infinitylock | 0359c34efaf6025a0dec1cf80b5bcbb9b20517be4bca8945af0391049ed2c134

Analysis

max time kernel
900s
max time network
901s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2025, 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

luna-1.6.8.zip
Size

5.5MB
MD5

24fea6dd585a009c3ff441760beae097
SHA1

1920784c67ed8d49b611842b9643000aa0d8752c
SHA256

0359c34efaf6025a0dec1cf80b5bcbb9b20517be4bca8945af0391049ed2c134
SHA512

8f060951722ae1420812a36f12d64ded40de1797fdde3ac1591e143d9b3233174996cad0405eda36f3fc410e1abeb791d36a3a437bda2afcf4aaf1a2379f6f6a
SSDEEP

98304:gUZug/1mvXA/eiMVm7TZJ4xpQCQqoInFaGZV++7n0hTMuymld03bD0D1fd9kRUAU:FogNEziam71IpQgzF/ZE+7n4t1A330Dz

Score

10^/10

infinitylock wannacry microsoft defense_evasion discovery execution impact persistence phishing ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Extracted

Path

C:\Users\Admin\Downloads\r.wry

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send %s to this bitcoin address: %s Next, please find the decrypt software on your desktop, an executable file named "%s". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) %s rar password: wcry123 Run and follow the instructions!

Signatures

InfinityLock Ransomware
Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
ransomware infinitylock
Infinitylock family
infinitylock
Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Downloads MZ/PE file 2 IoCs

flow	pid	Process
84	2520	msedge.exe
84	2520	msedge.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD4EE.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD4F5.tmp	WannaCry.exe

Executes dropped EXE 13 IoCs

pid	Process
1104	InfinityCrypt.exe
768	InfinityCrypt.exe
1528	InfinityCrypt.exe
1904	WannaCry.exe
3048	WannaCry.exe
3756	!WannaDecryptor!.exe
8	WannaCry.exe
2824	WannaCry.exe
3176	WannaCry.exe
4324	WannaCry.exe
1412	!WannaDecryptor!.exe
3032	!WannaDecryptor!.exe
4400	!WannaDecryptor!.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r"	WannaCry.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
123	raw.githubusercontent.com

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
59	2520	msedge.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3625106387-4207083342-115176794-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdate.dll.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-hover.svg.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\s_empty_folder_state.svg.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\ui-strings.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\home-view.css.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\OptimizePDF_R_RHP.aapp.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_kn.dll.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\ui-strings.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Confirmation2x.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\psuser.dll.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\load-typekit.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\ui-strings.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ui-strings.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\s_listview_18.svg.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\ui-strings.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner-2x.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\en_get.svg.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_en-GB.dll.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Checkers.api.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ccloud_retina.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-down_32.svg.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ro_get.svg.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\file_info2x.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ja-jp\ui-strings.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner_int_2x.gif.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_anonymoususer_18.svg.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\ui-strings.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\ui-strings.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\ui-strings.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\protect_poster.jpg.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\it-it\ui-strings.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pt_get.svg.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\core_icons_retina.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\SearchEmail.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_gridview.svg.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\selector.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\action_poster.jpg.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\vi_get.svg.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\MSFT_PackageManagement.schema.mfl.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\sqmapi.dll.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PackageManagement.MetaProvider.PowerShell.dll.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud_retina.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.pdf.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\plugin.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pl-pl\ui-strings.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\it-it\ui-strings.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ar_get.svg.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_sl.dll.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sendforsignature_18.svg.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\ui-strings.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\EdgeUpdate.dat.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluEmptyFolder_160.svg.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pt-br\ui-strings.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nl-nl\ui-strings.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\tr-tr\ui-strings.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\plugin.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\dot_2x.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-cn\ui-strings.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8	InfinityCrypt.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfinityCrypt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfinityCrypt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InfinityCrypt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InfinityCrypt.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InfinityCrypt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InfinityCrypt.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InfinityCrypt.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InfinityCrypt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InfinityCrypt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
4368	taskkill.exe
2708	taskkill.exe
4084	taskkill.exe
1180	taskkill.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 508258.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 127479.crdownload:SmartScreen	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5008	WINWORD.EXE
5008	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe
1032	msedge.exe
1032	msedge.exe
3492	identity_helper.exe
3492	identity_helper.exe
4400	msedge.exe
4400	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1904	WannaCry.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeDebugPrivilege	768	InfinityCrypt.exe
Token: SeDebugPrivilege	1528	InfinityCrypt.exe
Token: SeDebugPrivilege	1104	InfinityCrypt.exe
Token: SeDebugPrivilege	2708	taskkill.exe
Token: SeDebugPrivilege	1180	taskkill.exe
Token: SeDebugPrivilege	4368	taskkill.exe
Token: SeDebugPrivilege	4084	taskkill.exe
Token: SeIncreaseQuotaPrivilege	4144	WMIC.exe
Token: SeSecurityPrivilege	4144	WMIC.exe
Token: SeTakeOwnershipPrivilege	4144	WMIC.exe
Token: SeLoadDriverPrivilege	4144	WMIC.exe
Token: SeSystemProfilePrivilege	4144	WMIC.exe
Token: SeSystemtimePrivilege	4144	WMIC.exe
Token: SeProfSingleProcessPrivilege	4144	WMIC.exe
Token: SeIncBasePriorityPrivilege	4144	WMIC.exe
Token: SeCreatePagefilePrivilege	4144	WMIC.exe
Token: SeBackupPrivilege	4144	WMIC.exe
Token: SeRestorePrivilege	4144	WMIC.exe
Token: SeShutdownPrivilege	4144	WMIC.exe
Token: SeDebugPrivilege	4144	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4144	WMIC.exe
Token: SeRemoteShutdownPrivilege	4144	WMIC.exe
Token: SeUndockPrivilege	4144	WMIC.exe
Token: SeManageVolumePrivilege	4144	WMIC.exe
Token: 33	4144	WMIC.exe
Token: 34	4144	WMIC.exe
Token: 35	4144	WMIC.exe
Token: 36	4144	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4144	WMIC.exe
Token: SeSecurityPrivilege	4144	WMIC.exe
Token: SeTakeOwnershipPrivilege	4144	WMIC.exe
Token: SeLoadDriverPrivilege	4144	WMIC.exe
Token: SeSystemProfilePrivilege	4144	WMIC.exe
Token: SeSystemtimePrivilege	4144	WMIC.exe
Token: SeProfSingleProcessPrivilege	4144	WMIC.exe
Token: SeIncBasePriorityPrivilege	4144	WMIC.exe
Token: SeCreatePagefilePrivilege	4144	WMIC.exe
Token: SeBackupPrivilege	4144	WMIC.exe
Token: SeRestorePrivilege	4144	WMIC.exe
Token: SeShutdownPrivilege	4144	WMIC.exe
Token: SeDebugPrivilege	4144	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4144	WMIC.exe
Token: SeRemoteShutdownPrivilege	4144	WMIC.exe
Token: SeUndockPrivilege	4144	WMIC.exe
Token: SeManageVolumePrivilege	4144	WMIC.exe
Token: 33	4144	WMIC.exe
Token: 34	4144	WMIC.exe
Token: 35	4144	WMIC.exe
Token: 36	4144	WMIC.exe
Token: SeBackupPrivilege	5028	vssvc.exe
Token: SeRestorePrivilege	5028	vssvc.exe
Token: SeAuditPrivilege	5028	vssvc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
4400	!WannaDecryptor!.exe
1032	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
3756	!WannaDecryptor!.exe
3756	!WannaDecryptor!.exe
1412	!WannaDecryptor!.exe
1412	!WannaDecryptor!.exe
3032	!WannaDecryptor!.exe
3032	!WannaDecryptor!.exe
4400	!WannaDecryptor!.exe
4400	!WannaDecryptor!.exe
5008	WINWORD.EXE
5008	WINWORD.EXE
5008	WINWORD.EXE
5008	WINWORD.EXE
5008	WINWORD.EXE
5008	WINWORD.EXE
5008	WINWORD.EXE
5008	WINWORD.EXE
5008	WINWORD.EXE
5008	WINWORD.EXE
5008	WINWORD.EXE
5008	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 4420	1032	msedge.exe	97
PID 1032 wrote to memory of 4420	1032	msedge.exe	97
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 4840	1032	msedge.exe	98
PID 1032 wrote to memory of 2520	1032	msedge.exe	99
PID 1032 wrote to memory of 2520	1032	msedge.exe	99
PID 1032 wrote to memory of 2220	1032	msedge.exe	100
PID 1032 wrote to memory of 2220	1032	msedge.exe	100
PID 1032 wrote to memory of 2220	1032	msedge.exe	100
PID 1032 wrote to memory of 2220	1032	msedge.exe	100
PID 1032 wrote to memory of 2220	1032	msedge.exe	100
PID 1032 wrote to memory of 2220	1032	msedge.exe	100
PID 1032 wrote to memory of 2220	1032	msedge.exe	100
PID 1032 wrote to memory of 2220	1032	msedge.exe	100
PID 1032 wrote to memory of 2220	1032	msedge.exe	100
PID 1032 wrote to memory of 2220	1032	msedge.exe	100
PID 1032 wrote to memory of 2220	1032	msedge.exe	100
PID 1032 wrote to memory of 2220	1032	msedge.exe	100
PID 1032 wrote to memory of 2220	1032	msedge.exe	100
PID 1032 wrote to memory of 2220	1032	msedge.exe	100
PID 1032 wrote to memory of 2220	1032	msedge.exe	100
PID 1032 wrote to memory of 2220	1032	msedge.exe	100
PID 1032 wrote to memory of 2220	1032	msedge.exe	100
PID 1032 wrote to memory of 2220	1032	msedge.exe	100
PID 1032 wrote to memory of 2220	1032	msedge.exe	100
PID 1032 wrote to memory of 2220	1032	msedge.exe	100

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\luna-1.6.8.zip
1⤵
PID:3872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcbcbd46f8,0x7ffcbcbd4708,0x7ffcbcbd4718
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Detected potential entity reuse from brand MICROSOFT.
  - Suspicious behavior: EnumeratesProcesses
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2132 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2296 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400
- C:\Users\Admin\Downloads\InfinityCrypt.exe
  "C:\Users\Admin\Downloads\InfinityCrypt.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:1104
- C:\Users\Admin\Downloads\InfinityCrypt.exe
  "C:\Users\Admin\Downloads\InfinityCrypt.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:768
- C:\Users\Admin\Downloads\InfinityCrypt.exe
  "C:\Users\Admin\Downloads\InfinityCrypt.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5184 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3112
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  PID:1904
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 283731738683500.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3120
  - - C:\Windows\SysWOW64\cscript.exe
      cscript //nologo c.vbs
      4⤵
      System Location Discovery: System Language Discovery
      PID:64
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe f
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3756
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MSExchange*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4368
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Microsoft.Exchange.*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlserver.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1180
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlwriter.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4084
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe c
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1412
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b !WannaDecryptor!.exe v
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4996
  - - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
      !WannaDecryptor!.exe v
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3032
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3960
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4144
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:4400
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3048
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:8
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2824
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3176
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2000 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1336 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16831473467605848076,6077796111904020044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:1960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5028

