185e691f76da59f0f8746a6bc57ad34ebe0a90f28edb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4e9b18b0f66a7183_0

Filesize
1KB

MD5
cc6b0e23eba0740532aafb6f76e6261f

SHA1
2ed257cd16240b92f65709b9351c83f42eb5e932

SHA256
3d354fe248b4f7e90589b9478086b647cf6894cb12edb95e4dbf5a7ccb1dea23

SHA512
d1e0289e1ec74f2094115a60e35b2b6c65d8087e2d27240361497df968786cdbc48b44b63c6fbe214c7dde6b387a0e3d824212b7a01fd0ae951c8095b465f719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4ff4b179c1c05fed_0

Filesize
3KB

MD5
0fe73bfa8d69a41c9275f700f0a2d1ec

SHA1
8fe21be6d6a734a81ba0da1688943edce188926c

SHA256
65c8b4567a3f9c038e3ecc863980491c2749ad9a177370220c3d54f44466b9b4

SHA512
d220cea6c68e5545fc3b9ff4e3c171ba8d300f6ea5a429fee0229ce339134dfa80ef2739dc83da71896e164090c3bff4504f6ba22d9b9430413f9a0895dd8386

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ac5abc87e80789_0

Filesize
3KB

MD5
4f9889108cd8f2c7cefd7f0d93ed20cf

SHA1
2bd54e504e2dbab7898410de27af1a8cc66a718c

SHA256
5a36f04fdd24ddc3cc68183542c6f52bad031c0685d1149e36c1ada28848acf5

SHA512
55de43a02943614329140fdcee8c667f58997baf2afd6472020c7d18044cda4a86d2cf2790b030638f6078f73fbcc63dca9b66579c31ed97bf1a32ee9def4f29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5dd1e579c9681f95_0

Filesize
2KB

MD5
b63782fd7c1e4203110e26e2ae502899

SHA1
903331c0a40a78ced43c0745fa6eab3db5a50a9b

SHA256
60bf63a192d37c46dd0514f48925f988cbec9d2d08d3a21845b7376fdde19ea4

SHA512
2e44bd3a5d0e66f8b8ab96e1084fbc91216ac427b8a1c7fb398c2ba3aaf96fbeb425d758fce0493f2a9a84f9a79619c7c4498464cce7b8f4811d5012cdcc7411

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\61a0b4d20ae0e222_0

Filesize
15KB

MD5
e6facaeca5dbb699a89e50d9f458b241

SHA1
53e680e3d90639017fb86158b016ec3103fedf69

SHA256
f47853b7ae981ed9d37b033ac54fedea5978ba719045f8f1c3496482918d22b6

SHA512
83adcbb4fae3756f17b13df79c15f60c103d0a2ac9cff2b49f6ca8df7dff7416a477e914801d8914a10416804b6e78960b182a43dfe5272d118d0bf2cd8ae0d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6d98892e53aef8c3_0

Filesize
208KB

MD5
2462f8a75d6c66563b4b520055070659

SHA1
43a1e5611f56527ede2414ecbe85ca271c1ec644

SHA256
f70e5d661e607e596b1c52d5f7e8e1972e5bf9a336fac6b4450961c3cce1f137

SHA512
1668b5efff7ec65c749d36da712e6b3a1bf85faecfb8f6dad6cd11184415505aae007c5cacae0eee5a92572b71be3418c29d093615bbb847241a0419fa9dbb13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\71d68e68ea4089fe_0

Filesize
6KB

MD5
d2ca26e961c5911774bfb5971673413a

SHA1
1fa19f208ebcc640f3d46ae66111ebc7f7a9c63a

SHA256
6fb0e1e0119a8475d4416c421615ec3e0beeb070eb434e2405d435c8b550ca2a

SHA512
9579c566d7ee16c76b714c456e083ef855f8ddcd92de8f5e66de7c5b7c245cb50a6bf7525f8f4c68cbf3cd2ae8bca9bc5e53cfc6c54045056704b213c1698492

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\766094f4b47e839c_0

Filesize
12KB

MD5
f236f27969017a84993b85b5514ee1fc

SHA1
4f26d12769828379d0d9f388bc0de1caf6d34b79

SHA256
b3346bcb4fad2ee40809f82f551e20199fb908a99da8fa40a029214bd1d4c696

SHA512
37e5e28680e340424edc1fe169ce5721cf1f02462e8ca28ff1413a617bd0fc7204e2ac6bd96ac76b0c11fa90101573de09c4eb79d6a5100a241b7ca03854981c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\86b9cbd77d05d034_0

Filesize
9KB

MD5
5d1e2fdcb9ed1f119ad1b7eb9ddf4938

SHA1
54699f8e14c454b40e44bc2ff010569b49e611ca

SHA256
8f58028cf1f4415fbe5ccefc011e1664f18d6860e45e0a4d69ad7564504db8e3

SHA512
ae4ae894dc19f8549af39e08f77d1505abbdeb571cec0bc5163c908eab59ecbd2cce5a4ed9c134a5f6f5a78f5577b0b811786d0c2e36285aaf99de1505dc8f7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8ccb290f0806e930_0

Filesize
291KB

MD5
c34df24b9670c9ce50410a3277227310

SHA1
7c9d9502c6d85c8c6f73fb2ce203c321e2f476a2

SHA256
62ff3d49efaae2e9c069d556916b927db805f89e4a1554aef49670c5566775b4

SHA512
57f45dfe1b0af3ff7a0e341dfc791a7942f27f53bc85aa63ef9e0473f4196db7eec4ef0f51d8762ea3d7b55190d528f1626f3523f8349f65c40331a90daeba13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8e5987d08f7b6e11_0

