wannacry | hxxps://example[.]com

Resubmissions

28-01-2025 13:27

250128-qp9axssqck 3

28-01-2025 13:08

28-01-2025 12:54

28-01-2025 12:51

27-01-2025 18:45

23-01-2025 19:23

12-03-2024 13:45

12-03-2024 13:33

Analysis

max time kernel
873s
max time network
855s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2025 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://example.com

Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Downloads MZ/PE file 1 IoCs

flow	pid	Process
103	4456	msedge.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDE06B.tmp	WannaCry.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDE072.tmp	WannaCry.EXE

Executes dropped EXE 38 IoCs

pid	Process
4540	WannaCry.EXE
3580	taskdl.exe
4472	@[email protected]
724	@[email protected]
1972	taskhsvc.exe
5332	taskdl.exe
5352	taskse.exe
5360	@[email protected]
6056	taskdl.exe
6072	taskse.exe
6080	@[email protected]
5524	taskse.exe
5532	@[email protected]
5560	taskdl.exe
2760	taskse.exe
1776	@[email protected]
1864	taskdl.exe
5188	taskse.exe
1976	@[email protected]
5196	taskdl.exe
5292	taskse.exe
1128	@[email protected]
4008	taskdl.exe
5024	taskse.exe
6112	@[email protected]
4744	taskdl.exe
5180	taskse.exe
5176	@[email protected]
5168	taskdl.exe
5456	taskse.exe
2084	@[email protected]
5468	taskdl.exe
5696	taskse.exe
3540	@[email protected]
3780	taskdl.exe
4460	taskse.exe
5328	@[email protected]
208	taskdl.exe

Loads dropped DLL 7 IoCs

pid	Process
1972	taskhsvc.exe
1972	taskhsvc.exe
1972	taskhsvc.exe
1972	taskhsvc.exe
1972	taskhsvc.exe
1972	taskhsvc.exe
1972	taskhsvc.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3028	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nzfbkoaczl750 = "\"C:\\Users\\Admin\\Downloads\\tasksche.exe\""	reg.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
133	camo.githubusercontent.com
148	raw.githubusercontent.com
149	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	WannaCry.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 55 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wannakey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wannakey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wannakey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winapi_check.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wannakey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wannakey_omp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wannakey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133824777252476439"	chrome.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 = 50003100000000003b5ae696100041646d696e003c0009000400efbe47598b483b5ae6962e0000004ce101000000010000000000000000000000000000001a005d00410064006d0069006e00000014000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\NodeSlot = "5"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 19002f433a5c000000000000000000000000000000000000000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 78003100000000003b5ae6961100557365727300640009000400efbe874f77483b5ae6962e000000c70500000000010000000000000000003a00000000001a005d0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = 00000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0 = 84003100000000003b5a2c971300444f574e4c4f7e3100006c0009000400efbe47598b483b5a2c972e00000054e10100000001000000000000000000420000000000de56290044006f0077006e006c006f00610064007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370039003800000018000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\MRUListEx = ffffffff	chrome.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5420	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 929646.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
2372	identity_helper.exe
2372	identity_helper.exe
3216	msedge.exe
3216	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
4732	msedge.exe
4732	msedge.exe
404	chrome.exe
404	chrome.exe
1972	taskhsvc.exe
1972	taskhsvc.exe
1972	taskhsvc.exe
1972	taskhsvc.exe
1972	taskhsvc.exe
1972	taskhsvc.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
6084	wannakey.exe
6084	wannakey.exe
4708	wannakey.exe
4708	wannakey.exe
5352	wannakey.exe
5352	wannakey.exe
2164	wannakey_omp.exe
2164	wannakey_omp.exe
4524	wannakey.exe
4524	wannakey.exe
1616	wannakey.exe
1616	wannakey.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeIncreaseQuotaPrivilege	1768	WMIC.exe
Token: SeSecurityPrivilege	1768	WMIC.exe
Token: SeTakeOwnershipPrivilege	1768	WMIC.exe
Token: SeLoadDriverPrivilege	1768	WMIC.exe
Token: SeSystemProfilePrivilege	1768	WMIC.exe
Token: SeSystemtimePrivilege	1768	WMIC.exe
Token: SeProfSingleProcessPrivilege	1768	WMIC.exe
Token: SeIncBasePriorityPrivilege	1768	WMIC.exe
Token: SeCreatePagefilePrivilege	1768	WMIC.exe
Token: SeBackupPrivilege	1768	WMIC.exe
Token: SeRestorePrivilege	1768	WMIC.exe
Token: SeShutdownPrivilege	1768	WMIC.exe
Token: SeDebugPrivilege	1768	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1768	WMIC.exe
Token: SeRemoteShutdownPrivilege	1768	WMIC.exe
Token: SeUndockPrivilege	1768	WMIC.exe
Token: SeManageVolumePrivilege	1768	WMIC.exe
Token: 33	1768	WMIC.exe
Token: 34	1768	WMIC.exe
Token: 35	1768	WMIC.exe
Token: 36	1768	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1768	WMIC.exe
Token: SeSecurityPrivilege	1768	WMIC.exe
Token: SeTakeOwnershipPrivilege	1768	WMIC.exe
Token: SeLoadDriverPrivilege	1768	WMIC.exe
Token: SeSystemProfilePrivilege	1768	WMIC.exe
Token: SeSystemtimePrivilege	1768	WMIC.exe
Token: SeProfSingleProcessPrivilege	1768	WMIC.exe
Token: SeIncBasePriorityPrivilege	1768	WMIC.exe
Token: SeCreatePagefilePrivilege	1768	WMIC.exe
Token: SeBackupPrivilege	1768	WMIC.exe
Token: SeRestorePrivilege	1768	WMIC.exe
Token: SeShutdownPrivilege	1768	WMIC.exe
Token: SeDebugPrivilege	1768	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1768	WMIC.exe
Token: SeRemoteShutdownPrivilege	1768	WMIC.exe
Token: SeUndockPrivilege	1768	WMIC.exe
Token: SeManageVolumePrivilege	1768	WMIC.exe
Token: 33	1768	WMIC.exe
Token: 34	1768	WMIC.exe
Token: 35	1768	WMIC.exe
Token: 36	1768	WMIC.exe
Token: SeBackupPrivilege	3992	vssvc.exe
Token: SeRestorePrivilege	3992	vssvc.exe
Token: SeAuditPrivilege	3992	vssvc.exe
Token: SeShutdownPrivilege	404	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
4472	@[email protected]
4472	@[email protected]
724	@[email protected]
724	@[email protected]
5360	@[email protected]
5360	@[email protected]
6080	@[email protected]
5532	@[email protected]
1776	@[email protected]
1976	@[email protected]
1128	@[email protected]
6112	@[email protected]
5176	@[email protected]
2084	@[email protected]
3540	@[email protected]
5328	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 4024	3372	msedge.exe	83
PID 3372 wrote to memory of 4024	3372	msedge.exe	83
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 1764	3372	msedge.exe	84
PID 3372 wrote to memory of 4456	3372	msedge.exe	85
PID 3372 wrote to memory of 4456	3372	msedge.exe	85
PID 3372 wrote to memory of 1372	3372	msedge.exe	86
PID 3372 wrote to memory of 1372	3372	msedge.exe	86
PID 3372 wrote to memory of 1372	3372	msedge.exe	86
PID 3372 wrote to memory of 1372	3372	msedge.exe	86
PID 3372 wrote to memory of 1372	3372	msedge.exe	86
PID 3372 wrote to memory of 1372	3372	msedge.exe	86
PID 3372 wrote to memory of 1372	3372	msedge.exe	86
PID 3372 wrote to memory of 1372	3372	msedge.exe	86
PID 3372 wrote to memory of 1372	3372	msedge.exe	86
PID 3372 wrote to memory of 1372	3372	msedge.exe	86
PID 3372 wrote to memory of 1372	3372	msedge.exe	86
PID 3372 wrote to memory of 1372	3372	msedge.exe	86
PID 3372 wrote to memory of 1372	3372	msedge.exe	86
PID 3372 wrote to memory of 1372	3372	msedge.exe	86
PID 3372 wrote to memory of 1372	3372	msedge.exe	86
PID 3372 wrote to memory of 1372	3372	msedge.exe	86
PID 3372 wrote to memory of 1372	3372	msedge.exe	86
PID 3372 wrote to memory of 1372	3372	msedge.exe	86
PID 3372 wrote to memory of 1372	3372	msedge.exe	86
PID 3372 wrote to memory of 1372	3372	msedge.exe	86