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x408 0x500
1⤵
PID:4984

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\LimitImport.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
16B

MD5
571016cbf3b258d1cbd7a338ce9df2c3

SHA1
30a321021c422caff4084627db5796dd5900b823

SHA256
b5b72297ded92288a18666239bb998cfafe98f3f4d5f7a5cb4919037b30da217

SHA512
74b1962eefabfe1784c0306181a2113fa407dec94e63004b7e8a965e85b95e7155b6dd9556515cff68d6388558a7d44ae07411353d9c430f85ea6971c23fe1c1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
720B

MD5
5abc3f57b57c4f47f1dc8305abe99c96

SHA1
ae95f0847e00fef9734103396e527757c97e3746

SHA256
b6f63a9edc24610a9f25f41835f1e422e8f6989231d9f37219f1ad12914bb415

SHA512
d189dd8427754ecbcc7f63131bce3984e3cc312e7c3d22182888202a4162f976c0e7f67a14e6998c3a1f55c42820307d5b2cf8e1739b971caf88b1d73883a2da

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
688B

MD5
590443c25d0546d8c656eb931596172f

SHA1
c2a903d2ed7ea3d46ef06d8d01796fd771a7e1a2

SHA256
9d45626f540b8f9ff7996e14d033df6e3e30ff4edb8467da285aac3fa51a2a9a

SHA512
7690ad9b87a2f21c825a83378298ccbff3168ac218c3a47de12efc85c0685a0dfce8dddb4a8bdf1c8522d391f20dc1ba75c200b00f9d8836f6e2f552f2edd54e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
1KB

MD5
244ba2c93e0d9a66309b65dfc4aa557e

SHA1
1618fe427a8803995583502bd8415ad7d5736580

SHA256
f4283138b5568d2beda9280f208913febbe4abed7b638c9bf4dedc6b8886b148

SHA512
3f51faa4ccbad70630895da5bc27369b4acb957e7eeecbab3d2b1d47df6fc0fe4fa589dedffdb8cf1d314bbf9e7dd33b9e6d08ccd1c76b9c28840bd4a219ca43

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
448B

MD5
84cb9bacfd38b4af9447cbfcd6e83c60

SHA1
27ca5a88da02fb0dece7d11af74acc8c385b60ca

SHA256
e599d8626d930ccd1bd0ecc5cff7d440c55223bef89efa8e2d01c339b7bfae34

SHA512
41caa6f5453700f644ca1a4ffd2a5aec37ebdd7e67c19af8ac9619aec21c65bc13cc8410d07e2cba1cf98103405bbe695af49043edd24956b46a25b06ebf01df

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
624B

MD5
792958b03cdd98df469a10f9bb7a519b

SHA1
a7155435cd557f6a51faa2d58f8a1d7c8d269776

SHA256
cfa74bde1dec5dd47204fdaea6242b3d84ebaa10347ed2e324f95fdb0603cbc1

SHA512
f85e73f0cd46320e76ac55469bd23c569057353bde91991fb809558c84496cdd0408815470313d5c2ce9b22fb053b9fcd852bcf592cdcdb240e5d3d2692f7b77

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
400B

MD5
de2b761c311c80d93617f302050d8b2b

SHA1
0b0bdd1b425db9fe37492a65ef47b122957af484

SHA256
2d41005b99aa688c4b32a43c3fa9e3af4900d30679245ebb64a2b819e93be9ee

SHA512
38fb62768da618e1c0022d4c4bc53ca218ff5eb1473255568e3a7adc9227892a795b54b941e6f677551323583f3676bcdf92459f2d3731d4363da4a67e13a47f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
560B

MD5
54653e557a9ecd28ac9a54cd58be09ef

SHA1
112c2ccc3c3e26d31a2c5d666d3b2d483fb59bf8

SHA256
cbf6add09b00b62c3a414da2df903bee2b07c2ccfa0ad7d51b51d33cc5508907

SHA512
68f50f017f63438653901a067c5862f955a74a38ed323ac6b3e9af5d8cd3683cde8b889620390cff5dc8c831d34beffe960f859aaccc8f2fa6b2497adc3c6a74

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
400B

MD5
d0676fd4524ef75672fdd3c012b09c7e

SHA1
7b42a4a2a90f4eca8b3a7e8f24726310571b661e

SHA256
1f756b11e5994ab5f99d2905ea9f6070723f8c29e2469adc7447bf4d40873cd5

SHA512
8b1365b78e6aff5580112a088a456346d2971b249c0e8b1d76eadbd910f4c01c192e842bcc86f7fa9c636b967af3a9100296ca9acc547b39c2d5c5ed7c11a9d5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
560B

MD5
de3647c3fc7cfa37fc5ff9642b47c686

SHA1
7bf2ed3610e7ab28bbd11098e736e51852a3d9f1

SHA256
730a9d17455506584da70ebb3e61334682458a1f7fbadd80e593347d8a9db1bc

SHA512
9fbb789fabd8f5e475041128fd410702c48e56ee88b1a240a22805ceb03bdc3bc462443a2e45b6561b4d2139606695b280fd63f4f70fabd0e93b719bfb99df39

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
400B

MD5
c359925a27bbe01d9d09a3d60b0aadb9

SHA1
cdf793933ab34095c8844bdd887e8914da1663ed

SHA256
66d3cc50b51cce7e315530d32ee4426e8b438ada47c14b58a035300e2af0c144

SHA512
320fde201d4fe31eec2c133649717240dfdd664a562ed25cd3b91d221385b2da42022dcd519689e6d43e9d203ca357625b9fa93a0157ba915f32dbfecb4d4f79

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
560B

MD5
0293f6908be157a4477acf27c1559536

SHA1
238b3f8478b0de3e986c08fec5bb4fe67ca9b8bf

SHA256
e1b55ea2a53644ef75a98e8f08374a926b1923533e244680fac60213d8ee1a5d

SHA512
37967016c0eed857067be29b8bf73b2f3f75a515d18738b1d1c1b5f1543757d47c9ea9dc241ffa8adadf327e2e34c78d879bee2c5fd67a32ac5400d17dce40a6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
7KB

MD5
d119fafc0cc6ae8e29a59cb7e43b849c

SHA1
231a1299b835954a781c26533120a93acd54b697

SHA256
af48a572bdeb7a936c46a27123e9b70c5c4a259b288c0d9c1064fdeac68c1a43

SHA512
b62c5bea9561655ff4f8b02724bb5798d463660dbc87689acbcce3aeb2dffb916619b6cd3af6594665d4fd71e6819b2ea48eeadea76eaa5ce4f0aaa8398e93b2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
7KB

MD5
82398af56ca5cdca5cec1d02f4cab477

SHA1
8b96ddcd2920918a3a814f923bad41fc9dca89e9

SHA256
8144ec9cadca51c5fbb599971676bc75a1b83ab75f3386e023d0c59a222ec33b

SHA512
8834b0a6c93e0c792434718bc20161e384c8d7c5a2b5d7d1edfdb5d7a12df5655c8ac485aaf5b740ea4559fd7c523be13a25c46b70e6b8903c807fa0b993cf0c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
15KB

MD5
8babb23b2f85cc8b463174c27088e4f6

SHA1
61f00b48943fd22bb7a3c38e9f4ccd67a65395c8

SHA256
b5d886a9edba4bb7a6830fb5c9b798b04ef8e40d62be126799bdb3cf459fae74

SHA512
4d7d2267dc5d196ebb789efcb5196cc8cd112ae635a135fc33093dea8e81e71427bca5702de2bd62c6b25f38281885811c7b4b21051cbf0c0914d4a9f6d3e644

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
8KB

MD5
13a6d3a5880b0ee94a5a830638cb31c8

SHA1
bb99645257a4f3d2fcb30ea0da9e2cae08b9bad3

SHA256
f6fa352496fcfe19742ce34e34abaea09f8a99e04e65e1f4507088e6175b82bd

SHA512
a644d05a0e4271ac2ed359d3952346b31221b25ada201f76d650b4c867303e31897c30ce52e2a101eef3999b3d5307145078c81b4cd5baeeee9b2cc40bf9cdae

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
17KB

MD5
8381628fabb73dbf449dbf994ced8e46

SHA1
00d8757f9f61c88d58f355c6eba83c52a21e1df1

SHA256
1bae7e027134b5714afea85fa5ae444aa8c430f386e5f8e46456970b24129ba3

SHA512
375e571c53f0334e3f1f60f0cc5b345a15535d3bf48f7ce0c96249ca4c0db9973726de57808ae72aad5d918ab89a694dc61e437db0c4c4d73ba3f51e0ae4c51c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
192B

MD5
a3d1f20df37703ec92dfb419415a24dd

SHA1
171a405254297682f64d8a0f74defbac63ecb1ff

SHA256
d5a69154e2415139afebdab6cf13e8ea06e95a0e4f80e8484fcd191b4979dc70

SHA512
9e560d6361ad992bca63954b5a9d371ef4ae6a290a2313191d2faadcbd4162c0c6f32457632e94a24bb0edd82b28cf5c228a890886161e9504292136ea4eddf0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
704B

MD5
552350c6a4100340056b05b47ebe520d

SHA1
b7990b762fec7af9b816b61bd3c0ebcfab1f1e40

SHA256
e54ca1d91d3578065ff5d2ddf8cd510631c3f3f24e845fd12f9b05f91af88b9e

SHA512
411e946661bdff0f2e863a56e9e95923c70fbaa208ea575667d052d625f777670fd8829d8c84d95fbf07e4a12be76f3934c05d1cb003865a1540fd228a833e96

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
8KB

MD5
3adca585edb746e972c50bb8ef0c9a7a

SHA1
2d61858de3e91cab7eadd6a3884965b53fdc9899

SHA256
10ec25a1c0889b8f769696792795379509c7a03d784bdd33c1e5179b6dff1bb9

SHA512
57ba325bd87a33a5b5ef61e09601dc49902d6b6cdd34a7c1468b362947c1e31641b208058de2ee0382776db76003750c99ce61d25c33ce635d5fbf6f94c5829c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
19KB

MD5
ae2158cec300f87aba008823a8521c15

SHA1
5ff612ff61d42204d7400f332730245dd3721ba2

SHA256
d5ebc9e3d8d77d41fd1eed124db939d8941d5787f9c48cd2fb8ffee75c2be60f

SHA512
e3e9d300e2a21eb4f4b92149bf169c94f98fcfcceada2169edfa72960f9f2eec8341ae7c2af6f35ecc50f150c4414026b72b67d09bf83e6a3bbaec4eb7d44216

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
832B

MD5
fcc3ff42e48000a9176336b0c68bcb75

SHA1
b8ae38ae96ef3e73986094fd0e0f6346d14a673b

SHA256
8c102f14541106592e467ee9e558c0712c5c2af4f1d9835fc5bc0f0a419009a7

SHA512
35f731ddceea7ad13c274daf7656be9803633958e233ed666cf3fae458710c760759da29186a9416e0175a3c2226cd7a8c43ad6328cfa66fbbe7611e78f1ed8e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
1KB