Filesize
1KB

MD5
f8a51ea7ba039c543c5fd1f804d0f178

SHA1
c6a8e493cd1ada5ca0087d9f79fb3dd7f0633abc

SHA256
cedaf04caa5abe9b05b6d398f85d17d2d8b14a8d4e1f41fb704d40f2364872ac

SHA512
b61c4c7749ea10092023d240338e9765444ea2945a96f2a56dd8bdcba1d4378bd5507d90ed9aba5cfbe2488aaa07bc65046aec010699ed6ee394f431a44d8eba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\90d7d7591a1b39bb_0

Filesize
262B

MD5
66e896b68a15ebb226206c65a3f85cec

SHA1
8124aeb4961f985e110fe738bc50bc306eb469bb

SHA256
e4b6997b2a63b5815ccd559f687ff8d237f5394300008e4e515934843cf7c1e8

SHA512
9153c7ee3814ad7b65857e228b285c787b5a116ceac3ef88a0ef799a753ee3562b07a341880bbc5d88ce9ef29a94bf9f908c28cbcaae343cc074fcd2f1753555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\96bc766215a93e35_0

Filesize
3KB

MD5
9ba7121eaafef1fd7b329e84af6773e0

SHA1
951068605d6b90d24100e0fad8a58bfaabe358f0

SHA256
c7c0af28d45c86f5728597996ddeaf9827317a2d359dec28665dfddd7bd5c6b9

SHA512
bff45eee41a193fcc4309fb12edb3bccb25633f2fd70b92f9d14f1dfec56bf227b2cca0470a1bd1c0476ba83aaffb1058b2da07bf8af761878e3b49b9b406353

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9dbb949d27873cbc_0

Filesize
3KB

MD5
29a5694df9a349715e96e8494df804bb

SHA1
30ba541c4ab2cd3fcfddc0ee4dc9f18ca74affc9

SHA256
fedbe436d5672b61220da034d73a9eaa22415062bee88fc79fb96a72202feb61

SHA512
e5defedbac8837705d307abe88d297b88c647391e5f183c685b1dc2f7fec109c4d924b7ee3e05173212355fd48fc827f25300cb152e394c5ca5b61c210e51f53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be6d12311ce2b399_0

Filesize
2KB

MD5
d5d0c61b897585019a65e72a35658781

SHA1
76d8f89146b3568380a6aa7f814d99eaaa6d2e6f

SHA256
d4e8784c6898d723170aba0ba0309a8cf4c4ec882ed835bba04a66080568e2b4

SHA512
78383b81f8b91c306b91741bc10c00627623a40cb8b147bf5961916a83c741e21def43f335553933a9adbaf71724706a3fd2e0967bd2063307c734b20ef90bc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d79e0a2891fc014a_0

Filesize
262B

MD5
9c9eef34d8fb71e5043a55b973697b0d

SHA1
40ddb9aeade139d59566b14c3161c65792a1fec4

SHA256
01a0dc5ecb98efe6f36598c68754c2ba93767ac8ba7cf1346662dd209c98e4a3

SHA512
b850b95bd1b5b547d637a41d43bd6f640a4a4cf3a345c305dabdf26f1ae78b43d03b559fb2ce36ef3ddb68516eebc529334b429d6f6e45c3cf59d23734b38969

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e146fd968644d345_0

Filesize
8KB

MD5
8f8c198f28ebcc1968cf8c1ae57ad000

SHA1
2cf89a66a59414b6462eef3697fe5f3b1d193b98

SHA256
cfc180fe2a31f4ef5d12e76cf5effcd7b12bfd48272599bb2fc2aee60b4364ae

SHA512
fc961a54f7cec43fa8e1c2c0c646975cfed8952f5ace8316044a1b4f0ff39c528fc1e56d7d4beb61c58003e7f62d4cb621b63cc5c4c8884189aac4cad07c7666

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e1d30c94915f0cd0_0

Filesize
22KB

MD5
705600c2a42240bb6e3234bc3c42cfe8

SHA1
a9c2ca41e3fd2303c6e15da2beece82dd6f262a7

SHA256
f76a841c78bb9311c275613fe36430d1474434e5a79fc259e83276803f88e4c2

SHA512
975410061f04122eb586f43b8a6736b856c520fa2a6a5f2129bb15114879771371452cde89255a728a4d8f056ce45ee9870ef388f5ca613d56b491c0d025547a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e1e96147843f490d_0

Filesize
175KB

MD5
20bed0991046b90fa29df3fd23a08d36

SHA1
fb1adaa1001a056ff22f8ff02934b5593370c9bf

SHA256
e738f30727e2f7a060efa923d5ad0a93760ad59268d2b0de964f754e743eb6a9

SHA512
6748df4251dfa3ba95ccc7b06e3a1e86c05a3c68388ba907df161854ceec9f256aae7a2eab0034b4fce6a85ddc62863df715b4b81c8d6397207ce9b4048d7a9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9c7e700cc3e33cf_0

Filesize
48KB

MD5
4c06e5a441d55093db8c0f52583c0f8b

SHA1
6b283ada35ba89f267010811c8c19d99e5d83b94

SHA256
fd1204f474cc1bd96f0f4b8d7ecf3e12bca5922324922b99b57b9975b50a7acf

SHA512
2f3f6b0728199063432568e9d596e9056962a0ee57c9e556670260f522f15d1d32a19ee984f227bedac77df7f93421a1f64bdcbe1b103a5f8501bcc0efe3171f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ec8d777e9c30db47_0