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2236	attrib.exe
1620	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://example.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff0cb46f8,0x7ffff0cb4708,0x7ffff0cb4718
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1908 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2184 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1152 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6300 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1152 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,11367918646078404151,3155980503030105615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Users\Admin\Downloads\WannaCry.EXE
  "C:\Users\Admin\Downloads\WannaCry.EXE"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  PID:4540
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h .
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2236
- - C:\Windows\SysWOW64\icacls.exe
    icacls . /grant Everyone:F /T /C /Q
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3028
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3580
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 162781738004110.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1240
  - - C:\Windows\SysWOW64\cscript.exe
      cscript.exe //nologo m.vbs
      4⤵
      System Location Discovery: System Language Discovery
      PID:3644
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s F:\$RECYCLE
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1620
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected] co
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4472
  - - C:\Users\Admin\Downloads\TaskData\Tor\taskhsvc.exe
      TaskData\Tor\taskhsvc.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1972
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b @[email protected] vs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1708
  - - C:\Users\Admin\Downloads\@[email protected]
      @[email protected] vs
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:724
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2156
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1768
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5332
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5352
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5360
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "nzfbkoaczl750" /t REG_SZ /d "\"C:\Users\Admin\Downloads\tasksche.exe\"" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5368
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "nzfbkoaczl750" /t REG_SZ /d "\"C:\Users\Admin\Downloads\tasksche.exe\"" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:5420
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6056
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6072
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:6080
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5524
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5532
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5560
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2760
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1776
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1864
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5188
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1976
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5196
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5292
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1128
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4008
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5024
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:6112
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4744
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5180
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5176
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5168
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5456
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2084
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5468
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5696
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3540
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3780
- - C:\Users\Admin\Downloads\taskse.exe
    taskse.exe C:\Users\Admin\Downloads\@[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4460
- - C:\Users\Admin\Downloads\@[email protected]
    @[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5328
- - C:\Users\Admin\Downloads\taskdl.exe
    taskdl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3504

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fffde87cc40,0x7fffde87cc4c,0x7fffde87cc58
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1888,i,8217269835293806842,18065779118051999404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2120,i,8217269835293806842,18065779118051999404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2288,i,8217269835293806842,18065779118051999404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2300 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,8217269835293806842,18065779118051999404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3408,i,8217269835293806842,18065779118051999404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3700,i,8217269835293806842,18065779118051999404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4792,i,8217269835293806842,18065779118051999404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5024,i,8217269835293806842,18065779118051999404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5036,i,8217269835293806842,18065779118051999404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5196,i,8217269835293806842,18065779118051999404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5480,i,8217269835293806842,18065779118051999404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5016,i,8217269835293806842,18065779118051999404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4828,i,8217269835293806842,18065779118051999404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5836,i,8217269835293806842,18065779118051999404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5856,i,8217269835293806842,18065779118051999404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3152 /prefetch:2
  2⤵
  PID:112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --pdf-renderer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5992,i,8217269835293806842,18065779118051999404,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:4788

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5028

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3992

C:\Users\Admin\AppData\Local\Temp\Temp1_wannakey-master.zip\wannakey-master\bin\wannakey.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_wannakey-master.zip\wannakey-master\bin\wannakey.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6084

C:\Users\Admin\Downloads\bin\wannakey.exe
"C:\Users\Admin\Downloads\bin\wannakey.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4708

C:\Users\Admin\Downloads\bin\wannakey.exe
"C:\Users\Admin\Downloads\bin\wannakey.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5352

C:\Users\Admin\Downloads\bin\wannakey_omp.exe
"C:\Users\Admin\Downloads\bin\wannakey_omp.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2164

C:\Users\Admin\Downloads\bin\winapi_check.exe
"C:\Users\Admin\Downloads\bin\winapi_check.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:976

C:\Users\Admin\Downloads\bin\wannakey.exe
"C:\Users\Admin\Downloads\bin\wannakey.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4524

C:\Users\Admin\Downloads\bin\wannakey.exe
"C:\Users\Admin\Downloads\bin\wannakey.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\AppV\Setup\@[email protected]

Filesize
585B

MD5
dc007712fc78f47db7d0d7e6bddb4e32

SHA1
4bd10f9da23d9abca3f62b8976b08d9e84886a3f

SHA256
55e50a336fab7b62ea63e443044331bba83ade25ae62039b596c2f0ba999e539

SHA512
c6806cc28b901056eeeef5552c6c90de328f590687e215d0d7553c781c1866d96c36164d73a9b985715bd1a6074422f9078e078c561ae7288ebfaf7b31eee7f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
06d20da39105a99807ab711b20b60d6b

SHA1
dfc12d603685d93a91e37e4c2124da88ddc3d90b

SHA256
60a6ae41e7b01342b56f95d3630f3b2708a3ead152be8e2d33eebfbe049d7610

SHA512
81ec694c73f9c714b607ca8afe83a590ed34683306aa9f428388a967cdce36b62d6a9c205eec72ddf06a9965a64ea4b0cd8745f64f59f6bb165c83375e0c3713

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
215KB

MD5
7b49e7ed72d5c3ab75ea4aa12182314a

SHA1
1338fc8f099438e5465615ace45c245450f98c84

SHA256
747c584047f6a46912d5c5354b6186e04ea24cf61246a89c57077faf96679db6

SHA512
6edf4594e2b850f3ede5a68738e6482dd6e9a5312bffa61b053312aa383df787641f6747ac91fa71bb80c51ed52a0c23cc911f063cd6e322d9a1210aea64e985

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022

Filesize
18KB

MD5
0346ebe73b21667ad74c6e0583a40ac7

SHA1
4c75eafd2ac666700a1e7a36845ef859b1e8131d

SHA256
9df525b3192d1c859c90a82abbab4b5de63662e1374de09fbc381b55729a8d3d

SHA512
e27348c6f0f91f8f06d7bf9d3c5cb4b15d2cd7a0f8badc4822288bb63b740985798c96fbbbf1c30d67c59c58f08bcab5316f85a0d4876b67c27172db1a2c4e45

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023

Filesize
21KB

MD5
80bf99b5a21602b5a0dff31a970843c3

SHA1
a9b318e7a3c7d8a10ae5d8e395858f203ac68b55

SHA256
7cbedcad1d9851fd277524d2bb2f7fb0b20edd69165aa96a5024b74964b289de

SHA512
29bbc7846da13811461165b7a62f84707284123e54f0eed139a5558f37d8a4b2b73f478b43c9e2f7b9913cdbd3d538c84c848e4f36a9c9abde2cec4666eb41f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
168B

MD5
acbd75c5ba8c45be783ba8d913f24d2b

SHA1
796281ca8dd3851c669ecc99f86a588a615df5ed

SHA256
1366ab5f96d7a3615617630a622d27bc2931a5f15ade1ac03e28ce540faffb61

SHA512
3eb95476f63362442578b0cdf1b8995ce386bafb5b9c276798e0cd0c83a4759db40878833686f5aff017a43d21ed4a985e749e80b36af0b94bd4e2e795af6d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a29c488e69a527d82c4723df39019d8f

SHA1
ac25a3fefc72fc16b65dd9b4e7412cbdff4ee0e4

SHA256
893450b3e89830d8c850f5c3ff2b505d5cbea4c699646662b57c71957c83eb7f

SHA512
9a9be9702a35117c513f1f308d3f518f2cf24aafcf61a4c3f69e5f409bf890b498caa6fa4e7ce5881f0d328452a5d624172946a62631cfc1ffed0e4a24f66c6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
3cb26bdfdb42a4403849ee255fef0dc0

SHA1
195fa15e7bdd468f203bf0f9bc3c903737b9b5b0

SHA256
ac83926b15fd3e259f24fe8ab5aee88dc530f2a3eabca0e8cf9a6bb68eb3a2e9

SHA512
a4c9607a6a2f693f4cbc6118bd6997348fb95bafde771f969bd09a0267f5ef87d640a00e36f5375bed1bfcfb10ad359e02ab947a2a56ff76a47c459647cb00e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe60c577.TMP

Filesize
96B

MD5
6af4497ddfe92b6186debd564eacace8

SHA1
c56046b7839736c434102445b0d268fb12072f73

SHA256
da7c67181fdde37cb0dc69fcbd3a9459e817b5b109271650048e41e95c6943cb

SHA512
d95ebef553e3cf0b8400eb73e5946b98d329aed0413e5665694fab9aa2207d7e0e2797210548d0609a1c4ec76637b6bd33af3f7beb15f6fc8cd79155b6cba279