MD5
a5f6cca089a3982f9803d610d85f8ce1

SHA1
6d7b9b302ae2116c8518957e0db7a0b9966d063b

SHA256
df49ebba2930a19d9e2590ddd5e2a40bd98d0e31b87c78a2adc0888e0fb8a9cd

SHA512
d1062e16fa8e93754f6241ed41b112d77c6f59f1baffce5f214557da6838a7d978719a08791999146b0fe4be8f86e33d6dad7a06af05272eba5dce5d24d48b8b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
1KB

MD5
85b66a7e7297a4071d573bce3bf5b719

SHA1
e103e37e82fb8890056d731e5a91cd14a104fe56

SHA256
dbc756b23688a44170fdfa7db0399e555ea673de26d57130e683a71e369ab542

SHA512
b55362734378507dede69b88154cb88d3aef439150047a3d61493ccbb9a4dc5847c7f1cc0c95cec32cb65d22ba4530f6007f9990ac7106736f75116c260d5843

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main.css.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
816B

MD5
09512837021626c213fc9d0d3e22a87c

SHA1
7129fcd651525837c0b4c93c993e51af78bfec3e

SHA256
5cdbf1fa9ea28a36e319eb1fd7fc81391a0303df0c29406d2088527a6e0587ce

SHA512
a9db4a262b36df7875761f20b3f412f784ac994be346022c1962f34472506a0095ef0527ebc171b37f0a71e8d34b3148814b313a25ba29a53175d0e21aaa199f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
2KB

MD5
8990c61abb4383d5fd80839d4553b6e9

SHA1
2d29f59cf2cc67f5db2d17396cf88cd59cf5ddf6

SHA256
62e2ae117b111e420772350cd109ff936cf20322b9d0b908acc4453042c43cdf

SHA512
32cd71e8f79ea9b011c0f720a4d542ab69dfdd7898b1297cdb06b0cdddda8ed831f9e27421db56b0d1c0730010ad1598f1983efd46143f2f662a62dedccef200

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
2KB

MD5
ae89bed73448de49d0880d67fd657269

SHA1
3718233938592c69deafbb015ff1ffabbd0b2244

SHA256
ede819517c99a35a45226ac8513338d42c3ba23538de722ddee95ea4d638a7c2

SHA512
866a02aad8e276c93740b1362fada23725261ae8997429398983d431db57eb576037d95da3c2b6c50bb0928fadca9e99692efa913beb559e3ac93b3990dd0699

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
4KB

MD5
ccafb817ac65ae1077e4679c9f0d7b3c

SHA1
d7da8dec1acefec131483023c91c30745315eef9

SHA256
55b2b836068093f0d30f75ee2c379becaf2629f873ab4138d348b9c91931f7e0

SHA512
96deeee9ed05dcd2b3a509093e6538c4282f20d8cb74cfd408581814d49fa07b3aea7f17dfaad17a8011bea8809b2129c0d10b4fa6af3cf3c70f39845325dcab

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
304B

MD5
ee67e2a328dcff2159823bc01c5c0170

SHA1
345415efb3693cd66ae87c5db241e93bd70bb822

SHA256
2056b73856fe732d3194f2cf04489c3a3b06bef955e00af7d9f6589883109f6c

SHA512
c6c7fa82a406249a9effd272530e79cbc47ffeaa81278895a56d7b5dc2be42819a15ea03984f7f426d0700cbc2dc99a0342aa7514e8f6a4a06700e6c385adb24

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
400B

MD5
f08c18832499a82a3855a43d461eb1c8

SHA1
4cf14d18905f788f5ef8a35d26b677e626e89038

SHA256
9efbabd3c03a971756fafc3c941d3b03a3df223b98275b408cddaa89e6b04021

SHA512
55a0505f006681d8c3d9bab03ccbab62fe394367d0f73d043212cff6dd1f47c0abe2b29bba76537949b2794a363015c223e624010f1b794707faf8286c51fd4e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
1008B

MD5
3bd3614a62e9944c0ce182f855c86220

SHA1
3fc14a84b2a4cde12ae68d1e6fcdc275cff84e78

SHA256
b48c433c18deae6c2e3905094326e0f5cae46cbf91c26c6e50b60e4062e9b267

SHA512
901d057d340eedaf256405f86b7687705b3e7947067d65a63cafc62c957bb6a20e8ecb8ca24cbd851883e5d8639d76892a4854eb27634f6aadd58f3636fd8334

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
1KB

MD5
51fab791c5db9c69136ba2ab10c19296

SHA1
827a9e4081c5d88941f92ae5787076d4c6f83978

SHA256
a8249ce9fc44a79c3fbd5c185087075d4e8bd8c81ff376e3efcb023a61294f3e

SHA512
a962434c0109c81689f2005776215fc54aa411c9664bd605a0b02cda654faa8b8adca756e23331d74f321ce4ec4d8f01d9d9fb0d8eaf32bc2ca8a94914412770

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
2KB

MD5
1c6aeef51fef12fa0c8cfad1179f2de6

SHA1
f89c9d9e14c1c7353a549e98fa9adcbf0b79667f

SHA256
a2ae500bec20b2e1d472ad71450cbdff8e653ecd83b4d32e6a57b5e7de86beac

SHA512
b31de02306241923ff1b815ea3b63e1d98d7890b4bac7f6063398ee09a14d50c0612e98e481ed735d5d4d63d6a4d17e1dddb9c10bb8723fad9d06ddd73834387

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
848B

MD5
f1fad5995bbe75cd905b74217a9d283d

SHA1
e69a9665dc5473036fbfd40062f4c9e1a64c4ae6

SHA256
b528490ee98ce087bfd9a6d11ffe3f61082127937da6870f7e02d89e732258dc

SHA512
bdb016de26da4fb4e8ee0f5ec8c5b667cf23635c204a15a092e58b94cf406820b62bc41d749e5e849f9259da8c45f7ddadefe01b0a950b59f6d5782e4bf20c1d

Download Submit
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
1.1MB

MD5
3e2fc0bccb45a08272d7f1c0adb06a6c

SHA1
8f4e3bfa7e1141f4b564257d5ae83886e289dae2

SHA256
7eb03703f3ca4c92b512cb565c38c8f019eb5acd603e37d822a2865e352f72d5

SHA512
b01ee859ae5b6bb6f90906308d623f8231c928716e653be80545d747d5f25f27968528d8335b870d3752d299e06fbab4c3596295aaaa6496825a7182160b7195

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
32KB

MD5
b41eb6d18f1716e091dd197572ab027e

SHA1
bed3b16eb3727ff7e5e479cde25a5063bfc205d2

SHA256
0e987a671dd715ad80eabd6328f4efab1f0f5dd8eb3548ca4450ef6347317b8b

SHA512
e1c9290b57037a186012c77e491b1a5f0b13bc4bc17f52240c86831d27766ecef794e9844936ef03629a48fe5fa8ca59c50a0654e745ced8ebdf12f65397a356

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\dao360.dll.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
320KB

MD5
5b4a6a4797d0897818838988f6786602

SHA1
f2ed036bd3858d7d5428e86d5674706f68eaf891

SHA256
86f33105f8062fdf566b6d1fee1940a84e991454e19bd0b929a753f3a1ad14e8

SHA512
4976df17938c62b955d615a4354f3f96e22eb94dcff359f8d88bbd6f664593414082427233ce9891d2c728c01ca840fb010e27ac0e0259d37141cc97c4b07279

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\dao360.dll.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
596KB

MD5
0bead13da224c2b81b2df6bd76e8841d

SHA1
37e3f2b6f721fe5c4425732c3845b430d19b84ac

SHA256
1dfa390494cc8ed8c6c0bd7d92a2a82bcc088432d9d66edb8d61f99e753a3b37

SHA512
6ccd3796e4a0a134fd6040ad22861fa600655a461b6bc45570ca8b6bd0fab23be77ad41b6862b3a4df1713279753eed44f0bc0c9e2cf45480c3f2f2bf5bfa032

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\tifffilt.dll.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
172KB

MD5
8270b351e4fc963f69ed0d30cd8ad2bd

SHA1
0ad6ba9bd31003a015a01673816a456d0a712d15

SHA256
41a5dd001469ac39976e145258c4d0ceb74b38118102522e0c5d10fed7863d8a

SHA512
7c79b94358be46fbfd747d8b4585503c9172b314d24fbcabbd68b196fbe04e2401e555c1e619e8fb54ec88c7f949317096178dc0c7d9ca2373ebb8c0d07ce6a2

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
330KB

MD5
8efe7f4a6270f9c9bb88573ab555d5b1

SHA1
d2a0263a298bc6a6fda959fdeeafb1068d383ce6

SHA256
cce4ec05821179e6bf2f4b4f4a8c26e1903d0fc27bedb9163b10ea20c31e9541

SHA512
bd92905cd5492f3d511a8183aa53c051021e5f5bc281416cb91ccf83011a0d60aad979f8999ccf839720d598e29660e581bb34f3e25b3d63c00e159017c5831d

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
330KB

MD5
6ba026151536f5a52884e6d7fb38d288

SHA1
7b4c3b36763c5c7e0597d38955539c3307350d1f

SHA256
aa88cef4fb3cda8162a3af48fce40330091e8dca781c03216a016b0e2ea27665

SHA512
bfe649bb6a5e0313fee56e7eae3979d612b1252397d8cb04bd9dc6e2ccdb7d3fd75b626f8803801c0d1347264a4ab278b6b97010cf3131f6f6af000e7453fc9e

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
801KB

MD5
a1987950e5e9fdc4d8ad3b2c72cc90b7

SHA1
cff0bf6b9a57e9967c789948b2f1727914d067b9

SHA256
474e719fd2e576fc58daac089c7e293340d684df9402a4d54c7273172b090ed6

SHA512
029eb2fbf68d7be4b30f0fa89299d2d9dd92e4c4cc40f9944628f41ebbff9cd388b79d92b98d7f951225537eab2e5a483d72848c28b085d094bf73314ce5e8d1

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
801KB

MD5
1d2d90eebc87be9a7d9b5849aef4db29

SHA1
4c678ad01df775bde1d0e8201b859acf6ab5d225

SHA256
08bc69d8aed9d4906a2f81aa297bcda98facc649c4bb40a68da87e4f4a435532

SHA512
1de10a5e90c259e8bc51f16a0ce185bb16d0d9c5edaf926edd8ccfa98ca5f46526a744e22d24d4486f0e097be1f22cced036697d42c06b78e03ed0eacb71f00a

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
801KB

MD5
ede95e5d9f6ec810e7058b4aa381d028

SHA1
0e0d25c9801ecec2b55d066b1631ee8227b4a1fa

SHA256
aed5d1524b7437b0212c0ff8682208d3933d74cacf68e1d924ae93aef233f99b

SHA512
2405f4c1f8169bae29bef79598ac39cc4370e10e57a6723aca4c9d54535267c4703f902224a98f407de7f06c716ab2c7af290589d92ec25475f0e65bdc450231

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\ink\dicjp.dll.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
10KB

MD5
bf4ab41adf0f9bd849bcd5573a0bfb07

SHA1
7193bd840a86ea0336d66d6d318f5dfcd322406e

SHA256
da97a0fa7eabe48a6365a2f75ee724854795827f8f92f6a850ae361c6ef423aa

SHA512
b7a29e5ae74c3463688d04d68f9600450f5b84fd9814e1cca01124db5340a9c9e8d97a47235ec4be6e3015eaf54030f98610322b3ea9753e3b306ed85bc9f4db