Filesize
77KB

MD5
d1f4fea3a1ed1f8262283ab40b233a30

SHA1
34ec93c088d91d7dc22541a6a3eacb520960165b

SHA256
2612f6e3fc24ab78479e079705f90b768a1e37df4338feaffe90433ff509e5e5

SHA512
f9836da802d2d01076b694e5d87371124f750e4232f0bb3807f3109532cb0b7845252bea87ed63649b48824be31cbb31b98e398a528f53a308c5a4860105599a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2076e2a98754e97_0

Filesize
2KB

MD5
66d4acbf8427c0d6b4575fb53cce0f59

SHA1
7cbb1f4f5167726178f03a00c06238ec70ef3f71

SHA256
e42bb508773a1e237e237663ca0a76d32d751d40c97d80272cbb4ca7360c72a2

SHA512
a31fbc8346d530a01fc02278fce056894ba34b902da450ae6d2e004ed3ab411f28b718c024296f4165d8c8cc4d54ce3fe51f797e951ed5b7337127d9502c590f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2e4bbad99a372cc_0

Filesize
2KB

MD5
db8dc57dc4ceb41a5e28f0dda67b5640

SHA1
2fb7a69a3070c1b2fbedf9d8736bf36ef6da2c32

SHA256
df8509d40f070eab27645bde3eb1bfd4f6bc4548f0bf85cdb2ed20b575897a05

SHA512
082768a486e2bf580b6ca4189a766541ec99745dd96810a427ba85e1906e8018e2b8170d85cb378d033ded5861cc99c76ce198ec5d8c56f0f2a058ab6f0ded24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fbd11ea5cda006cc_0

Filesize
26KB

MD5
3c88ca1d55b0aa4868409cba59a25d5b

SHA1
69287a6dc27996b78b7cdf8211ef4122723125ed

SHA256
343855b0a5e8e0bc8db52f969851b27e104a6ea227269e947009ab6f66a59424

SHA512
194ae77fe13893b48f1cab167e5eb1a1d451b4d7b913f687d0ab5eac703f2516e2d5f0cc002c43a55a161bd05871df9a7e6735c1068892fd6556fade37b202c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
30e6acd9cd63d250cfefe6fa0df766e2

SHA1
56188148f681c678a85e430654f98bb108365899

SHA256
c4465f12209547d83b6d5dded808f9ad89763546416d6f87603be435b60b29f0

SHA512
4d3c230cf4f63a76708cdc22761f47f18bfd0408fdf25f0fc13a2e646227f801fb7ee9fccaf59efdb8bf9aa692e1f9e635bd2a82fb3d7f2abffce26aadb2fd88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
0eff5bca5efa51325d67e6ddd0a5e106

SHA1
096496027dc357109caaf82d085fe7607c388c96

SHA256
2f09865e99ba2d82afabc289c034d53f10a4d37777e178ff9057c6442e15417e

SHA512
762604834e89cd9cfc57e1b31b69c36b60bb4013f1f4b92f67780f933eb0492afda8f1e33fd20749a6bdb3c59672eeee4fa6885eae99b446a6ffe719f7775ed6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
19ffba19ab94cd71a853f8a608b9595e

SHA1
2180316bb153741aac37aa166a4ef0df553c85d3

SHA256
17709e91e6b0aa107db43fd62bb35d3e32b28fde285c3ca4fde64eaf91cba24f

SHA512
e9ec2339264c63259ebed27c4662da529c5091b3aae2738e0d6110cb760cb5faf680224196afa471a32bd18eab703e128347797446baa7ea683422d9f81a28b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
0547b4ace5c0a44936b3d3e971be5861

SHA1
d79e628c156a8dd85fb065b5c41d51985700e723

SHA256
89a6cfc1a5e60fcb9e2b8fb7919d4a070e96d92db685f41d0708e1e2333255a8

SHA512
622a12ec7277dac02cf07a646976f76c64a8e2642cabd2b69fe49eb1f9bcde6a0902c1e9e63d737508262d58b8da1ecd100050aed663c9b70dfe0b1e3f9aec4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3c76a36b93ad2348fbc69543a9b03eb6

SHA1
f148cdbe9cda76a012a58f4597d582e3c970cf73

SHA256
72e533dda6f91c831df4bcaa1ef4fb14a5ed0da03d1a2bc2b319f7c21bada52d

SHA512
d11be0e365d97c807cc53ac061a1666aa9d095fa3f70d0a1d3cd7836840a4de7114299b1e5ee95e49b62c221e8b193a11bf93ac56558e1638450cd75661dd2dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
96B

MD5
20c76fc7b81cd47c29f2b79e8dfe89a1

SHA1
ff3f51c129a8da02921453d073eefc61b8ffc2fe

SHA256
48a63c865aaeaee7aa4d7e5741d8a19bd7aac94667977564db086caa3dcf5420

SHA512
1e5d460510f98170034178d9f6f5312c5a083f562c287b9eea69316969c0c016c578905165bad20dc02d983599782d175fddfb951dc7935e7b16bb0279742c56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
01ee343844cf80e7a3292ca6f70c25a3

SHA1
b5312734a25200d8bc47c319e35af061a79fce9e

SHA256
b09fe708e08ebd457015f53bb8985b8c7ffb7fba168b50b2dd917fffe53bd25d

SHA512
b38d2872c43756607b2ca2f9ca157e31ba8217d815f5cfdbd9c17bc48162917d5a19e272792e6a5912b3e13118a827becd54953c1df8cce453965c50e2ae64a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b91a6aee78d64e7da2629d93218c9cff