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
e3c90d6f3bad367cfb281699a605ea5d

SHA1
aec486f14016167ec4ad55cc51080e99e317130b

SHA256
94fa82bc7fa464622f42762ee4c63400ca5d3d6d28e3dd0d3206cc314536aa81

SHA512
793d50d92f413c748dbd15deb5bef98e0f37b3d947ce36e98f9bde90a8cfe375650ea9f5badb38a200cc24dba77d4780bacfb0ede50bf0e83f74fb0b88e2a814

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
bd9daa92cbde521b7ccfa80493a99b9f

SHA1
6e61957b332a3bad3cf8d4cef4256de84acc49a6

SHA256
e4dc8a17190ee8d34d6b720975e0a90574db4d624f6faabfd02768bb020835ef

SHA512
d50c1c8a94ca61c50ee150a71c0995fdcbb91b2e4633fcdd1a6ccc66b9fc2d2d8363ec00a885b51314dd365eeb69a3d7cca16958bd4e004b2432e30d1baaa1a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
ff35f419fcc73d7fcb95f57d7f58b5fd

SHA1
5e9827bbedeb98353756f80c9dba6a55187cd1ea

SHA256
15edf72a6c31dcafe7ca0eb2cc1356533cb81de1119d3918408526dfbb08f1e8

SHA512
85e7d28201e643efbbc0861793c8f39070db9f7d3899d8128a18a2d4ffbc5c827a0a4916a257b362fec64a2cfac6d8c6e2ee019da1ce48d7be15f96dcd013ed7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
1fd42ec08a5fa51a3192aa1caf5a4637

SHA1
f8f59099d3e557db01a6d50172d50d2770d1ea2a

SHA256
f28afd5e8730f09c92edf1743bd1e56d4c0cbfc3e09d0b410f40574293c99c17

SHA512
faedb18ab7cb1452b10e7472c65ccf3a74edcddce7e4fec77416ce611de8b77cfcbe28fe7aa2cde38ab71f711b8614b766baee828528c96ee6802220879bba0b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
8595f08d60e973136a27d5f7ef121300

SHA1
91bbb1c99e570fe5898e402b3d6161b86ad62e98

SHA256
053e91fd8dd93407eb1baa5d93a200b142036c671fcc08b86b520892775f6885

SHA512
5ef2079aee6348be2e3c5a80a750bb659ab0736fd97ce087e0f695650c2abf7e8823b2c89eb89025d22169f1a329b985e50087a9c3a39e9be02c79522828df36

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
489831500d864ff627b9489a8e88aff3

SHA1
013966196ed8acef8f5ec46c922d582f3506d581

SHA256
3976691a804a4794d13c695f2fdbf1dc2c78d254c463f2e3c8323b7a4fa1403d

SHA512
9939864996c814778f12dfdf4ec0b57adfbf9889313c1c151d05dc57b836b8501788f4f6916da52cfd144565f3d85f0167550a86913af6f8a0606e2593782ca2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
179261cf8328a6c4fbf12d6f2f8ea164

SHA1
476f88028d1b55f152bc3af3749e30e23a6507ae

SHA256
944ac3dbdba5bf051f7da7f98890ae7bb3fcbee1dabfda6a24b43acf116d661a

SHA512
5ba68b3c32d55e9f72133ee7c3287a137251997c1c31a9890833534e299635dcdeac34f9a11121eebb2c558279910844b7572a3c470e7e8364f67664fcbb6c76

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
daf5020b3e70631f299b59c7de4036d8

SHA1
8a887d68bf08095e42af48e567fda09f472feebc

SHA256
cd5cd88fac91fc550c7abe306beaa6894bb77c8b63041e61996dc73a3c6bd03f

SHA512
38e3db83d107922704b57d554212136c2a6d977b62b8d7197e29fd4663fe1c9757e252c1aa42dc13636c5624dd5c57da988d788d5f69230e39103bf12bb62dfc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
6cf8c9b27ff0bb3c53e1d93ba6610035

SHA1
41e7c983a16e2fc4ac05769c683805f73a508356

SHA256
e1237339727170968056b45dd0d40725447f28c1d9b9c96f3c179568f585f698

SHA512
7062ff08b697511d9eab97632222f75820fe2ee3463115cbe9834b48430afeee44d2ca69e2ca8bca0bbb20781fcfa8e18462d152ca1dcb05dff282e217369cda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
5d977267f285911de1b043d8422ad092

SHA1
325303de96b9f5a8fb28d447054953207b70ef8e

SHA256
88309ff1d1b1dbe67eb1d4122e055173b8b87cddc6e4f96f7abef33a52673106

SHA512
0f4d9ad960e9d382f01cbb6a662f30830e9992a058c60894a0018c5461f6afddb20227a4dfb364142fc7a5f0107eeffd2fe0eb35debdff3657b4cbc819b3de66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
587b63adab0d86d2d026e066465d0786

SHA1
b5fe1f9c5b6cad0465b66b1c04dc39b5ab8cbabc

SHA256
55a71d21046c6625f0e6d0b703e39c518cbc563328f6fa9903bec399047545f5

SHA512
bc9d7fa5f6cb0bcf3d5ef3bc96d6b2d2548b523c4f7d7126da9ca3242d28e5962fd1dcd9891923c6cfecec0581ab53e71e64d67757b560fce97157d4433e0ebb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
cf665032e6c1ac77d772349b920549f2

SHA1
b3efc4d9ac13dd28335cb611ea70fc3312edcb77

SHA256
0eb236ea9c46300d75de62be790e745a7e09367b2327885e7de30fa77e9b3648

SHA512
f62fa06e683a9ccd96534ed8b47b2d90e604696f34f3a6c011140859f80d2d65593caa39a65c7d4b8e45ee6ed1ce1be7b47d0f8be5b0a46e185b102d2fd6703a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
0d00c60d411b875872b6b9c176ae3395

SHA1
365fd65ee592928f2bf88d6d06a113b1d9e401b3

SHA256
81bf4f878a3feeb28c1348dc60caba9da000d34b67fffe0dcd63351d4fd50e7b

SHA512
6911a3ab772bec0ababed3aed1b8a7f773bb646b2fdea210b43e51d28807521c523fddb444a87ba995d4132d3bfdef9e6abb8202f28bcb61b1b0f07ff20c7cb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
571f6d662fd1570dadf3438c13828c77

SHA1
faf51c318df5bb7eac89646b4835168993a52880

SHA256
feeea1c856e9ff3fdb1710a9072626625f0db9d4f082434d332a538c20e46645

SHA512
3e54bf003746605e20190c0188a552d1c2ebd3cce3e15d91ad0d8c901eef429117a20b6017931d5f19f01ce5bca350f7b9ed63e2389594188c9501ce1f7755f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
de947ecf5621c42b9d87a8488fd8ca4d

SHA1
3b46bbdfc4824200ee89dd0dc7dfa5c0d2c4e260

SHA256
088e1709bb861ff923c0f31691d1f4adf957ea0e63f358d52389b2408d223692

SHA512
12548d5adf4307174d525d098f4ca6a1a44444954fbef445f4e88d938317915ea6c9015b63e06d9f217383efd4144a08a0c65d85134ba59d5eed2e2375813bb6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7865cffd12339ba0a1fe8d07e8a4f89b

SHA1
8694ce411b40b1036e9f430cd46981229cacdb0f

SHA256
0e6d901671099f25fbe5e46468f8c14347b14d770f4bc89bf14d46f5c06004e5

SHA512
6da7730767c4c388dcfa138f0a8b7b7871a8b7a400424e9839b7cb0162d6b3d45b3502a81e59540406bc6a6c8b43e8b4bd756df32ce7613985366313e827254b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
53dfec8275fc2df1c349cc407d2da699

SHA1
96ec7c0751927469fe61d6154a8deaa3c4e39aef

SHA256
dda16cd7316347f2d1973942969e95dc2e4908229d0c0bae2ea0be559dd6b0a2

SHA512
447451f45a71e93b700b5256d5bcad7c99fcc8f356a5ab509e3028cc5e98f0f7b8be62583ed54a51f2c411432df67ea4399319fa73812b322a9f98b74a3d9428

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
68a820206a241f4c115ad5cc4f4c5ab4

SHA1
2dd6d82570594cff1e5269aaaa14cb001df5b1d1

SHA256
2c6b3d0d3d0258a1b7d1d0e6748d55692c39495f215339acca397c594c1785f0

SHA512
1c7b3b4942ab76e7cd83d5d5eb1910813707f1b64bfc72481bd9e0be8349fc2ed4190293bab689fbb12824b13493965a624b44af88a2fb8ae66e2d13cbca0ba5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c4e680a2141bc967b4be98c75d320c10