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\ink\dicjp.dll.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
10KB

MD5
24f1372703d7c95e377375735cd4cf11

SHA1
a21b0b67f33c61e439dadcd11ac344476a9a4c94

SHA256
a7052f4e9148b4e4d032a161bebe809e2904d593d4f4ffda2ec1c8ee1a6f68f3

SHA512
ffd9d8109ccd1f2d6528d22a299df52d9d85f20ed7936d8dee5cf0ffde4fb802935be2e1b9017cb8567daba766f30ef0327da4c3671ca93f0bfa9c5fe9e11850

Download Submit
C:\Program Files (x86)\Common Files\System\wab32.dll.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
512KB

MD5
1133abf39a4179f567b9fc8e452cb6a9

SHA1
b96863787f0ca62b80d8003d07f4c4b6807e02cd

SHA256
2a94d110e5ca94f3739085492fbce9140ce81c2210ba5e61ca72c83d5a9e841f

SHA512
47cf9439c6f96789a421b78eb11147472ada321af5dfb1af85fb89f07dc2605fdb785410f66d44fa2fd614124f14db36d91f79f6f4cd179b5cde41f563d3ac19

Download Submit
C:\Program Files (x86)\Common Files\System\wab32.dll.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
726KB

MD5
b2be7282acea43e86d8c01fa9d3b4a0e

SHA1
7c228c69dd290fa4cc2a99cb17831f49750f8d7e

SHA256
3c7929d5d5d5a3a2c5ff4eaa3e1dcde46c13524939c5b7bb2f38dbdfaa27a406

SHA512
21e4fbbd2e3412d305989b4f863599baa76cdfb0f50099a875c4748a7fcafbb988f917499f3bdbb85696e9d049cc1a552453b3b337edea5e75110474bb60603d

Download Submit
C:\Program Files (x86)\Common Files\System\wab32.dll.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
726KB

MD5
61f2f38ce04c10bd92af52c19069873c

SHA1
318cc477d51db730790cc9f7ac9acb0733dcaeb0

SHA256
377f6face94bc77184781ec58630f06e8a29312c9b02a1e6ac4a702711c6b8e2

SHA512
d7be2d74eb837abe7be0797db12e9315cd0bf974b462d058d1603d11789352597d8562a8667c09211dc667a28b3cd981931043747bbad6997a67e8af8be30e6a

Download Submit
C:\Program Files (x86)\Internet Explorer\ExtExport.exe.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
44KB

MD5
58efd798b8ea8b68232adef8694c4006

SHA1
693f499392254513102ea46ebe2ce1eb4b09baab

SHA256
85087501e32aebb239b214a252a117c22a3894d8f59704b5bb5a9065c6d88e63

SHA512
4aeb75ce5b6b940713cdbfb8980b31b434267e7ea7a8085fe69273c1a054de2de86d2a9e2b8d8a2addaf29bacd60126cc677c1b4d5ce7ba40a9259cb5cf25f15

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
204KB

MD5
07ba0f5f5d8eddd7305c1f30f0bab113

SHA1
906d3f289612b1fc8381eba03971b3aefda8d756

SHA256
3e47074496f22077e068c161d04e5f654a09a626a295231042f4f38339b1c2f9

SHA512
e04b6bfc38c07879f01798d5da1d83cb6f9b7c809fb07ad306a2682020430c9ab7f540f6cd89fe0b1b5ae6448f39d01fab72d41dba1f63164f44185c5d3afef0

Download Submit
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
104KB

MD5
b646c0a29c7b9ae7a7804c056791d2bb

SHA1
0071adf8937cee38dcb5b07060f77c4860fdc850

SHA256
293c72861b30bc972677fac09553533357d75fae04811b13d042036b7c1df257

SHA512
8df80f6ff254bb7fbd9db16bbc05a25a9ed57c5fa849bdeee45e78a0bc4f86a60d0afe2ff299e3fb5dddb9f963f4a71633fbad459c8317d0457f3f61fa81cb8f

Download Submit
C:\Program Files (x86)\Windows Defender\de-DE\EppManifest.dll.mui.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
2KB

MD5
8761351b1f4baa831738e8cedec74067

SHA1
7aeea6714dc96e12cb6b544e4a8daca597a6b650

SHA256
c523f6c9832b4e2ce8fd9dcc4df10327c87f60cf500ec1cd2e0565d5a4f9b7fb

SHA512
4f035247f6af31398dc502e331359c8f17e136574c3050194ca9dc1dd6fb4de8d3597fd748ac0e11617810789ae2a72364d100b4201a3fdd1ab34e36db63c95f

Download Submit
C:\Program Files (x86)\Windows Defender\es-ES\EppManifest.dll.mui.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
3KB

MD5
ab603ca1c6f98e877cefdfa910e2ffed

SHA1
73937cbbc6e446ac6da4e3b8421a1d7aa809ab0f

SHA256
209242f70c799e94a577999f2122a77b1f50d4eb44f1fa71816905af354b1df0

SHA512
fc876e4125c877a2f33b087cb9d338fe7b95b83042d17780feefa6252e08be1b4859d730624189171a103e021bc817e95326db56bac334a26760658953bfa9b0

Download Submit
C:\Program Files (x86)\Windows Defender\fr-FR\EppManifest.dll.mui.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
3KB

MD5
4eaf84f82123cf6947e15d99bb1e7a85

SHA1
58a40a9158898c14b32e71c4a0778b51029ed6ba

SHA256
c134eae0c00809b3b6702c1db591e331c4b6aac0efeef516c007647390b5b3d6

SHA512
00b7499e31b35bf53a4a6c7ce3d0afacf45ce408f617676817f936aa38043d3ef9cd82400582104c44da52e8fb3177bc7d9781c477de1e89c0ea61590df99aa2

Download Submit
C:\Program Files (x86)\Windows Defender\it-IT\EppManifest.dll.mui.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
2KB

MD5
accc9f4d3568893335b12982aa76a6ad

SHA1
15d8107c790e4febedaf4f7a410716a960164dca

SHA256
2addb01da8fcc8677ccab70e2f6ea4d9565c50f71d2fb832b6bf39e160b08590

SHA512
9b4c967436c633f08721247fa210b0c9d468325b54d206095056f96f2eee3de99b167e77c51b06c0fffed246df5ff89cd8ae1f5f9b93ab1fcf08265c5f11b2d3

Download Submit
C:\Program Files (x86)\Windows Defender\ja-JP\EppManifest.dll.mui.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
2KB

MD5
7ab57a3a9710f856ae6b765ba6ec76f0

SHA1
f27556c9aed2bd508845246e03f6791e53813d0d

SHA256
794d4f42b4b2b5e77c7eec9929eae8ad815e0872384fc3b4d029f3799b2fb58a

SHA512
117e8ae817c2ad6ab6d3ad07bd739a28a3c2f17f69e29637de03b71d870df36d658e11f56ad9cef1c421fb953b6021a209d7a0f018eb53aa8719f7ecc3120035

Download Submit
C:\Program Files (x86)\Windows Media Player\mpvis.DLL.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
159KB

MD5
eeb24590f033099b8f4966bc79790c80

SHA1
3949326d0e4fdb722996f1601118053097044d9b

SHA256
ad1c04e39c1b518db379a9fa529fc64e341b06d320891d54961c50415d0f9e69

SHA512
2537ce3af96681cb98b026ae1c90f1671dc55269922acb6c08cbcc95574a5cc5e65ae8c6d0f7f4935abb882e659697c86c1cbc5ee05a1d3841c8bdf995408b3e

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\sqmapi.dll.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
39KB

MD5
ca6837f6be543b3cf2b12e89ab53388e

SHA1
0322d6fbdcd462cf32e14e79e5485f3d2e051ef8

SHA256
8c6009dc24693721f9d4b32d2eb8bdbedb2e53cdefe5457db4a28b015f4dea62

SHA512
62cfcd9ec93dee6e1ce06eb9653c721cbfcba6828dac781e4a8c2d6c54c465781ae9b959c77c89411cea6d451b6279b27d19ac32b1fc731b0021a99023ce38d0

Download Submit
C:\Program Files (x86)\Windows NT\TableTextService\TableTextService.dll.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
601KB

MD5
d10d7b1946d75c848c43f1bbbe48b6c0

SHA1
8a05e36711ffcf62d8a334f199a0e4bc0bc12556

SHA256
7eeec9d532fee59189cd23e53260ee52dba84542fb52000cc10da35d7ca2e062

SHA512
53e879471a881d1d89b2dd6e38e6b5d18450a7b9e415d52c2fe668dc8d6d55813ec0305c5385bb316b7a2d5ec29937cc78da877884bc5b47446e713e4db8ca24

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.url.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
208B

MD5
5c35a0dfdf7d7f91aed8be34f3c9e2ac

SHA1
80c9c448a70d64809f467c4a64c4b8a127612034

SHA256
4e3feaaf4906ab6ca1700c8db5f83b6c3e6942262259d5e75ac3df467df6d7b7

SHA512
baf01dc9b4a33619c5264c39a3327a787e7dbb8c65458739e1fa2037cb15ed93380aa57455a3d05439b68c9ce28cd03e81c6029f7e84a851347fd9f99353a6d2

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.url.1318CD7EB05F58C01EB4EBC47B15A30CAEB943D80FFA891C5686C2862F0AA6F8

Filesize
192B

MD5
9c53bc3bd4be9f628d918326b2373055

SHA1
c9ffd2cef1d2f2767d5e555ccdb9e90a04a92bc1

SHA256
e026f65c58d3491efca6b49115efebd949e7107ddf1ceee2b87ad41c17dd8d37

SHA512
c7f9a99e7239bd617323ac186307a9e1652aae70303623497da3bdaa14c31c9152dc80fb698220beef005c6ebeee35c4aa812cecf197fe5d6a3404561fb299ac

Download Submit
C:\Users\Admin\AppData\Local\!WannaDecryptor!.exe.lnk

Filesize
590B

MD5
980d0b41c24d4142d6ad3594b08ea33e

SHA1
a45cb5e23f0acc6baa2e270d07098fb992a08f9f

SHA256
27133ec51e01f77a67a7c102d4181da9709cce0ca4035deb1e7bad03e31bf0ea

SHA512
b434f6eb539d6c396157260ed76cf0bc0a75f238a6de433bd7ee19da39e83d623a702bb558257d687c48de794f0d74901e7e4a5d73caec79db68edc8617051b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc29044ff79dd25458f32c381dc676af

SHA1
f4657c0bee9b865607ec3686b8d4f5d4c2c61cd7

SHA256
efe711204437661603d6e59765aba1654678f2093075c1eb2340dc5e80a1140f

SHA512
3d484f755d88c0485195b247230edb79c07cc0941dedbf2f34738ae4f80ba90595f5094c449b213c0c871ade6aff0a14d4acfe843186e2421ccbad221d34bf54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
709e5bc1c62a5aa20abcf92d1a3ae51c