SHA1
8cbecedf0ec1688b88892904edec56d1835a03d6

SHA256
28446d655d5af4ecb1daef3fe455e89af9ee1c69296ee040b56be86e2f97b65c

SHA512
eeee426667ac91aecf0740e1efcccdd1cd1e61effe2f967829b33f469fc1669cfe5cbad7faa11f053815fa078d31183d3fefb42d70df2217b0f51ccf151820d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5480757e68d0aaaef689f2e7e8b54f5b

SHA1
71f0857c958918eeb5386c09a1359b3938eb0b44

SHA256
fc2857ea6f8d50bcab9b9bddfdc4dfa03aa1957f4a10065cb1ad7d7c87de377b

SHA512
38365af9985ea240cdf83c46303dec0d9cd170a6079c78f75d49b7b729354d1137e627fae99f6061569a9b43dfa99c5b0b0f4e8102936cf76de60f4b0a7fb113

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3f4b12da75c0347ca7d47ac06af38afe

SHA1
73d9b91908965bdb8c6a92b37708b97e534592a1

SHA256
d05d1b7055f6045c36f1339fcc2f80b84d2279a29f4c373508b84b224a9b229b

SHA512
ca37e2253ed1fbd526031aaca9694d8fc37832896cf50847defe6e3e7164a99c9774034355233cc07bb6b2e03cd7c4099beb9215f8b4dc7da7457cfe78569f23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7fc3f8a9007f902e3076135ab9f4079f

SHA1
a7fec800958a8b72b35b1359ee9449acf28a3f6c

SHA256
adaf101b894cd5716edeb81558b52ab6eb061ef14d4e844d92822aa2e4b85831

SHA512
37f4f03046587aed16c402336446cda01129852295ebe81d11424d23270bb166c1acfc782f2b978f3bbb36334fe157d5ed9c91fae7dea4ba8c227886119a7012

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f98dcf472cbd54a218bc0d8d210f3a8a

SHA1
bd186861ff3f38f5c5ca290f4fd4a8f7664388e4

SHA256
b37ea60aafcfe8a5e963ce1ff1d493a463430ffe798e6ed3feda4068ee50a04e

SHA512
72297969b9edcce860301c7d81ada93e28d5156b8ed166b1f4edac15e6822394a3ef1dcd27c0cc7d77c337cf4f268c1dd748724e39c9f3c5259bd556a0df4cfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0574948314d2abc7c8dbf5920be2f026

SHA1
1de888dc2416665df340fac850b5b35fc5f08713

SHA256
7bfafc7e2ae7406db7361ea0aa2d0ddf436ac685a0bad5e8eaf8096d7480e812

SHA512
5befb24ee51913fcf06f8c235bf99f3d9e117ca66fd8f26bfd4ec8064264e44ae39680075df6310186294738cd461fa777c31967485d257fd80bcc80c5cbf369

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e7e9dd6e8de14eb7a73f7589601d19ca

SHA1
925fb6d95cc592953122fcb64c935b4f88cea8e4

SHA256
28ccf9cd5da24a31349c815f26fc3bbbb2f40ddbd4a35fe7b63eb0118f6be2d5

SHA512
2368f208515870ae4688f5e416c661947fd3c9143cf4a5d28564c386c22723a5f271a3a3e89d23113c405fb69b2cbc67fb1cd5a064f44484381f45700a3c5f18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6ce899d27dc857cc010f089e129a4292

SHA1
7ddf4d14236151b71d6f36966e7712b422c48474

SHA256
4e8418f8296927b0b4db0043f97cdcc35d6adb5243fe3ac31fd23d4cfce1495c

SHA512
483a825fc5f52433751cace3b9e983620dcf47deaac315c5e90a18dbe57908844b790b083a0ccca21529854d41b8711c1aaf8d430e3aff73810449ef51d5c217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b7ed9e1318ff2c18b4e7a32a6d1ae38f

SHA1
a5e4b7373a17e9a024f73fe0448679642eca2d4a

SHA256
733312ad3eefec73c694e4592a6fc6b9071b3e97f16adce02a5da896a0a01be9

SHA512
fcbd8fe715c97965ce3844ccb606d8ef04988bf7859d0489c1e6607e4c7444ece995996744bad6bbc23abe5d666cddbcc52853c5458833cdc2d5e914e7de0812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2e3357b833f74505e21595ea12ac5bec

SHA1
dd76957177f66c981fce8bf2b6ec7c33e09bcce0

SHA256
9b4bb98e64527a98ebd3336a7c236d7aa81a4b76e48ca0ae3d27076909d1bbfe

SHA512
1e341a904ea8985235448933cfac19d5492b7c67d2d49ad4aaa33699c74073501ea1a0a2b5c8ef5ef378e6bac29638881115b49064f823f7dabdd60901b6587b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9e6f59ead11793745503c39d53e8b91b

SHA1
b38a5bfddbe67a0535da68359ecb5bbae246337b

SHA256
18fd6e515830cb83b8ca42be116c064faf6791e445beb3fca532b73ee2360921

SHA512
b3bc622988d4882ca068fae9e79661c0fd50ae25d7a4efc830901b035f05e9d5cb2653d5a6f996bda2cd0add425a35b450ca6c0cc57056841d7eaea5a4ad3850

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d81b6e949dac5c8b5615fe02bf82a47d