SHA1
a98373f170869ad613ad99bf017a9877055065ae

SHA256
2457ebb4a37e78b36fe343a594a518c51ec6221df2471e17e95d6303f186ceae

SHA512
22c7b2ef36c6059e27e0969c99ef8e37d7b8fbf6458fd55c44707347eed76919fcdbc76368f0a99de8e65c4845bf34593a3f61c0e962bdf188ca9262e968f4a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
9ca78364b0e5cdd62d32f17e62a6e57f

SHA1
83e0985d0c88ade0e88e664ef6a392e490179da2

SHA256
551ce81e73f9a75b8389f29dc5e489a9674cc4fc7c082ea56b4bc1a1261e3e88

SHA512
7a32e6e800209bac5c14daa24cd06b522533a936410f2655756ea7430fcc993341595b687e0f7533b8a13c8da726f609be05940c523f1a6debade1cfe2041384

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1763dd65f95a6814fd2713fecfd0e990

SHA1
564a6747911ded9f022ad2a7168e19374fc769c9

SHA256
902818496496915443bd97c7879a80c423f62dcf94b2cb03b9c0ae75737f64b4

SHA512
b074286b8966933c7afed49f0f51db7d62c83e70a5976ac130f110ddfb0499eecd27ceb8da1538d37e9c263ba9792261ecfb9d934cae61a2d1fc71daeaabe6bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
eaf5dca00514d62b9e3ee45cf0d0c172

SHA1
107ae1b985f62fef84eb29063229066a92ae1244

SHA256
48a79ae6789c4f76e1e5a9143b9c755cf393190878adba6058d688d15a01cbb8

SHA512
3133820199bed6b995a264bac6cae17d133cc3b314182833ad2162422a0e8a423450490489adc6ba86db0bc69f706c22a95a05cf3525dd9830bcda491c2aacdd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
323cc1d842c5a33f524a542fe3639e51

SHA1
4601d8cb93f7676e6fb60b4a20077a3c640e7328

SHA256
b43e6d588c8332b5f5139d88b38650dff5767c1fe7222aef91920123a562a554

SHA512
9c43ace009b107597f6eb73b2a6fc8b97dfffe79726ac265437f0e10d9de9ffeb54a19b5b084823e4eb97498c14be7c4125d49d94c887080a4ffb28d6eec6300

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
a95ff53f72a8e67e7860087b34598c00

SHA1
d58d2fe196a4e92d53d804b679829ec9f0bdd56a

SHA256
e7fa114a88726c07d300bf390535fb77daa76f9cb110b9af2cddcc4f96ac5b1e

SHA512
684ebbecd08289558da24caa0dcefdc0abd26cd6b628e58948d0773494386194418d8ac071be873025db477d8c0785d1a204f81f17c853487b0a871f91732ef9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ca89a6c55745eb2582269584e9f4f312

SHA1
97538679f074c9f19fb24c73f7efea1b72517f56

SHA256
a24d123dc64b60a54f72a0954f42b01aacaf031a3a47f7527df45c752265959c

SHA512
1a3fdc694b79632c0de3f8008a8d1c5f45d68e3325a23f74a24ec34697911c5afa4d92934a68a50377c9735cd0050fabdf6553dca006a43547a5200644d32f14

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
18fc1405ea0065439befe7048f358b6d

SHA1
af0d9752b7251199bc16d03b88d4a2be94c9a7ee

SHA256
8db6c1ac80508e4276a95845b216a49e626e3efe6ca0b81a18adfc487e6dbe67

SHA512
75e75465681aefbf1cd27c6c67aed6a3072a523e7ca7c9128162a5d930fe66c887cfa42aa82f6d1f11a3c64e568b3e8a1ba3471d51d537396f79c90f6cee5a20

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
3de142233c89c7c7ca1a6f6977542c14

SHA1
f6474cf5233063b99a9ead0fc2f993ded4e50870

SHA256
b86a8c2e2905f2482ba05a6a2edeb46578b2757435d316fdd32353b25bcf68e2

SHA512
8d6e9df9a15d9ff4c3246d3dfe94bea5f46b06597a4f184a9f774026ceee478975bd82e85db8719583c257d82d0f3f8bb567f73af2b9d2157ec4b31dbb3ec0ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
72b65d73834de3fe17f2a047ede1d775

SHA1
31894f3113537939582002bd17afba8053823f2f

SHA256
4a90f95970b368bfb1722187c392c0c61b391f07f00b6f97c44cabe620b92364

SHA512
6b352af824b365ef10555bb81f3f296beef08ddfba6b5ad57bcbaaf7e7ff1a629c657524ee3a6c7e4a31f68e45dd1bc16396babc5a83620ae762817c96dfc14b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a527fbbc91a90ddb4f30cd6927be79e0

SHA1
be136fa964c772dcecb62f124385dd7ef089cbdd

SHA256
7b90a1e0e486041da8efdb1e3a732a57af4d6a96ac1559d569fc2e44e2a9eb5f

SHA512
0bb8c30f6f7830f510cc5a46f6ac0cb726b09c04390d2819c8f0254cd0db336c66c354f3da874d6ea6755ad6caac62e3fc66187b55e0c07094d03a781f847d7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0e80aca6397aa7692d00a53754c86146

SHA1
0c52eb10e9bda374cb2b9d4260bd90805a0b5cc2

SHA256
6599b5db6f882a09e67c256aa0b2e7cbb7ef113de4bfae36de65c9de421f61f3

SHA512
e1522e83598b4cd54940d12ccf4aed7bfb10df2e5c90374c605f2b8442ab6cc697b973867dfe51d9a0877876ed8d34ab4ce973766c684b30affc31e26c0ba7a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f61c756f0533ab68d6355063900e67bc

SHA1
942ea6cd0f4ba07e0fda9754b55bbff72ecf76cf

SHA256
bd38d213021998d16cdb2863dfa45b7c60069c3b1cc8e96daf64c0e1d59d8599

SHA512
ad610e1a14554e9f858efdcddad3c1397bcae5f78e16a891f2e8164a884213808c0607965eb143edab4e120a099cf290a874b11548962dcf99f9eee4e27a22e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
fdb68c16c42b203abbfc865fa41be402

SHA1
a617cd88766459a9cfb6541459d9b56f26936976

SHA256
f6b8b7201deed205f1566271cf7de18950ab5b70e86eabdc7204792f4783c498

SHA512
ec25cc3aeea28218e0afd9b79e5f2bad27adbe5d6b038a10797f84a6423841155d8683f9c7f2f8f38688c0473060d04eef3dc83906a4dbe2d92093cd3dd08600

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
6786a4605229ff8f71c535fd09f7ecd0

SHA1
0bb26166197ebd636a007feadf537f021cef4523

SHA256
7e218c66225dc5aaeae4b31128e5551a2141071cec9c352558bd3504cb4f1bf2

SHA512
7dc76e8882f63f2bf88f2e1865f65fc0997aa96cd077cf78192970c8b9933e6eb1eca35b609fdb3b9462623875e1f4ddd997f60b126159b778a34b6f8ee374e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c9deba3f6b10949bb28803c74fee5991

SHA1
0da7f6eca62270999bb1cdc2aa250a22b823db36

SHA256
beedf34c01912bb900f8eadc61e0450e344e6f372fa2b460e1044565eba50d6b

SHA512
23525cbd8149d71b87b10b9992d8cfaae45352d60479c01ff1520e90eed054c0f547379c36e08bfa7077586fc93adab38880a29d80bb0a64a9a2ce44bab09416

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
2af69b663cb7cf0ac91a7f93e7dbea6f

SHA1
645e1628429634912cb442a6f669755eb15b6886

SHA256
4ea6a84f815704e6ef31a2d7b103a77e87d08713ff1787b866e3ba52a4c44b17

SHA512
e7214dc557376478614f67bbc1fb2c63d518138558a00fc51f5c06b5ea4e4872c1facec05a089af30f4dcfe6ca7533355857834afa2320659a0ea4ad7f79070c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
aca8b03ba7d7f52d0a5340f536a01b85

SHA1
aef7fab337f0b83b7e157ae903793c52422d9f0c

SHA256
8e7a131c7b929f53c11907e1b718cf7e1154091b83cf7a483dde6728854f335c

SHA512
e80aae4248d184cfce2dd13f385f672011df234f4a2e6c45003699900fac733545ea65c178e4027d084ed92fc30a744f7a1a70ad83d788e2265b2ba0dc81bce1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
6eb224b608acb43b4c4c2d4b6562367a