SHA1
71c8b6688cd83f8ba088d3d44d851c19ee9ccff6

SHA256
aa718e97104d2a4c68a9dad4aae806a22060702177f836403094f7ca7f0f8d4e

SHA512
b9fc809fbb95b29336e5102382295d71235b0e3a54828b40380958a7feaf27c6407461765680e1f61d88e2692e912f8ec677a66ff965854bea6afae69d99cf24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
48KB

MD5
df1d27ed34798e62c1b48fb4d5aa4904

SHA1
2e1052b9d649a404cbf8152c47b85c6bc5edc0c9

SHA256
c344508bd16c376f827cf568ef936ad2517174d72bf7154f8b781a621250cc86

SHA512
411311be9bfdf7a890adc15fe89e6f363bc083a186bb9bcb02be13afb60df7ebb545d484c597b5eecdbfb2f86cd246c21678209aa61be3631f983c60e5d5ca94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
25KB

MD5
e580283a2015072bac6b880355fe117e

SHA1
0c0f3ca89e1a9da80cd5f536130ce5da3ad64bfe

SHA256
be8b1b612f207b673b1b031a7c67f8e2421d57a305bebf11d94f1c6e47d569ee

SHA512
65903ba8657d145cc3bbe37f5688b803ee03dd8ff8da23b587f64acaa793eaea52fcb6e8c0ec5032e0e3a2faacc917406ada179706182ce757d1c02979986dd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
160KB

MD5
1ca6c3703115d9e04cc9e4e9f0c759e2

SHA1
dd2a95a88cd35d9417cad8d17c9b78dab3cf22bf

SHA256
73491deb6ba59a67719edb1b19bb52027b23c728b3760231377b1af212a89391

SHA512
e81ccda09b16bbd5314dbaca238d8773b35d3473c0f7df1fb87794fe55e739017c5f0f355ebe02676fd601c506979fd462f40140dc09502820aed829d9894184

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
38KB

MD5
adf2df4a8072227a229a3f8cf81dc9df

SHA1
48b588df27e0a83fa3c56d97d68700170a58bd36

SHA256
2fd56ac4d62fec83843c83054e5548834a19001c077cdb224901237f2e2c0e4c

SHA512
d18ffc9a41157ea96014a503640b3a2a3931f578293e88cc05aa61c8223221d948c05637875d8e3ee5847b6a99341ea22b6a1aee67c170e27bde5e154cf1b9ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
76KB

MD5
3a2231bebabbd5a167c00cd56e045fa2

SHA1
b6ae6dcfe84f34c76b1fd20cb8223c5f86c44f10

SHA256
d32de23e0b9c1cc0161a0515fb324bfbcc38b3f3b5197926b04ed796556bda8d

SHA512
095557a685b35bc9bb971524950446f1918cbef5ba64a7b8165b6d78d7b4a858ed86b5bf741dfdb2ad3c622360232d88f5327f338161083976747d93855641b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
37KB

MD5
9fc4f3c0ec97d39f8a936972c9caed48

SHA1
a9546ee2354cdff39f10fb32cc9495745c14a875

SHA256
9e86376f729620fd1970d3931cba62626108e41f6962e6b84a13bd8c0bd641b5

SHA512
6e1cd676423da9bc7aa523ab56b45f0343721bcd859fb0e7b0061ff940f27a5db6119e5dde37d397e189177ab80444d38091a31d0e6c354840d083bf1bbf8445

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
20KB

MD5
d8e280973cc708c5ab15f393bc63396a

SHA1
e5ed496d8bcd7b16832c2412f5610de426529ce8

SHA256
95498d8a14b76949c4c3adc70aa7e5583e2f57ad2c0a49e6b631aff2d9a3cd06

SHA512
7b62d75d904710845244f8707e7e15f3f98dac46a2dea848c69080d2bc24d137ea136f3b03c22605cc46e66e3ef40c8562f19a0a2002379c5012111f767ce773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
21KB

MD5
d141a6f6f1f714737b9121b00fc34f8c

SHA1
a151b8ae9b99e23d2a264e97f38e0fcce2e9ba4b

SHA256
e83fabb2fb694dcd82143d1f67e23b46caf85a50fef6c178d9ea38a0809f4e3c

SHA512
b2d7a92848a9aefb245783ea0d142d3fe987b551eaee0e37f68070775dfc35866c295702da092fbf266a273755036228f26cf6090414e2325fdc2d06047e5f13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
18KB

MD5
8bd66dfc42a1353c5e996cd88dc1501f

SHA1
dc779a25ab37913f3198eb6f8c4d89e2a05635a6

SHA256
ef8772f5b2cf54057e1cfb7cb2e61f09cbd20db5ee307133caf517831a5df839

SHA512
203a46b2d09da788614b86480d81769011c7d42e833fa33a19e99c86a987a3bd8755b89906b9fd0497a80a5cf27f1c5e795a66fe3d1c4a921667ec745ccf22f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
26KB

MD5
525579bebb76f28a5731e8606e80014c

SHA1
73b822370d96e8420a4cdeef1c40ed78a847d8b4

SHA256
f38998984e6b19271846322441f439e231836622e746a2f6577a8848e5eed503

SHA512
18219147fca7306220b6e8231ff85ebeb409c5cc512adff65c04437d0f99582751ccb24b531bbedf21f981c6955c044074a4405702c3a4fae3b9bf435018cc1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
18KB

MD5
8eb86590ca5b589e6d3f5e70463e320b

SHA1
0ea23b0afdb96b7841dcdc3ae7b670603cccbd4d

SHA256
fa6110d56d214ae00a4c1b32499ada72a82777f59bc7b5e8cb4851a9d2ef56e4

SHA512
aab24f0b1a810de82251a11d6f22a593354c09387b3667185e6caa726b414885a3bd4f1bfec7166bf63d9e092184f5a6fefabfc9edf1e4b849f57699e20ad9f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
59KB

MD5
25b3d7b6beb44eb20ffd065656c15e1d

SHA1
59301a1a36a144715b51bdccde1eb2a328f7efd3

SHA256
00a88a411e1a1ba98f55fae99469271160c23d87b1f71f90f31a7810f063db9d

SHA512
8c71c4b268832f016dc20f68611abe976294421217f7834b5d409b53b0f0b137231c9364eaa84eb1afb05fbb121a0ebd263e52ba60cda157ae892219b462e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
43KB

MD5
1cc2aeaf7da6412e12e4ecc5256a6759

SHA1
ba8983ace5bb0cd1c5cb50f699e3b2eb3e2cc5fc

SHA256
4dc7000962d23e9afc639dbaf869962b54ee85927f933f30bb33d3b71a0ffb53

SHA512
539e0773e7c115e35a37202802842e3d7244a5032a6b3c3ee024c346b9b239e68fad257e5a0c664799260d586208daa2d174e0dea66df5bbb649fca1dd00ecba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
55KB

MD5
c649e6cc75cd77864686cfd918842a19

SHA1
86ee00041481009c794cd3ae0e8784df6432e5ec

SHA256
f451a4a37826390ab4ea966706292ee7dd41039d1bedc882cbc8392734535393

SHA512
e9e779870071fe309bbde9b6a278d9627c7f2402b55ac4c0a48c65b1de5172cf9dad2992f8619d7e7aaf978e6ccd607620de88554aa963f3d45501913ed49f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
16KB

MD5
dde035d148d344c412bd7ba8016cf9c6

SHA1
fb923138d1cde1f7876d03ca9d30d1accbcf6f34

SHA256
bcff459088f46809fba3c1d46ee97b79675c44f589293d1d661192cf41c05da9

SHA512
87843b8eb37be13e746eb05583441cb4a6e16c3d199788c457672e29fdadc501fc25245095b73cf7712e611f5ff40b37e27fca5ec3fa9eb26d94c546af8b2bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
87KB

MD5
65b0f915e780d51aa0bca6313a034f32

SHA1
3dd3659cfd5d3fe3adc95e447a0d23c214a3f580

SHA256
27f0d8282b7347ae6cd6d5a980d70020b68cace0fbe53ad32048f314a86d4f16

SHA512
e5af841fd4266710d181a114a10585428c1572eb0cd4538be765f9f76019a1f3ea20e594a7ee384d219a30a1d958c482f5b1920551235941eec1bcacd01e4b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
108KB

MD5
d78913ec94c74c8f7b9917ea8d8e7c5f

SHA1
b75dc5cf1fbcd90c59adaeb0a66bed203fa17a46

SHA256
0fc8cd712751d7f0704be9138524456fb825a6beb4f13e08ff5feec14b482d86

SHA512
d17d858361f6e763c2b473fd1271a1cc605d546e456e428f90e0bfd649ba3da38c7097953064fc4e03b5349b4c8804b84fb2425cf4a62b9950e7be9f1bab123d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
23KB

MD5
222b32e64db1f6ba646aef52df6275d0

SHA1
e5df12bf81036b65bea6321a6650b4dfdef29850

SHA256
58d2c2be5d79b3f4907def3e2a01ba780f0667d56856abc3064e6a99fae3bfd4

SHA512
8e1e121b239b003942eecfa6953a22ee6dd5b525eb85971dcd12bef89bdf908d81bf1421690b80c2138f39a3e1476001ad7da665b0880037cc9ed73938512873

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
16KB

MD5
686cd4e029335cb803ea8b47ea727bd5

SHA1
acb03acb24c943d81a8e4822466201cc4114692c

SHA256
785ffc242cb18f8e9ccb9ab96c37df3cdf1612a38a325a2a9bcf8164eac6488d

SHA512
a54e055ca8e021757102aa6c7f9045959fa32a7db215595cda8419ac96f75f44e1f5846037e14b6a20d0db51c4b1e974aff1718e16ff5d7650e0b667ca09721c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\03eef0e77feb64d4_0

Filesize
6KB

MD5
9c782689e9638fc01411ddf10fcb6600

SHA1
944436b7ad6f42da89364770ef0e7accf398bf71

SHA256
370fe8816570e0d1c163ee975fd069471c81fc635e7cf5fb204be8962db4107f

SHA512
667385c947f807880c0f4228786c324e6e30736157306eace3f1feb1abe319fae720e2c3ac032d3ee75e13cc4e8c1919ecd97f77a6ce6059574c67e5370da297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0bbe00d9bf7b798e_0

Filesize
5KB

MD5
d92a4c5b957e1308808595a45f2c1f18

SHA1
1d78b583de3406d2ac3b7038b5b809f1d53500c6

SHA256
c29c9e08e86975404b8f4155debb689b1b6fcf62838ec6b371981eead6483249

SHA512
76097c8656799c2b47679b710156fc3838a96a8a46ca32829cc131ae7ac0e7e7f30fe6e58c3bb673c519096a1eb31eb2bc5f9d44ba8536ce303e705dd8170467

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\14ff8116b518ca2d_0

Filesize
2KB

MD5
ae5bf7f46017bd473d7fb55e9ef8e765

SHA1
cd09c2fefdc8f43d45e273f7795daa10402799bc

SHA256
d279fad84e9d14f9438ee4d1961a9059769b0bfa5b9a27438c2955d738c3d35e

SHA512
99c60a67ad53af7485035a5b77a3250c4dd17ff94960006cc1d645293a1c72617c4c22393f018ec5c82d258f992bf4d59eac9edc87d6a68c774fdd4935ab6271