SHA1
cd22d495f6453766c176fab66014545349cb7f18

SHA256
0d821217ec8b506cc6d9eedaf9bd45dd2112f43cea1ef884e592c0153794ca75

SHA512
1100b894a61953e3314611c46e780135e0e79923e5662ef1a5b4338e0fafac58879bfd29565b3599440474a0f09013dd42bbb7c7160f147709eec7a604d4df70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0238d283ecc14c2f54fafc00cd2634ad

SHA1
c4d43f3a8d920489dc053c9cf4be9cddcc201854

SHA256
8cccee6ebb69f5bb5f9f6724cef9b2f3d146b471db1dfd15a247ecbadda6f496

SHA512
9f01095c7eb0b728e4f2d9c3c7098f7fb7236cecfec3bd41b36d0f8d3cdcbcbe4826b0607ae6950ffaf12ee72e3c26ef45d3504559a9a1bcda20138b8703b273

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
825671f31f551bfcbb6856a1d91f96c2

SHA1
8558c213a89b76103cfa144abebd4b30dfd8f518

SHA256
73867209caf9c70d9ea2aab9caffa846d2ecfe1f0be51b8485576685d0c727ae

SHA512
0ba3dbf41a089fea4b474c10d15ae7b16b67e88c9add6b321c355461a2a423e9668ffda64a1234f41280711772d350bf00ecbdf5ad41e099fee166661e0164a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c797d69175136f529afdeda500da533f

SHA1
3a18675f73636269a6881488a1189e45836c01f9

SHA256
bdf485b7a873b28f98c88b0f7e176b7fbfbaaeb0f3db4e7171d24cb2a5e1770d

SHA512
16fcc934f16276f004e5f2c3f9fb5b6de8a8d4b94d798ff8ebdc71eb663e0751d7120e8313c4d5ffe7fe750843745e8f8ebea729b63a7298793625c82422ba37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a3f27c3aaa8d5c4052f0667041437d69

SHA1
3141f4bccbf76f8a19768bb19f031ddd86433c80

SHA256
834726dbd50de3b3ed3d0a7c124822ee9e4da8024d7694422d5d4b47a1efa8c5

SHA512
03acd900cfa30975e316f2b204a4c74a373cf4f05c49ca0a09aaebd45b2b4134519dd1ff20f5fb5537ce2e46761e71d1afe763c70e8402026fb6592f8eb614b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e2fb384bec447caa9fc7ce4933864540

SHA1
d6515754d914d2f5e064eefc34a816bfc15b01c5

SHA256
67a870ad78c887d616ff5cfb4caf39be47ffaee766dd239bf5d39a8e09d8388a

SHA512
5c9a1000ec469d3753b0a9fea18a3c74c5ea87b3a893df052c6be3b5ad90365a5e33becfefb6da8b336b4027984b5f7a9217a9ca7b4d27289ed607a4dda6244c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bd880d3b1e7161421ecdcf4f4c8e011a

SHA1
dcda6314fd7577a1673033e2c2dd4dee4b41b01c

SHA256
541e894450ca92dde548253d632758b00fe6f3a9a89f466660c4eb2250170b62

SHA512
0e1ee7d72a17b4c055036b51bbfd8ca8061803cd02b1cf369b4aca7853d0caee266ed40f126e1c8d479791716d5436b9de98a1ae766157922e0b00a949a2357d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
27064594eaccd3327b70a10dc5d77dac

SHA1
3aba6aa717b07ebbc1acbc6c52da51930989afcf

SHA256
34afc3e53e9595ffb229f8b99dd80c51b88fa3d53deeff58fdef715c5c504f88

SHA512
649eb27845b2eb75558144d21cea110433ed3e4524a5532dfb64c0809e1e74a6aa386690c6327f9a9cdd56d7b796b8aabac81e7cd1810a99c1e014b899f6160f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
579d6bc8499903353e86f1e7441eb5fe

SHA1
360af823cd9f6a21e567ab96f3c66a504f6bb083

SHA256
bd0262fa7b75c154af9027005427a3e9e67208f053fdbbfafab5e949a8a414f8

SHA512
e398faea1b12ece665079dc3e73c124bdc09724f9236e9df48070d46ce41808898e66d4515479ca77dc83bf42d3506512ec0c1910884c5c25b26a79e637a73d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
53c99aba8f9de153cbce22cf3251e73b

SHA1
a33d1ff6e1cb57c1639dd3eb1b17a259338cdf14

SHA256
b5949f8933fa1f79b122c2b6feabfe4385e19fdfbbbefb87e5136db405578ad0

SHA512
f8fa89361268314474e4e3898b242b87aacd3ec99c5bf1fa04e362f2e87cb609c9305175669db52ca911390ffa18a74e54bf60533d9d615315d4b4027d602f15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a0645cf67191424335f2fdd38f9e6dd1

SHA1
87ba3c4a5c7ee64895bf9151862b05abd36946c5

SHA256
19168f7262a438c3c19d58ce42e30580e8871c007d62d2e02be992a756f34203

SHA512
3dd2554c9a02591e9f92f6974113c8bbb41d73ac989cbe1be707c67453afbde961b14f41ce9ecdc791eacb4c34628b6913dab0757cac536aabecb6774c792d81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9c67badf0e5c66530156ae23ba8edafa

SHA1
1e27a0d23f37129bde370264b0c2f16b8dff0b81

SHA256
b6332517cce62a49465eebfade661d76f3e404301ef73c7bcd98ab9fc2aecc34

SHA512
3ce23c01fa1db128cb59fdd4872432a5f49acf4bd9467e3d5ffbcf4e85fe9daef9a498bda8ee071e13768e8b9c68b348e8957e9c3c58094144a5bcce03259640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4e98287b98ac2bc31d323aff3ea725d4