SHA1
5c38bf17fc82a01e54de8960e37e7f78dc470d7a

SHA256
c9833166048c94a2ac6877b32090eb770ac4fe08fc86c81c348e9f766bfa2d43

SHA512
fd02ffaf36d17b27cce7a582bf04bd3a34157d5faf9c7534c1319682e0135addac5a9b519379b038a798c4a8e7d739510fceddad0761cec3c60dbdde2cf64499

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
9550b0d4566e2cc266983c6f580397e5

SHA1
ec09a1b58104cb69d8bbff05d2e1e8f435cc9afb

SHA256
ed41ef0d6da9b3c02ef9e976effe72a382afb2b02ef71b511051450f8c1d1c9c

SHA512
5e54d327d8026dae353a628c4571cec51cc61914c46b835ef0c71b6ef9036523eddd1aa6f907279f81ddf1baec33789ce21abafeeddacabb22826b2666437cd9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
fff185f3ddef57e72e7d7c132b8ad64f

SHA1
6feffc9214bab9503633999a0eac4866c3a91ebe

SHA256
99e4e15c08066ab3f2be530bedd716c2558ac010b0259f64487fed38ae7c5580

SHA512
7292b304817bb995d0a821392b4ab63ae1fa6e9bb7a5781f88e27dfd7b2650edf2fdac4907359f554419fe438336d4e05403dcfb17de64f8128244935ae830a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
eaff1d767cdcbb07a2146cae447c0a99

SHA1
e3df6cd785324bed8331b11944d26b27b39f3059

SHA256
e0dd12364d3158fafacaf6f949075c9e47232439d9b3eea1eeee857875f17a7a

SHA512
79ee896c13a7f8425bb594a782586cd52f0cea1b13165cb3c08daa222ae1a8af3fe055243425296ec6963b98f4c759015035de49f9e9ed3de177aee9ee680b81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
47KB

MD5
0d89f546ebdd5c3eaa275ff1f898174a

SHA1
339ab928a1a5699b3b0c74087baa3ea08ecd59f5

SHA256
939eb90252495d3af66d9ec34c799a5f1b0fc10422a150cf57fc0cd302865a3e

SHA512
26edc1659325b1c5cf6e3f3cd9a38cd696f67c4a7c2d91a5839e8dcbb64c4f8e9ce3222e0f69d860d088c4be01b69da676bdc4517de141f8b551774909c30690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
70KB

MD5
3b06aa689e8bf1aed00d923a55cfdd49

SHA1
ca186701396ba24d747438e6de95397ed5014361

SHA256
cd1569510154d7fa83732ccf69e41e833421f4e5ec7f70a5353ad07940ec445c

SHA512
0422b94ec68439a172281605264dede7b987804b3acfdeeb86ca7b12249e0bd90e8e625f9549a9635165034b089d59861260bedf7676f9fa68c5b332123035ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
26KB

MD5
8ce06435dd74849daee31c8ab278ce07

SHA1
a8e754c3a39e0f1056044cbdb743a144bdf25564

SHA256
303074dab603456b6ed26e7e6e667d52c89ab16e6db5e6a9339205ce1f6c1709

SHA512
49e99bffcdf02cfe8cef0e8ef4b121c75d365ab0bbc67c3a3af4cf199cc46e27ab2a9fdf32590697b15b0a58ee2b7a433fe962455cf91f9a404e891e73a26f59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
38KB

MD5
adf2df4a8072227a229a3f8cf81dc9df

SHA1
48b588df27e0a83fa3c56d97d68700170a58bd36

SHA256
2fd56ac4d62fec83843c83054e5548834a19001c077cdb224901237f2e2c0e4c

SHA512
d18ffc9a41157ea96014a503640b3a2a3931f578293e88cc05aa61c8223221d948c05637875d8e3ee5847b6a99341ea22b6a1aee67c170e27bde5e154cf1b9ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
20KB

MD5
edff034579e7216cec4f17c4a25dc896

SHA1
ceb81b5abec4f8c57082a3ae7662a73edf40259f

SHA256
5da4c64f6c1ff595779a560e215cd2511e21823b4e35d88f3ba90270d9244882

SHA512
ab2dcd1628a0d0cadf82eebd123526979e8cf0a2a62f08f1169d4c03b567eca705bd05a36e5ffa4f6c3df393753b03e3daa18122955dde08fd8e5b248694e810

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
37KB

MD5
5873d4dc68262e39277991d929fa0226

SHA1
182eb3a0a6ee99ed84d7228e353705fd2605659a

SHA256
722960c9394405f7d8d0f48b91b49370e4880321c9d5445883aec7a2ca842ab4

SHA512
1ec06c216bfe254afbae0b16905d36adc31e666564f337eb260335ef2985b8c36f02999f93ab379293048226624a59832bfb1f2fa69d94a36c3ca2fdeebcdc3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
20KB

MD5
99c59b603e12ae38a2bbc5d4d70c673e

SHA1
50ed7bb3e9644989681562a48b68797c247c3c14

SHA256
0b68cf3fd9c7c7f0f42405091daa1dda71da4a1e92ba17dad29feb00b63ef45f

SHA512
70973ea531ed385b64a3d4cb5b42a9b1145ec884400da1d27f31f79b4597f611dc5d1e32281003132dd22bf74882a937fc504441e5280d055520bfca737cf157

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
26KB

MD5
525579bebb76f28a5731e8606e80014c

SHA1
73b822370d96e8420a4cdeef1c40ed78a847d8b4

SHA256
f38998984e6b19271846322441f439e231836622e746a2f6577a8848e5eed503

SHA512
18219147fca7306220b6e8231ff85ebeb409c5cc512adff65c04437d0f99582751ccb24b531bbedf21f981c6955c044074a4405702c3a4fae3b9bf435018cc1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
18KB

MD5
8bd66dfc42a1353c5e996cd88dc1501f

SHA1
dc779a25ab37913f3198eb6f8c4d89e2a05635a6

SHA256
ef8772f5b2cf54057e1cfb7cb2e61f09cbd20db5ee307133caf517831a5df839

SHA512
203a46b2d09da788614b86480d81769011c7d42e833fa33a19e99c86a987a3bd8755b89906b9fd0497a80a5cf27f1c5e795a66fe3d1c4a921667ec745ccf22f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
18KB

MD5
f1dceb6be9699ca70cc78d9f43796141

SHA1
6b80d6b7d9b342d7921eae12478fc90a611b9372

SHA256
5898782f74bbdeaa5b06f660874870e1d4216bb98a7f6d9eddfbc4f7ae97d66f

SHA512
b02b9eba24a42caea7d408e6e4ae7ad35c2d7f163fd754b7507fc39bea5d5649e54d44b002075a6a32fca4395619286e9fb36b61736c535a91fe2d9be79048de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
58KB

MD5
267673b53e30990f53624c0c77a98b01

SHA1
b866f6a0ff5b16016135b9f81b1973935422d412

SHA256
75049bdfdb5c6c6cfb6c6cbed51d88c9c862f92eba2639a1d46fbbf226f61add

SHA512
bea27f1d2004506ddbf94d5fa0e3d39dd86e45afb3f3b11e066f470f6d465f49ca31426791bb137487fa2af3586d15b4dadfe2668dbeda8f39e2abd7e0b99f47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
40KB

MD5
6405245ebef4dfac2674d06048d68b73

SHA1
7ea43b7c2799949730785be8e1e1a6830b713ecb

SHA256
65432f323635831b8fb8e56af3dec04775c270ec53964c3513b48ddc82fbd48e

SHA512
b75bc7d63cd7786b52e66e271af3fc235bc904f4d43fcb29c2f9c57dbbd7bc07807c90686c92480e79aad74979db2016bd56fdef4a57583177eb3f8fec5bf12d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
53KB

MD5
2ee3f4b4a3c22470b572f727aa087b7e

SHA1
6fe80bf7c2178bd2d17154d9ae117a556956c170

SHA256
53d7e3962cad0b7f5575be02bd96bd27fcf7fb30ac5b4115bb950cf086f1a799

SHA512
b90ae8249108df7548b92af20fd93f926248b31aedf313ef802381df2587a6bba00025d6d99208ab228b8c0bb9b6559d8c5ec7fa37d19b7f47979f8eb4744146