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\163cfbbbd670a71e_0

Filesize
4KB

MD5
3b1ea76ca2d946a0d682634312062a8d

SHA1
127f2405588724156f55608aff2774154b8da5cf

SHA256
0f2a81d0956509e6eb088de38bef7583b0bd6fed6811e3ab1b7249275108cecd

SHA512
e35b5443b6cc4831d11949fe5e21fe77da8b9b9224b7f6de6e32aefd96134b3ef9247c794310e84fa3c1d024ca22c607fbccb869757a88b26e431f8e6cd8b6ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1a914eb5fc51fb84_0

Filesize
9KB

MD5
a7e2bf1b9bbbf3bd600e49477aacf9ee

SHA1
c767f5ee03ff144bd681b51ae4401bf6a105b413

SHA256
abe22ab10e2da1e68eedbf972d4ae8d7adcc0617bc93d1da111c35df9f9ed697

SHA512
25f73b68ff9fbffe2a271c3b4113961ea55ae196e3ae8977f000eea8ee00dd4bc447e74e978b5dfa76fd1fb418791a2d1f77ac05d004089de15cb8d9dfff1fc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1e3673adaeed829c_0

Filesize
12KB

MD5
95574a55404bf9fc0f0efa35052abea6

SHA1
cd23798544252b038a7a28f6f2ceb2ec3460a391

SHA256
56bb87de261579906ed7d4fc9c947128c7b72c0c13cb4441550f72da46c8b6be

SHA512
ad130e0a2cc763dd1c9e21743a5236afbced807ac213ae9f6967643003100010ead43fe24606b0773d19ebfd821b2a53a2d81f307b3d9494fd45af7f373878cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\20ca2cc867212551_0

Filesize
294B

MD5
7fcc7ae51431d718f8db010e9b93ed8b

SHA1
2841a599fa7eaa229359e6553330bf014b53a860

SHA256
11d4660478a5efada822ed092b464a7f8365c953d172759e63fd807577bf4a2f

SHA512
4734d7212ab5bdadfaf9e1284d3d9fa6af12502b23285cfcab0838d399cf8a4b72bade04ea9ef74970cd36d7070d55896cd44171d90ca7319cf7f5ff2a126a35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\242d87fe25e8b258_0

Filesize
2KB

MD5
d7c3cb03ac0240dd892c432888c5e79b

SHA1
b1179c557e970f349864f33d3622ad36a40cf478

SHA256
529ba872349251fc6caa4e9a727a3f9e815f8af7610fabe47e17dcb474881320

SHA512
8469e0c1e3b357dfcd04542b566a73c67adcdfdfa5d391748d9f59eb6b9682e3d2333391180c68244f167d7210245f4eb7bbbdfd2ac3b01c981a82bbe01f4815

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0

Filesize
1KB

MD5
5a5767158dc22dd4b4d94e8dc8951495

SHA1
80b61507419b8f96fcf5e1a94d94e65bcffa8d2d

SHA256
4443dfc41c2363b8c8e5ad1339308b1f226e63872561faed9fc966a58cb372c6

SHA512
6aa6881e2fd23327caabf4b79e08845958b13426eab2120850f1279498cf2b48c66b34cfac336d345bd6aa0921e9f6ae3c54bc9dd221c3d47ebec4223aba385a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2692617678c042d9_0

Filesize
10KB

MD5
9e7ba89b4d774d6ab483a75965906e8e

SHA1
b52f7f1bf1c5bfc7cdc0f4555e6db3e040e8df54

SHA256
fb8cef764d9196e90e0cf09e8b7c02fe4b184cb262a19dbc101733a711dad6d1

SHA512
205e02a739e8e483781843db28ee6cfbe34b48a31874676053b2dd808e570e1815b91fe37210c0eae4836aa4e4b09525d1b500d8bb99a7d4c6b23960672cf9b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\37afe38eb817b647_0

Filesize
38KB

MD5
66e4b247ddeb96883ee989d4df81df25

SHA1
53664e5753d8ab516c4b317fb04b5e5e6188c8e6

SHA256
7d7a0e3e5e82528153eba1452fc89f8d4c297e5d03ae392e89f4966669add8ed

SHA512
dff075b71c59ce4c53ba6420d46596c44dc4979f2732512478595a9a3169321aff14001d6d69c69a6a94eca55f51dfb7993c0767816d754d3eac0020d7545497

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3a4259a0181983ba_0

Filesize
6KB

MD5
2928a90cad27e87bc14de477e16016d3

SHA1
85af8f0a2a3d0bcd7affe5174f80401b31285314

SHA256
973c784e862980b02addfe3d80bb2950318c3bc6eb2f1c3b7d786d592a15bb52

SHA512
a5a916e38160c98b541a1eb28e656bb971e55aac5de05c0b43578c9409b5dd759e3790ca2ff020a2efa29b2bc4c91cbfdabd18bda80d2c592693b0e477c75a41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4038e9c1c0e5a02e_0

Filesize
4KB

MD5
70feb1d205eebddba8c383156972efd3

SHA1
8e5f3e41bc587b3136d77ed0238362222fa5ad66

SHA256
1df7f0e832aee202e7a6fbe39481e4199a930880b63dcea30fbf19e3586822fb

SHA512
2dea04ffd89a9313da330de527075ab04453bce4be77779818702ca08d6f240a0549b20086ece247aea34157cc79182615c6f74f6e1e71da5069449a343efae8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\447fe4d5b313c1e2_0

Filesize
1KB

MD5
4b42c9186d7bb37235510a8e1eabee39

SHA1
0ff4fcd7ffc30594d6a65b98dbc151726cae3eb5

SHA256
9c708e8311d635824f4d7b108da8681de9807a8f07a3c154b6b425ffa93a14b8

SHA512
b6ed429712b2489dc6ad267fd5d474399ec4d0a6fc2e8b74115ea44393a4a23b9a63065323dbfa4c8fa869809038fad72cf773a19717da33bd13ee92d6e649c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

Filesize
1KB

MD5
dc51982a3ac7e399aaaa0cd9804a4bae

SHA1
a25f499313f03e0d92c1d98690a598454bd504db

SHA256
9942676fb30a47001786b9e6e4141d53b284ce32aa00d88f98d2aab67643f3e9

SHA512
f9d45c550e3c2e73bc43030fc4241ef17c232cf004f5df1d7b05fbc1a6eb9f469d349527d6b65ac9c48a62b1ab47e29569a3aa4fce9df3af08b64d0a6fb73ca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4e9b18b0f66a7183_0

Filesize
1KB

MD5
1aede320238a86ba7e70e269cd60c797

SHA1
7324188964796b16a0f0f12fce12deeb5daaabc8

SHA256
fbdbc6876e2f0e57200940a2c42024680fd91a49bbd9b2b7a938744ced7e998f

SHA512
82bd2a6ed1cfa76109ed871bbd4676c9a194e1e77d8d8192680c0a42f4a941da6ec59a3335245b27820f152d08e8a50f5cef01f2be48f5be4d54361487f78d10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4ff4b179c1c05fed_0

Filesize
3KB

MD5
62b4a943c3c2375acedfcb856a0263a3

SHA1
c9d2ff3a1a8aa19e5215f5dbb256834a16c35fe9

SHA256
cd7b5358359c1da00e61de6a5d31f576636666f8bae24fd7555a398a879b9c0e

SHA512
ead519072299452da3c7082685a5e02265d0a04c830ec5ee548d71318c3e7fcd4467343a2bfa03d6b7e15c747c63b5073c57d08fc5d47aaa54761729f00cc6d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ac5abc87e80789_0

Filesize
3KB

MD5
8d7b4b658378b1f3964b45c5419a6bac

SHA1
e0ab2290fec21691fb85e1652e926b97b17a5c93

SHA256
ae3b256a841e933eaf32d8ae5380fbb7da1593a91c176432579d4d90eac440be

SHA512
db6443c294c8ea737618cf94c2e7037c80ea6d54ae35ed778b955b6b072d3d8207f6a268204126ed945456e1f473d83a6d9a9995b473e20019c1ab98fde6a8dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\55d1a302ab2e2689_0

Filesize
14KB

MD5
59c4710cf3ebaa8198b761fe96229479

SHA1
6062d3ccb22a9d7084d926c56e228b1b1dee298b

SHA256
f6686e1a1d32f4041989e439f2166614bae166a8ed345981688d7cd9d72fecab

SHA512
83a965a9537832c428ab142b0cd6942d8f71af0136c404b399d2020d1c0bf3c66bf162245f7944bcdd413b19970d146ed6a083c8d64e7235d0e3b5c1004b15ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\56215a7167502ebb_0

Filesize
2KB

MD5
aeb1b6615373009b846fb2c9146eca03

SHA1
0e24c071fa8445f23656ad3de34db29deecdaf95

SHA256
c128d66557eb8ccc0d82ad02fe969ac33f8c0f854fa1a5b4ebc39a59aab5b422

SHA512
a7d88705352b53964a73aaab90adea44e0a3cc833d843bb7adce94365707f82e842e942c78c5c1dc6d4a735eccaed6c747286932f695ca15fe3b02eed8c18ba3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5dd1e579c9681f95_0

Filesize
2KB

MD5
4e3c5212b1504a725032c2b6eaa89a80

SHA1
70051e7475f8a1752909345ac45d005cc4a8e811

SHA256
ba79c0e9bf92fbdb5335f7ae066bf3567f707395f4cc5975c81eb027997289af

SHA512
7aa848a58c6ed45576c85e6e15b36e5e35dceffd825477ab6c6bfe59291f2999f92ce576e3858906df335c6420cea55a0a1204d867db423d001fbf3287e5a68d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\61a0b4d20ae0e222_0

Filesize
14KB

MD5
2c56ee87f79106ab63dfc5a51bdf9857

SHA1
862cdb19f4f2f114bfeb78e0d497f6b18d3e4d7c

SHA256
28c6f3e306f6160c3a84b8b3beac0ae8f53e5a1d78ebbfaedbb39d7e82309b6c

SHA512
5b2e38341b6a9378decebad856b2667e4b19bf612169a29dacb5c6bcbfdff41ec5748edbe15359b9863241c13c9a866cacd15dfe8a5dfb46f05b396c9c19f489

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\624c9bd517fc9c91_0

Filesize
1KB

MD5
92313c86a56f67897968335707d61448

SHA1
1c92022e094d32d7120ffdc50ba2cfae585eb199

SHA256
77019298d21877517c7e440db410fd1665529c9dfa2e9f52b12b5d92dca8d84d

SHA512
4c8ab109c257b3ae1560ffacc1e66e100a6ac4f6f663509ab1c0d47312ca3aeda6dd78e24c27c5789528d87861ceb0da49e8e300f27095a6b9acbabf571e3685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\635e64b37935c888_0

Filesize
1KB

MD5
7e027c3c5f77edfe5747c74e1a27cc73

SHA1
1a1331973bc92549605f3804a62427759cd68e6a

SHA256
a2b3ec6e70bc35545346b6007b341cc507ff0a1e5244c4f737b5b31b6c3d1373

SHA512
aeb15b472447971b191146e256c29e093a904513c8d4984c0ea94e415b307f30d6b7dc29ac8c16d72b674c672599ad4aa8c1c68a671d350bd22df6adaf0240af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6694ab02863c6848_0