SHA1
3ba176cb9903667dc9d52551a1f1c44c8ae1012e

SHA256
36c9458717c94c4dc8e5f80115f093d46b4fde1f54c61d019e0978bd01391b0b

SHA512
e610f02eea61f4cd55abc8f35a3c31552e65c11a2f52761eddeda542f1364a24366b6b2d0edd53785f2251951673acd90bea91467beaa2ef96fdcb78804aefbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
49108ab8b0e0e21de6bfd545dcd6ee53

SHA1
06129d853101bcc071b57c3eb19a9ce6bf9fbf32

SHA256
eab618cd1fd9b31f442e3fed37b2c34f9705de79a3792cd563fa05f93c3973cd

SHA512
68944c94022f3faf102192b678ae609271ca92613610f2ceffc1c1f53622c6ef72ca2661dbd24774fd2f7f064244133c816d0a7dd542afd401c0a9755a5afea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9522ed3642bc8353340005bf625e4641

SHA1
6809aa233f7c3dc764cabac4e80443dc6c687c17

SHA256
ec9a66aaef023f19dd0a2a56ab89f2f023fc7d90221a7d66b5dfe11f01419ef2

SHA512
db08e550a8ee36f3ce444a6605bdfb15e1bb7ffe3ce0da8c652a5da1bdd56ab4c13b09dca1fbeae57a5cf480459073bfad3f96a5a8d06f343d803b33a2299671

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
3402356afb3c2509624655a8a5f1721c

SHA1
e23bf3e85abbdb44ed7baeeacac5a51b39d05af1

SHA256
6c196cdd71d6b9c8374efd9ed9cb0a83ef2866b5fe661f3dcba7b4b027315881

SHA512
35df6959c30536e08852e989c877aa4d66ebf4fba437e5d0478266a325e7b682ffbf633cfc5b158a88d3fd1e346ca9993b8adc61f7eaf5c2f0302eb303a387e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8d05f905b936c586adc02cbb414b2522

SHA1
44e856cb109a561b29d91dfd2ff9a2832007eaae

SHA256
a62ac39b7eb19c3f0c9bf42c197e1011b38d9a90c37ce8d26a534dc1c39192bc

SHA512
e785b5da477b7095945cf0de09f9303e6404259336e1594bd8b00f5601385046f27256a98ceb7e53f43b9528bf3df0841f57db289008286999c28f754f90a33e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e332ef49685932f51f11ace75e74f3d4

SHA1
ce93bdfa3c5b4bbb8277b7bb557a3f7b220bd089

SHA256
d5be3784cdd56dc1cd293cbb540f4baed9816efdcd3c23773042fcf688f522f4

SHA512
a1c28a7a8266a9dd1d07dba21c0461aeb5f9ccf9c449c3343aea5dad850c4d3bec43523dca592e943aa82b421be968e76eebf52b975174096bec415376d43c67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f23c3c16e20be08bb6c3a6c202d02bf0

SHA1
c566d7e3014c54888ab3cd31e4bf42a0448f963d

SHA256
8adaaa19501ef218c66c07ab1ec898d87851d6598aaccb2a9a346fcd98a295f7

SHA512
2831374043e713b7022b76306372af0ee380aeca2e960d40e41d4919bd66c4efd3d6adc7d3b179f522d3605932bf42d2683384ee2b52ebf088b6e1003a8b7e1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5822f4.TMP

Filesize
538B

MD5
f2d43ae2a4dbea7b212f9bcb8c67f04a

SHA1
4ac40844f18a6c3189e44ab46bd5e0f0a57fa332

SHA256
fa14f5266e3ffe5d4d3e108b7b2780782c162a808de3e609a31b0a8e09c8e22d

SHA512
eea3b4acbb6d969232697bc430445fd689cbbc9223302cd36dfe99dd2a165d2d2660d2cb9ddae03a1143de2bef1fe5fdc1d79fe1fe3a58d7e6ebe0da984ec289

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
87404b2b68963fac1ac75ecdfdf9ee80

SHA1
3968ef6e2954ff0b20b8544520180e1fe10fce0d

SHA256
4a510fef0dc442533d1ef8caeedd5f7f367268b5c389d6c3ed37577ee8cc0f1a

SHA512
b8739a70b6bd168d3c549cd2a44387f8ea6dbcfd3a9ef49dbfbe025e204edfb3f77e9a05a699da586aced6c253aee0b79306f4349296c8c93d380dffc04284be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cf6ad0c542522fd9db5ef89b1570552b

SHA1
8f4945c992f1bdb395a0c93439ba094313269c28

SHA256
92b24c6d941ce62900428863b902dee80dad81f6148746339ea0fb81cbc78fbe

SHA512
5d585ac7a02e58978cc0f5fc70d7ce1caaad37b044182725fa8ad97974ec3da9ba2fca1f25600acaea02c0370dffcce925178d5e02e088e1adb2322fb222678c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5873bc59218000adede359b9a78d8921

SHA1
627b26b31deff12075c5f15ee7609b689634b4ac

SHA256
9d87338b84e5172e414115ca928f8c63906fa7b043afa04704bc31e8e2a213c6

SHA512
845476cf3a5daa8c73dc4efaa4d7ad09761274caac64cdc3c3f58c3b7f881671f4e5c5274aa75b1cfae651769dfd81a2a5daf79b4c1d5582d26a765f63002325

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
59bd2e13f5cae3dd572bab188e8562f3