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
107KB

MD5
299ca95cc038a95290e1110e037c96fa

SHA1
cb9cbfd904623ab7287bb019c0eb0c48bfe5a4e2

SHA256
9847c0208b4c74a399438b062467820f9023534a5358fa5d6b28a4b0c18d033d

SHA512
6b61806258b2a02aa968c0ce55429adf5727af4420547532c9db10ae832f1e3abbf70d08f6c69e590d1823b6699685b0c153314ce113bf85d346f4dba0c97cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
87KB

MD5
65b0f915e780d51aa0bca6313a034f32

SHA1
3dd3659cfd5d3fe3adc95e447a0d23c214a3f580

SHA256
27f0d8282b7347ae6cd6d5a980d70020b68cace0fbe53ad32048f314a86d4f16

SHA512
e5af841fd4266710d181a114a10585428c1572eb0cd4538be765f9f76019a1f3ea20e594a7ee384d219a30a1d958c482f5b1920551235941eec1bcacd01e4b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
16KB

MD5
cd4e82b46e4da434142a43b103c70d82

SHA1
c90880a374cca87c8db41b629e803cba3412f14b

SHA256
7fac6df5eda28d747100a7de800f01581d46fc81adfb53e5f6597e81ced06613

SHA512
89d38702ed8b7eef95f287012b3de691cca0c191c673ecb7be8aff9481f38e6669ff9b3b422b4e92b1d4bebac4d4e67811cde421b422728930c75962f989a6ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
419528e9c147535427336dd580a9fc95

SHA1
a6818bba13f9580bf7b0443421f5b067c183c94a

SHA256
275602e2e8c40801001c94fd2b269e8cf889c69dc06ce1ddb59f21162d74efbc

SHA512
de5d933f8337f98d52d107646c963104a0c25b4661391212ea47179c175ed99fd15b0691ad16f9f9838f62c7beadce908f45d55052317e5b59962d58f8bcf65d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
0212f3b3e7474bfe5d38eb39acfb329c

SHA1
00e018c283eea117dd85f956ec0b034c170b3cf0

SHA256
360e5d09b3d6686f5a54e8d09812f2275c4217fe8bf18639784f5ef6693f2d4b

SHA512
031966887e87cc090ac1b394b0297308aba37bd79f8d86def7df63cdbfe4aed28419a095dafe0cd108b6978b0ab1f81f8cebdfb9ecce66680f48874c41738e31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
628B

MD5
24469cca1ae99641ac91de7a552f8d90

SHA1
309428f9c5091ebfb0dec5df3412b093c1dd345a

SHA256
0a41293f60a210d3608e5a0f7fd348203f080928b27ef75d942de7bf3cbe5c33

SHA512
a0bf889e904c8f7af163538c402f8fc8c56003d940ea9ecd5bcd531ee49d0264030668f698a428db3e197e622e5b1f7cd15a30b64b929a250666d718e8c60da3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8771d5bbf219ac6d09279248aa3d0c11

SHA1
2a305d98fa3734a5866f187bd47ce0a77a44631b

SHA256
f0c4440944a0aa0be2b7e18d14108dfe76af6b982fe7ccec096837ddbc1fb419

SHA512
77b9adac8bbad9a5d1432048dc01d2288b8409915f76c2eb26d88817886d43bbe606ce6cd1324f291ecb68a59c10ae4dca6df9969e18000c4cdbca69ad5cb9f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4ec0e19ae76d29df8b3b1120d7c6b668

SHA1
22cb8a373f0e423fd500eb839f5171ec247c915e

SHA256
855919c2712f20f505f2dcb6720d428aa27664f8f673b58664fcb9f924b379ef

SHA512
d111f049116b6a985e3de39ac73fe2530c1ca7fa6107731aedbb1f9f0dff73c475d4ec3d99a177d48cef15e40f086e2ad652f2e986c30af84e14f5efc2807d61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6b216bf3636e2b70c7b3d7cb48af65e5

SHA1
152d48f4faaefa1744fcb18fc2f39afac8a10e30

SHA256
a965f326c8e13be38a5a36a5042d33c3319612890bffa21dd8bd0a83c8bc6620

SHA512
7dd4ec9b750ec5d18727d1bb246372058e65a09cdec40a6d257cc91b099c32fd48be6317736d40d8176b0477eeda94f37e1f8e7045c312383e901a5356160b78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6f77c23189ad44b4405ea9980cefd583

SHA1
f3245b3cdc614cd82f0cb5eac28ebf98fc893596

SHA256
278d71a193ce02cae0a48fc81ed1bfbda17f1876759af605a477d2c6920f857b

SHA512
55b5e214aca90507fa7c443bc223db2e046c1507f5d506ae69def66b8f8954c1acd25da047bace386b7ac6b4801575f4a2dbbc5b65d9986a3226aa7d6b376304

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8062f29c8969438f2ddf2fda325d512a

SHA1
9b73177cc3338d3027b8bb14f47dd98b5f8558aa

SHA256
5efece96feb6454c8551fa8f6730bf951b456671b2325cb0de97ce63d0d8778b

SHA512
5c57547738db31dc5b5b84077e8be5bd778d44fd90429969f7fbcab9db31275d951828cec8d7cf0e28f1b33d8f0cf6f5fd534526f43892820bd1f10fa1f6b46b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3c344c515c9a7a3c406540da44abffed

SHA1
3302a57203dfbc3519c1e925f0781c3b5e328351

SHA256
d49f54b9028502db2a655f5fb1e7bfbc565ecbb80446b8b6cd615b10910f9e57

SHA512
89416af8a7f493f254929f29f8d2e979fd9c5807e0491f1588265d94b56d4aef879b33cf85ce888758b83e0a7db25e16313f905d614ac9f0b78ba95f21b65f23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b08b218bd18ac7699408a6b79b940597

SHA1
ab16bb3db13a931c8c490a9bfc5ed132eb93c314

SHA256
81ae345107f0c822b3239c81bcc4e84a79604126ab28af3a5655da29a6a87f97

SHA512
21bcdcb000325ceb8732331ed5e5e4a19f355eaf403382bfebe808a29eb49cc1c21aa96b550f5cd346ff9be2211037f679d3edcf28c0f5f0ad0f82ec5c396ad4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
20745edbbd6b70fdecbe241b61eb0c98

SHA1
0ebf46bb78e178930239aeac758164c70a1d295c

SHA256
5125e1eb2f19042bd2e2a62a8b5e6f389ba8bcdcafb57b2677deeeb3738d88c2

SHA512
40781062d52f7d894a29ab31d74a789b9c95dd2b5ddf0c3db70f1dd3a067bd7d09622501abc63bee62015aff157a5c4adc2879929932e1c3aa267842a832f2b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e77ef7bcb913d0baefe13c1496456ce2

SHA1
afbaf1868097a4de5a35b0335e8038abca413efd

SHA256
f1f7355756b6c66559426ecb78a455bcc250091b743a1bad06738a2c6c5023cc

SHA512
9d4d1979039faea491ba6860d30b603b48ee9f8507fa8be95ff83274966188bb7e0253afe498edb33cac6bb56d04c6053a92698b1f1af93404493347867aed6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8405734157efd9a991bdb5f850f506e3

SHA1
a5d8ea2f0404e872e1f9ccaae1b9b6802e6ba93e

SHA256
f60655ebd107f102f578c07316cb344ab1d9b2d041fc010754bca2bddca9a5dc

SHA512
49bc8038071b8815a77ebe0663801ad9baf30bce40acee9020a121a8f669e8f12d1d0247b787380369a4fdce7cd74fa5a9a4bac8752c21e955d4fefa638575ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c5d536e8d10730b7b9cc5aa9ca773e34

SHA1
ec2da9850064cdb00ab9ed4066b77eec2a6f8701

SHA256
fb2c994aecbbc471bdad730ba9a4c56629533aadd91d434bb4d9106c6c53518c

SHA512
9acafd3af44297159afc8533433aa8c0b3ea756da1d340f66c0ba5db04a1ac38934328594def1cae81474434870b5f0e7f30891b7f8823cadb83acd274543f7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
98bee3d0225fe161242f47ce99be2cf9

SHA1
7ad68c88a2e5e94652cb6c8ba25748a7d18669cf

SHA256
5fe4662ddf2dc0a35b45e311c5037bd1daa46ba28113bd7ebcf82aac3d8cdd1b

SHA512
343e9c741e9cb30cf2d16572b2d3978725f8e76f39cda268071a5dbd0f6732e74b91a6137860dce80232e1664357802b0297bbcc836e993a078925394eda7465