Filesize
113KB

MD5
3212b15fa84831086906a19e1b781346

SHA1
6f440dc6f6e4781798585ea4cfcfd282bbdf11aa

SHA256
84f869cc0fe4cc98915e58126bda23f4aad14b5130dc7f67dc2353d126db5f86

SHA512
ee35e84cff144f0346bd50cf1458f9b864ae382124f16e4dbd957b77f580826a68ba3d842630578e24074b91b6409a14a1938fd2e00c2a3d1acf4dfadcfe3b74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6a5e8bb53a565b9f_0

Filesize
3KB

MD5
e42fc1512b22ccc59ccae6fab5d0b16d

SHA1
4127be676c696b8a1baa791dbb8706554cb5ef4c

SHA256
62b594614b10b5129bdcb40ef1e09696f1fe4269ae93924e8ede1710d3952c81

SHA512
a3c63adfc9f2695b9edcc20ffbe23a758a3186cfc76f40a45e3fb09fdf91160f5ab42b565c2af2034431d53943e15e3f8e25a06a21752cf1dd0a18f6e99ed7fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6aa9a2943612cce1_0

Filesize
3KB

MD5
068e19df9e57860b8881196296f45ab5

SHA1
8e03e6d955c2e2e1a178aa2656bc60e35aba8560

SHA256
1296927d674006fdd5d9ef7235802cb35d71ff3a1122fa552197b9115a6d80e4

SHA512
0d8fc795ed9ffd34de87c2bc57bc6c23bf506107fc1ef287f8115843688afc428871237297baa0b42a3923fde8e019e7e9b170c194c0daaaa7f1af16df72d1cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6db290dce274a012_0

Filesize
4KB

MD5
19e6f0037ec3ca5f930c27539a2093e0

SHA1
5aba368af922057edd12266a05d5da1f840f149d

SHA256
378cd851b1db9086d5f2ce9bba12756d47fc66212c0e36dd0cb236ab6352b223

SHA512
c7cc7191476effdc9db6280d0f4e490b43124035d6c3d7567b69ef15cd23e71577f0cbd457d31dc377eb4e8b1c50a8eab9b06e76e73650bdee838939341409fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\71d68e68ea4089fe_0

Filesize
5KB

MD5
52bbc99d31b29dbfb425663f678229fe

SHA1
39e77582696d7b7cca7c04a75262377ecc24da0d

SHA256
c90c67f7bf8ce8d4e2ca0706c28a0b1600a88c3f9d3f9059b689507fc1150563

SHA512
e7d6b6d5ee29cdba1dfcaa45f42f6db7cdf1d1a1284ccc0154989540a174a26903f62be6356876c76d3168459f7d0592c27dbd3d0060df1b1b74d9dce458238e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74b88724f60b0383_0

Filesize
2KB

MD5
0104e9d06e13d4f547e4646c3085c7ec

SHA1
67d9ba388f82bf4b4a4cf2290f8e4ad6b0adbb1d

SHA256
b6bc5d82d19c42ee9e8fca6aca93aaaca7a076182bd6246df7c353b1e13c8ec0

SHA512
85c490b678fd7160941a1e7583c0a6532a8f567ff5c83075b5923c16e5cbcdfdcb62d0b5d25d28e9a015763f63269b81f0d84a81632b384a4b3e353be8c5e063

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\766094f4b47e839c_0

Filesize
9KB

MD5
d8a26482a87f9771a6e3a78a1effd9af

SHA1
9b6c0a3de0c0e4452d5043fd8a1219d9ba1144a6

SHA256
7fc652fcac6e0d067d795e5c2a7ca87fbc7ac9ef6183f541146b042b17727f8d

SHA512
034b7a4c13a88369ae488cc56c3c5bffe98316698951898c7141e941ef1668883177a29e81b0c13142bf09dd702d37d1a2b5457efbe6a1d83f03230cd2557616

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\78bc646c0524ce58_0

Filesize
2KB

MD5
37402e33d37f01f27f8935b99f329802

SHA1
37a8a4806dc49ae895e4b02ed623f8a58d1d8bd4

SHA256
60ebb3c22a42daaea452243d6d6adf802584261b6e41e70967e1ec1a1b64807b

SHA512
651dcd9b1c35eae681641d295b39aa8868470027663a0ae17490954380e4b2ec187cb75a34ecf7a9f3e4a1c600ffd3e79dac86eabf7660cf09d93404af853b73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7cf9843337c39c04_0

Filesize
1KB

MD5
428acbbf742e8c3042cd6d926476f5eb

SHA1
5f0954a93711d5cdc3f1eb08afcd8752ed0bf089

SHA256
f9e08db5f8363b6e14578d11cb28465a3d0a310a1977360ebd20b32bdf5e1cce

SHA512
e312b02955962ecc5d7e5139c83e7f947748fe0eb8bcd47fbdc7d448f667539de6f61064e645b038a87fe5fd77c6ba9151bd966aeea99f25424d3622934e2865

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\82af833e9b5cc26e_0

Filesize
2KB

MD5
5627a4d1572742d34395b446f0d4601e

SHA1
03c918a74337a6d1cca0bb9e6c4f42e12f5f5a9f

SHA256
f1c9838dfb2ba6ae9776d91a97ac4e362499e300c3d546b703090aeaa31cbe16

SHA512
4e791f88e264035dcfe59d4eba8a3b9a6f78c4f538cffc23c61161686e47d70876aa45a5127c60b7f36de795060cba3775f999c758474908c8f183a37e1bf6d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\86b9cbd77d05d034_0

Filesize
9KB

MD5
6c201e8f25d0f156086b2b18f0d59e7a

SHA1
19f78fd49a5635de7bce9b245ac580e5686def95

SHA256
bc4d2896ae201d94b2cff32f9a044c6b7d514220eb324bafbae07135edacb20a

SHA512
a7bb99a0cf142e5ed77eed289b215ddf27d95fe9533a59e8021208ce06ca23645d11d9cb5ba06e80fb43989104eddd0993deea32523017a79d76da634e875d68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8e5987d08f7b6e11_0

Filesize
1KB

MD5
894aec290182c30af2934c60e58c7c44

SHA1
d190711c4b507ce3005655c0e5a7a5686e2738bc

SHA256
3b8febb0afcb5278d21f746faa3df09a2816cc201a5ce679383631b530aa5131

SHA512
b67697334dd2c2fdac88ac9db7a8f28efb2ce961d0583d7b47aa1d2fd90f77e4efbc09db9b9380c7540ee7ba64cbbd4081ce4790729001269be3432a63d51e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\90d7d7591a1b39bb_0

Filesize
262B

MD5
1c4c5cdf7687758d8333a242d85bdc75

SHA1
7c53c501d33a03e91396340cdbdc0928661a8d8d

SHA256
cdaeb66f3616462a3ccbe1390834eaf9f18877e2ce284936bafa992ab7c64bfb

SHA512
ce59250cc16b71c9898f1b38a3dcb4678605eacdeeb980595e9dee8d4162aef2a76f7ab872c2ebe4cb1b8f51302b6d9d78e2dbd13f4170e1ea65411a15db7ff2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\96bc766215a93e35_0

Filesize
3KB

MD5
04a17e65d11b36c58232521b2de3bfc8

SHA1
28ddad504deee63b10efbe48ac6156bafbc4c30c

SHA256
ef8ff8570b8acac951177aeadd94e708f648f1998cda3a619cebcc9177460990

SHA512
87efddf0648ca3b8e1091074a6ba72423778dc088e57247d6a012d55a73d90cd6b1e5a508c7f02e9b9501f878345a1c606f9523b4cf61df4414d49a1fcf35281

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9dbb949d27873cbc_0

Filesize
2KB

MD5
6cbd051f9fdb5693fe9dd603fff6563e

SHA1
c269e6da40c4f7841d9244116016f324c44cca2a

SHA256
dd4db481ba7cc777be0db1a3cfa126e1b04e019e5cc47079813c7c961cd87044

SHA512
53d7b4a485a64db3a54fd4ab8ae549aafbe7a60e87148b7cf4326f1dced8f438deaa8d8e2e655c9a34ada7a4d654f4cd4ce7dcd5193dc684bf1bede19360d76b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9f608f61e011c420_0

Filesize
3KB

MD5
2f63b411fc136deeb2cc363f1aa32183

SHA1
d417a722f1854981eb8fd1a50010c143fd17e62c

SHA256
16967dacfc165ffb24327900329cb2e63a357cccec90e0b7aae9ba09ac7504b3

SHA512
76cb287c72a587fe7331a3d26905556d0b5c506cb8d85cc4c95812859c4e8b0fc4e2e4decc11050521e1663b9ee7373c9b5ed166437e9e5df763377704b0a64d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a28b766f2e67bd61_0

Filesize
11KB

MD5
b97ea033bcd372d24d4e6a2313e91107

SHA1
5a28c7da4bc443a270bb0568d4355435219ecd91

SHA256
0c668513b2f1728922c231b035b8bb4e125074cd9bd72fc204516e377dd2171a

SHA512
b2180d6aeb236163fb6d691e0456d850ec2627f30ee50bb039c23edb1ead948e99f4dc196a9998ed31b37bdc2b9d30ed107fe27f1c75200fbd9455fa3ccaa5f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ab38c7b2c8042af4_0

Filesize
20KB

MD5
fca19da042c7878946f5e1e59fb76cae

SHA1
a17053503cb86e9ab5ad9da523f8e5dc5d0bfec6

SHA256
35f6c267085d0a01700f08b7b49525098c75173668a5b016b8646e260a343f94

SHA512
b144fbc310f912ba2e73203aa2d7c569106cb83d7a7021369805ef31d61e89981e12a57da09b63d48f35ab8e1f4feef5ae1d3d8963fd7d035cd07da18401eecb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\af2cfcaf6d9b18bc_0

Filesize
3KB

MD5
ed8fd84558f5491f1e6db720d7de5b30

SHA1
6e43105d6d4cdcc58c126eb5f35c2d611aa78430

SHA256
1b694cc137371c2764eedb1bc9dfe8d5ebcefd3d235776af9c80eb2adfa419f2

SHA512
eb35f0ea4e285429d4e5656a8229524e9bcd35057032fafe6dfeef65a7124e2485b4e2b301e469d48a74cd209bf6ec596adfdfcba178bac74cc00d44c08e0f1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b4b3be2a7e68cab0_0

Filesize
2KB

MD5
66d21c51648534f2cb372788f4a733fe

SHA1
5f7709c401bdbdc852f1c378b440c79afdde61e5

SHA256
42e19b95556f1cce4067b37d23a796425a1a6966e9069732953e9be67fcd74df

SHA512
1cc27dac1224208f11b7ff98659ddc729f1936eb4051fc5d6032ea996b856800c311df2b1440ca533f0e2e0d676af2fb8bb5e6dacc1ffb6f5fdc6c572214856a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bae5a029e187b19b_0

Filesize
289KB

MD5
212d302eefc98eff52f4489f725db8e4

SHA1
db4c46c3ac86dde243b6f2245f16843c14cdeb47

SHA256
b0c39db2941b0990d25bedc2d3634981c394170024436c54b7c4bf15c4eea9fd

SHA512
f59458085cefb870e81596abe036a3cf487c446337dec500989140381592b2ed60a2572f021f70d7b20c3d711e8023f02034bf3dfe6526836acf077e82bb932b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be6d12311ce2b399_0