SHA1
d9370e56e866ac8d91d2b7d41ca1706bf4a25415

SHA256
949ce8f3586c068e834e24f474a7f0110794f1faf5ff6887c10e3bd2b3006b0a

SHA512
6e0245f363f0b6c3cca5e292b7fb1f9ccc079c5c8d2a191f0d6a6a2813e07026447c5c4e2618851ae705e94985765b1d53445402f83f480d8416571e120943a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7320261e91904afcaa238134b8cdf7c7

SHA1
f1bb2308e6450a902451f003f81242a623a93a4f

SHA256
12dbecae1c454f1e60a10ce62e4fc909ae9ff0250ce17a599833a78f3c749938

SHA512
37daa6ed3e7dde760a91dd078e47d5161af5a6a86edae2db8b3fb4beacc602cefb06e4fc41b4c3a28e972186706195ee41c01c978aef80c2a21d44ff42bb000c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
64KB

MD5
bc1f6be3a8618717daf4ac98c485d55d

SHA1
1a7abc80d9b72f3f5af21082ebfdac989f71c029

SHA256
05f7eeedc319c0014a7f2da67900469fdad03e7e0f650039791b624f062d68d8

SHA512
5eee3c6f5cf1f325ea3dd99febe74b2bef6ae2b061273e54626811b9dd45f74c90c19226d868e34289d3620760fe4df92a5cc2f0968cbe6d5c7b81295c639670

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\king.wav

Filesize
3.5MB

MD5
377eeb8a80733bda6ae558a44b63d83d

SHA1
1588d521eac314fecbd95d4b76f06516aa2bd41b

SHA256
af9220c3d067ce69cfe82c7c4dd716325828066ac0612e422a52c4091a3c7b34

SHA512
a9b5eaaa6a386420e01af7c63ee60654b0feabea5698cfc94b157597bc2005705a2a0700160c33d1b61ed19b9365d0b3384433b7aad367e292a4b341b3cbe798

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

Filesize
8.6MB

MD5
779a7558f3f6c0db0d8c1663eb8af514

SHA1
5a7fd191229b10992e2a6a4ca2cebe6c4a5d8c5b

SHA256
f4e358ff1d3321f7892623a3d5c9455677f3dcdc7360ed45e65d61405d51db85

SHA512
1bf9aee19449613220d0422edcb82a9cf64a75a8ad6b17f28554de453b548cdd697112ca99cb9e0efb41bcabfaf38c696100cdd9ab6e3db2bb724db920c4bf94

Download Submit
C:\Users\Admin\Downloads\@[email protected]

Filesize
933B

MD5
7a2726bb6e6a79fb1d092b7f2b688af0

SHA1
b3effadce8b76aee8cd6ce2eccbb8701797468a2

SHA256
840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5

SHA512
4e107f661e6be183659fdd265e131a64cce2112d842226305f6b111d00109a970fda0b5abfb1daa9f64428e445e3b472332392435707c9aebbfe94c480c72e54

Download Submit
C:\Users\Admin\Downloads\@[email protected]

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\Downloads\TaskData\Tor\tor.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 192307.crdownload

Filesize
32KB

MD5
eb9324121994e5e41f1738b5af8944b1

SHA1
aa63c521b64602fa9c3a73dadd412fdaf181b690

SHA256
2f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a

SHA512
7f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 785196.crdownload

Filesize
18.1MB

MD5
b7d826d82d1a6b46e71a6d99aee57735

SHA1
e4cc19696d7e5c01b59b80bffb8888e2d41b4d24

SHA256
71173adf238621f1f129a6f03b40a4e359201ddc69209574b2d345443e2721fc

SHA512
e524ae541aaa072bbd2a3882d55fb3713cc8ce8b42633c5435a7af5057b4be9fd1e754e6063bd7d53e63b657bee11817d9b502f4c93fb91b7523a19d4c6abaa3

Download Submit
C:\Users\Admin\Downloads\WannaCry.EXE

Filesize
3.4MB

MD5
84c82835a5d21bbcf75a61706d8ab549

SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

Download Submit
C:\Users\Admin\Downloads\WannaCry.EXE:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\WinNuke.98.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\b.wnry

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\Downloads\c.wnry

Filesize
780B

MD5
8124a611153cd3aceb85a7ac58eaa25d

SHA1
c1d5cd8774261d810dca9b6a8e478d01cd4995d6

SHA256
0ceb451c1dbefaa8231eeb462e8ce639863eb5b8ae4fa63a353eb6e86173119e

SHA512
b9c8dfb5d58c95628528cc729d2394367c5e205328645ca6ef78a3552d9ad9f824ae20611a43a6e01daaffeffdc9094f80d772620c731e4192eb0835b8ed0f17

Download Submit
C:\Users\Admin\Downloads\msg\m_bulgarian.wnry

Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\Downloads\msg\m_chinese (simplified).wnry

Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\Downloads\msg\m_chinese (traditional).wnry

Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\Downloads\msg\m_croatian.wnry

Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\Downloads\msg\m_czech.wnry

Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\Downloads\msg\m_danish.wnry

Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\Downloads\msg\m_dutch.wnry

Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\Downloads\msg\m_english.wnry

Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\Downloads\msg\m_filipino.wnry

Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\Downloads\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Downloads\msg\m_french.wnry

Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\Downloads\msg\m_german.wnry

Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\Downloads\msg\m_greek.wnry

Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\Downloads\msg\m_indonesian.wnry

Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\Downloads\msg\m_italian.wnry

Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\Downloads\msg\m_japanese.wnry

Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\Downloads\msg\m_korean.wnry

Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Users\Admin\Downloads\msg\m_latvian.wnry