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
07bac193ff8557c9748192776ae69c95

SHA1
ae47b2f47c8d03abc437c0f735dfbd6434294d2b

SHA256
9a0c20184aef6b3451fe25b1d55cac888ef3929b4a2fbfc788bb12867aa64e2e

SHA512
9472c9cd64a91be6a906a885fc81189599921077d30907014a83de828526567adb5241c42dca8269229190fd655cb82ae1f2c803041c4eb6d57b10a5abae5d84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0af2d1be0960f49e0b0a995a22300c4e

SHA1
8d37e4964ae1cb16793d61e298b3700c97e56243

SHA256
878c543a90c93ffac72819171de1fcbece8e069f71f958ef68cb760c51daf293

SHA512
2143d78b72b4caa39f4c37abd870abfe42653df629c0d940029da659b67f09b7506e744b81ea67e7ce5fa22e426d246b4865cf6de6d2c3cfd5038b1fdf7a4449

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
02d080a86d4e72a6d8bb0cfa7fb99b72

SHA1
434b3ffb78e5a09dcd13d320ef5c38cf86907642

SHA256
7824e95effbed759c7ea2d1e3dc533bf5e10a712c4784e4f5ad18f72309abe9c

SHA512
e76909ee53f8ddf8378cb7e09d1f82d714a79808cbd0d42f793b48784189ec05abecd4e4dd93b6d61c86c8dd5856f45a90a31cd3f792b4fa14fc8921c3af6aec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
238aa236b45c2df4ff9fa4a5fcf5cb03

SHA1
c7f22f573a3c16900b0128e3f48d943377432585

SHA256
2a59facb03b7fc3a9ed416b2ca8243313b48abdea8a1a5115a65c655180efbc6

SHA512
3915241f64613ad116ce3bee96cc5dea0e91e9c0ae0d8a90338d3bf60179b8edfd2bf1d0a5868775cf63d8e4c1e1af9a342d3bdbefd86d4863385775bc9feade

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
617e71fcaff237cc9e3ce5e15c0eec31

SHA1
28d239190f61a396b75451ac8c7a85eb04c31070

SHA256
1b7922eb1db32e408bb8bb34d34b566d625e9c49e70b6ee5393a400f6607e90a

SHA512
a734d43cd9411b9fa5f7d24afa113a74c4dfe2a8702f655b676ce8fa8d81810cb07d7b58efb62caeecba35b79a9aed9893c8b3207fadf673db8695f5a514fcaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fd1a2843817b1f73ab16b58937f0826d

SHA1
3c6fe016667f38fb83f9a402b8ccdb6319ce2690

SHA256
1f00d5f2da87eebf2fb0b149649c9882c49a7341e2e71b1bb64ab5e76a22fdda

SHA512
a94a0fb4bd5d5866360f53dbf14fc3435a5217261554104d609a913145e6d2b9d4581c629362819faf87e6299c2e0d9845e99eebd92a3b1783991f97295f705d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
118551a98a41468d9ff90782a5bca663

SHA1
06f0d71e9edbe51718acd87f8d4c4241b4acbcb7

SHA256
2a9f1ef46bee5e11bdffbbde00d3d78f843c94fc6ec1947548946d8418d688a5

SHA512
555cb61da599257333b13416ed9a8d5e9320096853c5c0021af4a2036fc6b228480b4077104afc0ae3cfd876f3e4f41a9d50ae5e0524da50f21028bffb0d063b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b93703d510480dd4c5c00cd38c4e8205

SHA1
97e31291a8a7dcf787e9e78f3407ff88b388bc2a

SHA256
932ddb11ddc5638f2d8a80c4f0c664b9a4decba7f6826863b6cae6570a0500cf

SHA512
1df985cbdd24b435e2d09eaa94b5cdc7862ac88d6b49bc63004477868736165310c46d9d07b4a6aedb43511ce4141d95940ce10f7cd42c4b91095be26d4d3b9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
1c186654b7c15c91b8059ba25158aebf

SHA1
8300319d12f8c48a6763705ecce44ae7a4003512

SHA256
f2a93b8624a218f5ddea23983ffa603da6ea5a7b7bcf4f15c2ece7cbdbeef04d

SHA512
b90b9be500970aaace6c66c1dcb36d133b4e843b68d27b74f7d28ff27209c8b4a9d4fc4a13c0cc303e9a1a62b4f66f284d1c84a1caae92f2ff281444072a5d46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58eac8.TMP

Filesize
538B

MD5
7c3ba11fcb5bcc6919ebd4f30478c43c

SHA1
03ce184e233afbb6293e74e84894778804f827db

SHA256
5680f3e8bd1f4aba8fb38930bf3c77c7b5b0ee01b1a885526e48fd916c531ebb

SHA512
d73736f721ae2d5f1926a06ecba97bf2b665d8c6952c6620484a422b5175c5ee50091d4dc243f6e7aa67e57cccfb6d66c7a059d26a59029478fb9f7560a4a879

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c80c041f-97db-473e-b8b1-e08ab3a72291.tmp

Filesize
8KB

MD5
0ce8e6d19d484355f4d60d5226b042af

SHA1
10eb1c0a178e0922e0ebcdc58a5175588c6ccbbc

SHA256
f90ecf539144cc8637afa3c54f57e306683ed105bf530314673659bf583a57e0

SHA512
633e5729a133c1447c4fd41985caaa93ad3d54bc9ea1f07bf9333830e75bb2221eead3d9a668ceb751cfd3c5d271d3bbdbfe82f361804021f6b9d3809bb049d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5daae470f00b8194d208329cb8795023

SHA1
dc0ffca8e96b658b96f67210ff1df7af759c7e29

SHA256
6e5514d56897bc1cbb6fe9be58d3168c93233876d1154de65155bafa43f98076

SHA512
0409f1ee32a8f3ef7e3e022fedc54741c2e7bb1ee37cc63afc71b1c348be859e49357d0bc0f66f5853febb5d76ed0317097001d1abe26c8aaddbd037fc7912d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9a89cd5e59f40405a0460d928647f652

SHA1
8d91453757ebdd5092ea2508c89dde59391ed25b

SHA256
1b6c66e885a8d606ab4f598964e6e666950551f115644a64f5e2f0e6118887fb

SHA512
e464fc99330db95ad29be26229f3e9a32d2ee2ffd27471d8b6df23574cf70ee439c8c6666cde7ad58bed2eb342616cd44f627bf6cc45a8fca353f53609f25d48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fce5d7148dd260adc9578958fe751814

SHA1
a795137c9b518e3b4c423e4251fcda3db501e3a7

SHA256
b6c944425d353105cffa7778bf767971302a49c3ca9f1634483d7adb9dbb856c

SHA512
bbaa3786afd6536c9084b1ed6b0de1bd1b81117ebfd27c0ac7c0880c9e33df7218339ef9cc7b4b822241ce11152066f2b94d5c53e614f8daa4113340903ad91e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3671ee5a0a33566c91240de65a0fd7d3

SHA1
96f1ddfb94fd53431e43eda6cf377ad94d844795

SHA256
7001fb066ddeacb5195c5fb310a1170f34ae380a62673bd679f78c316fbe6aeb

SHA512
5d38fd870943d1caa5e44b836ae6ed3a39311ed7ff8f0083287e1bfdf8abf2323ef29b40972fa1eb6450a1a48394093119125d34dcadcfc2cbdfc7ef84eb9a06

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

Filesize
7.7MB

MD5
c45421ad8c4ca94d2669dd73d993cc2e

SHA1
43a1ff8d302f1666573840b3dea86fd9f71bee82

SHA256
d0849197fe7b483534c795f9b6aa68218765c7d5c4a55ec97035fe54e6942925

SHA512
dd75f5fe904e61927079b8001b8779c0f9faa84a8af29e0f65d2c9fdeaa4c523ae056405bb5977d422e512106215fc2ca00d3e9e3d6f677ac434bd08dc89bf25

Download Submit
C:\Users\Admin\Downloads\@[email protected]

Filesize
933B

MD5
7e6b6da7c61fcb66f3f30166871def5b

SHA1
00f699cf9bbc0308f6e101283eca15a7c566d4f9

SHA256
4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e

SHA512
e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3

Download Submit
C:\Users\Admin\Downloads\@[email protected]

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\Downloads\TaskData\Tor\tor.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 46197.crdownload