Filesize
40KB

MD5
c33afb4ecc04ee1bcc6975bea49abe40

SHA1
fbea4f170507cde02b839527ef50b7ec74b4821f

SHA256
a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

SHA512
0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

Download Submit
C:\Users\Admin\Downloads\msg\m_norwegian.wnry

Filesize
36KB

MD5
ff70cc7c00951084175d12128ce02399

SHA1
75ad3b1ad4fb14813882d88e952208c648f1fd18

SHA256
cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

SHA512
f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

Download Submit
C:\Users\Admin\Downloads\msg\m_polish.wnry

Filesize
38KB

MD5
e79d7f2833a9c2e2553c7fe04a1b63f4

SHA1
3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

SHA256
519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

SHA512
e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

Download Submit
C:\Users\Admin\Downloads\msg\m_portuguese.wnry

Filesize
37KB

MD5
fa948f7d8dfb21ceddd6794f2d56b44f

SHA1
ca915fbe020caa88dd776d89632d7866f660fc7a

SHA256
bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

SHA512
0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

Download Submit
C:\Users\Admin\Downloads\msg\m_romanian.wnry

Filesize
50KB

MD5
313e0ececd24f4fa1504118a11bc7986

SHA1
e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

SHA256
70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

SHA512
c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

Download Submit
memory/1572-2716-0x0000000000690000-0x000000000098E000-memory.dmp

Filesize
3.0MB

Download
memory/1572-2599-0x0000000073750000-0x000000007396C000-memory.dmp

Filesize
2.1MB

Download
memory/1572-2625-0x0000000073750000-0x000000007396C000-memory.dmp

Filesize
2.1MB

Download
memory/1572-2559-0x0000000073AD0000-0x0000000073B52000-memory.dmp

Filesize
520KB

Download
memory/1572-2560-0x0000000073750000-0x000000007396C000-memory.dmp

Filesize
2.1MB

Download
memory/1572-2562-0x0000000073A80000-0x0000000073AA2000-memory.dmp

Filesize
136KB

Download
memory/1572-2561-0x0000000073970000-0x00000000739F2000-memory.dmp

Filesize
520KB

Download
memory/1572-2872-0x0000000000690000-0x000000000098E000-memory.dmp

Filesize
3.0MB

Download
memory/1572-2878-0x0000000073750000-0x000000007396C000-memory.dmp

Filesize
2.1MB

Download
memory/1572-2563-0x0000000000690000-0x000000000098E000-memory.dmp

Filesize
3.0MB

Download
memory/1572-2593-0x0000000000690000-0x000000000098E000-memory.dmp

Filesize
3.0MB

Download
memory/1572-2597-0x0000000073A00000-0x0000000073A77000-memory.dmp

Filesize
476KB

Download
memory/1572-2958-0x0000000000690000-0x000000000098E000-memory.dmp

Filesize
3.0MB

Download
memory/1572-2619-0x0000000000690000-0x000000000098E000-memory.dmp

Filesize
3.0MB

Download
memory/1572-2603-0x0000000000690000-0x000000000098E000-memory.dmp

Filesize
3.0MB

Download
memory/1572-2594-0x0000000073AD0000-0x0000000073B52000-memory.dmp

Filesize
520KB

Download
memory/1572-2595-0x0000000073A80000-0x0000000073AA2000-memory.dmp

Filesize
136KB

Download
memory/1572-2598-0x0000000073970000-0x00000000739F2000-memory.dmp

Filesize
520KB

Download
memory/1572-2596-0x0000000073AB0000-0x0000000073ACC000-memory.dmp

Filesize
112KB

Download
memory/1572-2722-0x0000000073750000-0x000000007396C000-memory.dmp

Filesize
2.1MB

Download
memory/2632-1340-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/3300-2998-0x000000000AAF0000-0x000000000AB00000-memory.dmp

Filesize
64KB

Download
memory/3300-3001-0x000000000AAF0000-0x000000000AB00000-memory.dmp

Filesize
64KB

Download
memory/3300-3000-0x000000000AAF0000-0x000000000AB00000-memory.dmp

Filesize
64KB

Download
memory/3300-3008-0x000000000AAF0000-0x000000000AB00000-memory.dmp

Filesize
64KB

Download
memory/3300-3007-0x000000000AAF0000-0x000000000AB00000-memory.dmp

Filesize
64KB

Download
memory/3300-3010-0x000000000AAF0000-0x000000000AB00000-memory.dmp

Filesize
64KB

Download
memory/3300-3009-0x000000000AAF0000-0x000000000AB00000-memory.dmp

Filesize
64KB

Download
memory/3300-3006-0x000000000AAF0000-0x000000000AB00000-memory.dmp

Filesize
64KB

Download
memory/3300-3005-0x000000000AAF0000-0x000000000AB00000-memory.dmp

Filesize
64KB

Download
memory/3300-2996-0x000000000AAF0000-0x000000000AB00000-memory.dmp

Filesize
64KB

Download
memory/3300-2997-0x000000000AAF0000-0x000000000AB00000-memory.dmp

Filesize
64KB

Download
memory/3300-2999-0x000000000AAF0000-0x000000000AB00000-memory.dmp

Filesize
64KB

Download
memory/3300-2984-0x00000000062C0000-0x00000000062CA000-memory.dmp

Filesize
40KB

Download
memory/3300-2983-0x00000000062E0000-0x0000000006372000-memory.dmp

Filesize
584KB

Download
memory/3300-2982-0x0000000006890000-0x0000000006E36000-memory.dmp

Filesize
5.6MB

Download
memory/3300-2981-0x0000000000600000-0x0000000001818000-memory.dmp

Filesize
18.1MB

Download