Filesize
13.5MB

MD5
660708319a500f1865fa9d2fadfa712d

SHA1
b2ae3aef17095ab26410e0f1792a379a4a2966f8

SHA256
542c2e1064be8cd8393602f63b793e9d34eb81b1090a3c80623777f17fa25c6c

SHA512
18f10a71dc0af70494554b400bdf09d43e1cb7e93f9c1e7470ee4c76cd46cb4fbf990354bbbd3b89c9b9bda38ad44868e1087fd75a7692ad889b14e7e1a20517

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 929646.crdownload

Filesize
3.4MB

MD5
84c82835a5d21bbcf75a61706d8ab549

SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

Download Submit
C:\Users\Admin\Downloads\b.wnry

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\Downloads\c.wnry

Filesize
780B

MD5
93f33b83f1f263e2419006d6026e7bc1

SHA1
1a4b36c56430a56af2e0ecabd754bf00067ce488

SHA256
ef0ed0b717d1b956eb6c42ba1f4fd2283cf7c8416bed0afd1e8805ee0502f2b4

SHA512
45bdd1a9a3118ee4d3469ee65a7a8fdb0f9315ca417821db058028ffb0ed145209f975232a9e64aba1c02b9664c854232221eb041d09231c330ae510f638afac

Download Submit
C:\Users\Admin\Downloads\msg\m_bulgarian.wnry

Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\Downloads\msg\m_chinese (simplified).wnry

Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\Downloads\msg\m_chinese (traditional).wnry

Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\Downloads\msg\m_croatian.wnry

Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\Downloads\msg\m_czech.wnry

Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\Downloads\msg\m_danish.wnry

Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\Downloads\msg\m_dutch.wnry

Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\Downloads\msg\m_english.wnry

Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\Downloads\msg\m_filipino.wnry

Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\Downloads\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Downloads\msg\m_french.wnry

Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\Downloads\msg\m_german.wnry

Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\Downloads\msg\m_greek.wnry

Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\Downloads\msg\m_indonesian.wnry

Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\Downloads\msg\m_italian.wnry

Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\Downloads\msg\m_japanese.wnry

Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\Downloads\msg\m_korean.wnry

Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Users\Admin\Downloads\msg\m_latvian.wnry

Filesize
40KB

MD5
c33afb4ecc04ee1bcc6975bea49abe40

SHA1
fbea4f170507cde02b839527ef50b7ec74b4821f

SHA256
a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

SHA512
0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

Download Submit
C:\Users\Admin\Downloads\msg\m_norwegian.wnry

Filesize
36KB

MD5
ff70cc7c00951084175d12128ce02399

SHA1
75ad3b1ad4fb14813882d88e952208c648f1fd18

SHA256
cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

SHA512
f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

Download Submit
C:\Users\Admin\Downloads\msg\m_polish.wnry

Filesize
38KB

MD5
e79d7f2833a9c2e2553c7fe04a1b63f4

SHA1
3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

SHA256
519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

SHA512
e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

Download Submit
C:\Users\Admin\Downloads\msg\m_portuguese.wnry

Filesize
37KB

MD5
fa948f7d8dfb21ceddd6794f2d56b44f

SHA1
ca915fbe020caa88dd776d89632d7866f660fc7a

SHA256
bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

SHA512
0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

Download Submit
C:\Users\Admin\Downloads\msg\m_romanian.wnry

Filesize
50KB

MD5
313e0ececd24f4fa1504118a11bc7986

SHA1
e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

SHA256
70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

SHA512
c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

Download Submit
C:\Users\Admin\Downloads\msg\m_russian.wnry

Filesize
46KB

MD5
452615db2336d60af7e2057481e4cab5

SHA1
442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

SHA256
02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

SHA512
7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

Download Submit
C:\Users\Admin\Downloads\msg\m_slovak.wnry

Filesize
40KB

MD5
c911aba4ab1da6c28cf86338ab2ab6cc

SHA1
fee0fd58b8efe76077620d8abc7500dbfef7c5b0

SHA256
e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

SHA512
3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

Download Submit
C:\Users\Admin\Downloads\msg\m_spanish.wnry

Filesize
36KB

MD5
8d61648d34cba8ae9d1e2a219019add1

SHA1
2091e42fc17a0cc2f235650f7aad87abf8ba22c2

SHA256
72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

SHA512
68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

Download Submit
C:\Users\Admin\Downloads\msg\m_swedish.wnry

Filesize
37KB

MD5
c7a19984eb9f37198652eaf2fd1ee25c

SHA1
06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae

SHA256
146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4

SHA512
43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

Download Submit
C:\Users\Admin\Downloads\msg\m_turkish.wnry

Filesize
41KB

MD5
531ba6b1a5460fc9446946f91cc8c94b

SHA1
cc56978681bd546fd82d87926b5d9905c92a5803

SHA256
6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415

SHA512
ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

Download Submit
C:\Users\Admin\Downloads\msg\m_vietnamese.wnry

Filesize
91KB

MD5
8419be28a0dcec3f55823620922b00fa

SHA1
2e4791f9cdfca8abf345d606f313d22b36c46b92

SHA256
1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8

SHA512
8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

Download Submit
C:\Users\Admin\Downloads\r.wnry

Filesize
864B

MD5
3e0020fc529b1c2a061016dd2469ba96

SHA1
c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade

SHA256
402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c

SHA512
5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

Download Submit
C:\Users\Admin\Downloads\s.wnry

Filesize
2.9MB

MD5
ad4c9de7c8c40813f200ba1c2fa33083

SHA1
d1af27518d455d432b62d73c6a1497d032f6120e

SHA256
e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b

SHA512
115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617

Download Submit
C:\Users\Admin\Downloads\wannakey-master.zip.crdownload

Filesize
2.6MB

MD5
3e124e1aef07a9ec3085bcf8c6234e1c

SHA1
1765ae5f7097d18f63a4f7dfcebdf78617bf6eb0

SHA256
941eb0ade566d9b13faafcbc9b94961fede92f01d28bec4e3b70d11f74d0549d

SHA512
20892d03aaab0ac22c653be27af9be1afadc1bd3b4b746683a5c381805eed20f3ec00c90b335c19337777549d9f4d296d8c2af03bc54824cd10420822404d78f

Download Submit
memory/1972-2719-0x0000000000070000-0x000000000036E000-memory.dmp

Filesize
3.0MB

Download
memory/1972-2661-0x00000000739D0000-0x00000000739F2000-memory.dmp

Filesize
136KB

Download
memory/1972-2782-0x0000000073730000-0x000000007394C000-memory.dmp

Filesize
2.1MB

Download
memory/1972-2776-0x0000000000070000-0x000000000036E000-memory.dmp

Filesize
3.0MB

Download
memory/1972-2846-0x0000000000070000-0x000000000036E000-memory.dmp

Filesize
3.0MB

Download
memory/1972-2870-0x0000000000070000-0x000000000036E000-memory.dmp

Filesize
3.0MB

Download
memory/1972-2881-0x0000000000070000-0x000000000036E000-memory.dmp

Filesize
3.0MB

Download
memory/1972-2685-0x0000000000070000-0x000000000036E000-memory.dmp

Filesize
3.0MB

Download
memory/1972-2657-0x0000000000070000-0x000000000036E000-memory.dmp

Filesize
3.0MB

Download
memory/1972-2659-0x0000000073A90000-0x0000000073AAC000-memory.dmp

Filesize
112KB

Download
memory/1972-2660-0x0000000073A00000-0x0000000073A82000-memory.dmp

Filesize
520KB

Download
memory/1972-2816-0x0000000000070000-0x000000000036E000-memory.dmp

Filesize
3.0MB

Download
memory/1972-2663-0x0000000073730000-0x000000007394C000-memory.dmp

Filesize
2.1MB

Download
memory/1972-2662-0x0000000073950000-0x00000000739C7000-memory.dmp

Filesize
476KB

Download
memory/1972-2658-0x0000000073AB0000-0x0000000073B32000-memory.dmp

Filesize
520KB

Download
memory/1972-2608-0x0000000073730000-0x000000007394C000-memory.dmp

Filesize
2.1MB

Download
memory/1972-2609-0x0000000073A00000-0x0000000073A82000-memory.dmp

Filesize
520KB

Download
memory/1972-2610-0x00000000739D0000-0x00000000739F2000-memory.dmp

Filesize
136KB

Download
memory/1972-2611-0x0000000000070000-0x000000000036E000-memory.dmp

Filesize
3.0MB

Download
memory/1972-2607-0x0000000073AB0000-0x0000000073B32000-memory.dmp

Filesize
520KB

Download
memory/1972-2876-0x0000000073730000-0x000000007394C000-memory.dmp

Filesize
2.1MB

Download
memory/4540-1151-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download