Filesize
2KB

MD5
357862e8196f828bd5c5098f69c1f328

SHA1
868d0961be0165a34f1e921a83ea5a0729f4c3ad

SHA256
b7f711ab82f8d86bc1b67950d9c3b8d948db87d867f18bb29e0420c775449624

SHA512
766b9f42d161a4c00a9ed1987c0e77d3a02578b176d177b5e15dab6943771d2f2349f6eae8c225fd35feacfcb17fe9a1f32f4eaa06d0c1d8b3a12902a9d2c3f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c0d1825e36e4f904_0

Filesize
42KB

MD5
bfd7acd1af8298d0bebf7465d92b0607

SHA1
b68770782e8581101834119fc4e0de309c8db588

SHA256
996c8156f12ad3cc55e5a995e615210911d797c17d5426f268e338f031b46889

SHA512
b37a22058ccf72adcbf97c18cdf4cf8bab13df60cc59d02aee63405fc11be51d6ae76938232bfbd129fb633965ff8b6c0344e12cb5c71f63ebdbb73a89f60543

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c211c9dc68f4bf01_0

Filesize
5KB

MD5
4a5ec4cdf7e95d0d739bfe552ced59db

SHA1
e68fe3a48cbcb20c6bc75d5b0b2639edec63fff1

SHA256
81c5d2052a0830d2e8f158e2d473d720552117c3d5a7ca372ba88dd2489fe1a4

SHA512
e62b802e98a05c2d1163f021023d9414ad44adf149d194ed6a74debc770cca6dcb68cf69952d0a5d7e1709c2ca473f84919d1771da4bbea66ce7489ad3562e07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cd9a47d844308cbb_0

Filesize
6KB

MD5
c4352baabdfb16408b4caedc6ac89da7

SHA1
355a9dba9b8cf2e92da8147e8568ccf6c3f10ccf

SHA256
c45f8209e120cec25771d27f4263cc57d61f92a7c451d7799a24b5d6740b2c12

SHA512
84d3ce07705fb75cbb66cbac739bde3e610aa348171a757fe7c945c084b9982ccb0a6111462a43e75cd36ecaed2faf5dff60569fdd151d398b18ee1759ff9616

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ce003bafb7f85a78_0

Filesize
262B

MD5
68e9e7c5e1245976ab9d4e67d12e31ba

SHA1
d59da18fbe5a9cc8627cc7f12e74854cbf9f24ad

SHA256
caebb89a2219232ac5f00efd545a61a9e971d1bb93f9efa5efcc6917e5c2bb51

SHA512
fc4a3d3a74e25c5a14faa556afa2ffc1511521430bc088281f9fb83322ebe501fb80b4387ff9988d697fa7b7039d9415ca87cf5d88cf25a562595c3af5c8989b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d2f9a2fc02c20de3_0

Filesize
5KB

MD5
1e15bcae16e198e8aa1e14028ae6ee01

SHA1
ee1e61411fef257c192c7251ba75ad47ecefc01b

SHA256
9217406e16aecf361decafeed66feff89e19cc4ac85fca246c5403c7116ea3b1

SHA512
5e3d16aff62a745353e03ba91ae5b6351dee0a0a56eac0595e3d7f9ac0b7a67e9c28597b4746e701c87ca58e4b263e443cbdca4cb134f10402fce055c7b04f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d45aae6d8d9c9ff2_0

Filesize
2KB

MD5
f24f00d34ba6b54f507e6aa0166c26b7

SHA1
5fd2803c3dd1cca8fe4dab6fa7671ea642f03a55

SHA256
e7377e4f4a57f4e27fcb338a5ed8e8f94356589eee83289c5a55790f158de56c

SHA512
344d2854e58636b9ac2c408863412aadc7cd35ec3659721a0fc4cdd03e6e854b2ff45aed01955a208468f3b659e03f2711596d7da4c5035047fbea294f9b4798

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\de798863d54bf130_0

Filesize
35KB

MD5
988ecd07a70309188c3ec722a04e1fd7

SHA1
23ce9e1177ad255ad54012bc79bd35cc3107b899

SHA256
bb6884841ea8999b7bd0f2d5d8e860abdb3ecdeae4f592eca0964aa8fefb6733

SHA512
507cd80ac358897b0e7c4fb0883fbf49e19d89e40b9e6552016e783f8b963d699f93455bd9a6889461330ad06c5047cbccb71d355906b5bd6d090bac705806e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e146fd968644d345_0

Filesize
6KB

MD5
a05d5c1eaf98fc7665f86a4e2e75b783

SHA1
2f7a2de542e88b08ec77793bc41ed6a787d436fa

SHA256
336b4817fc799587a82a8b3b564aea544f54286bd2cd68a40f1369ecd12a8546

SHA512
4424f2c9862a1ede596fe0e2c3f0b4be08adbc0e503f2160076e91641046b1a18b9b756c8c272c16e7c84e2638c5444efa4033a01b756a1c41124ab3759a2d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e18532de58fe3a53_0

Filesize
59KB

MD5
9fe3e2ac2c944028e7d1d118baf1aeb9

SHA1
41dda64a310fec6fd53b887d12e0c2618b517043

SHA256
e4a8c3d3615d7fb799e099b373adec7a007d6034dce1db8e322318cccb464bef

SHA512
8a0978f734ff76fe66abdede685ea8b764a4c424cb10bad33776c20a5559ceaaa2ec9411a017a32bff6055ca9f8271b11006ebf9da37d0b608695deb311feff3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e8c8218aef51a783_0

Filesize
3KB

MD5
883f7afcf7eb47796165f8283193040b

SHA1
f486ff68c54f04b2e31d057872f081c7d767165e

SHA256
02f8c95e3cbb1e6f48ac1cae45ea30ac0b95aa0dd9c574a5284613cb3140d731

SHA512
5f81da9e1b30c991de754d79e0034c1e13869e2e6ccd23039fac633c2a73b7dcce38c0c76400106ce8209051cef38505a828e9b0f5e488c752856ca1e1a6a34f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2076e2a98754e97_0

Filesize
2KB

MD5
1fdf6bed215adbb6080c8154de7b40ad

SHA1
c5ca5f4b1439e51be73ac7bd675cc0a4d317ba9f

SHA256
ed857542cb39669057f7ffc345f3e7b601c2f6dc2b5539e9d6aa58c61ec5a098

SHA512
9c43c88a5f5ecf53ec44c07b35db81bf52fe8dc116e2112c020d63dbf1a1f0cbddf1522d45e5e6d9f613bf85297c74f2cf79c436c66b31721018d0166eb7306c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2e4bbad99a372cc_0

Filesize
2KB

MD5
d498335cf5233972f9926666b20893f0

SHA1
8d58cc9c01ad6032a7aff1466c3c1805248bca98

SHA256
2c4f2982b7d80c79094270ae75f296be20dfb88dc48075f1839137ef9a3774a3

SHA512
86e3c4cac51b682b08ca8cd7a57fd9e0ee1594b7d581eb0dc588029bb049e1438fbf7c7ae8c85ba1aab12b39452c5abe41dc9912171b9a93cf8f85a21e827e04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f6947f2868481e39_0

Filesize
208KB

MD5
98605052002e39c3541a9b503e966822

SHA1
44b721fe2bc5c44ef92428ec6e465030b2932bd9

SHA256
57f002be0639c7208a1189413f7fe5e415109eebb54207f78df00d6f8beeee93

SHA512
cdf522273979afc07cd02fe993c9ecb70f54e2bf71d423be3d146bfb7f34eac572e35e4a009281cfe8b6cabd8869f9cb630c5cf186d0e0e0c4bba8356f7f8177

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fbd11ea5cda006cc_0

Filesize
26KB

MD5
528f3fd8861d5576413e22fa0b4ed765

SHA1
a997bb2518086beae5b62a4f92bad769beaa9a41

SHA256
7bcd2af10d456f9e739280437714b83d9067078e040e125c02efab349f06eba4

SHA512
34627ea35f57c2685ea7e722da48f93422ff376e7b1db3375a2fee628b0e171c081a52462f8cdd3152796dec468b3501074ec96906200a8e4ae0f260adc7a008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
63f3f94d67a71d292ae344fe8ae75b04

SHA1
5523566c6bc3ab2f8529cc107785d5c3bc0a5fb1

SHA256
6fbb55b11b4301176a72c9189d9bf7c9a67a6eddceac71bff9369317b09ae247

SHA512
34f08fb6637b333f14b792762ad214851fe936f5d1d608cdd00d330581cfda8fa5cb50f78f5b15dc67c39ac07ac41d09e40db88443d548949bedcd0a865e92ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
0ebaa8345a1995caa2773ffc7b14f0f9

SHA1
270b91b7df61e4024920182297e3d2386acada74

SHA256
3c59f60e0b6a12eaf0b2180c3d10add1c17097de1e1d371d12534e8788d39f0d

SHA512
886abeb629e0b78f118f591eca48562c5c4296f33fc6b90cb2adc181fa02d1d49290489dea8f962e0b6a693df4f1196a949c9d695e880e5f1b9108da8fff5e25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
e86f7f451a983ccc77b35b4be2715aec

SHA1
3d7466680e7f02c4fe7bdd586bc6f26d50a6bb61

SHA256
6f3c38e6f8febfd70ad2db929f8e6407ff7da3f3207d43aa3c474c1c5b743649

SHA512
3cca0514006e9b581f43efdd50bbd3644a86828e09915d368adb920e366aa4c88218067dca8ee92115fa5a9fcd2d077ca01cc0eea419d8ab36261ad0851e10b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
9006db64ce5a177feac25bd6be2f6c49

SHA1
bd3114958eea7c13f7cd5cd29ead34b8d94ffc46

SHA256
73d0e71cba10a86eb1fd98d3f5c74a00edd857cace0d94dde8fbccbf85b59c1d

SHA512
d03a43d5e28495dd7a2db3aad801cb8c1233554982b885fd0cf951bebe4ece2c16269f75dd45955a3316d7ad44a75777c93419617ea02c6d9797aedc6d35ec79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
581db1742cc37e04c127e17c665405a7

SHA1
61cb15673279ede05e5222202520d10568cef19c

SHA256
0256b94deddf058b5a5b6f99a425cc0d02a7bc0acab394c04e04c3ba6f62fe36

SHA512
f70e2a5a8efcb5ddedd43a9a26ea02807c85758c87bc85188127ac6b839ad954f05e7a78d741f012504b2b10d3c2e4bc63b078604b0ce84a76e274020dc828d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f5f12aeb7fd2b348717adbad96f5859d

SHA1
973f70353274b09ac98cf3777f05e5266dccb103

SHA256
4c385095e78d1b3960c7da5b669df0c06a0f45a4ee1da23f1c508825595ab49f

SHA512
58fa474502df5e1c49e127e1ff87c0f58c5e934b31fabe50d88122e3980c004b74f381737b0efc04950730edfec0273ddf5b5d613d0004610c481ab5e76b601e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0a5fea8dc573c8e6ce01c5e3c0efa93b

SHA1
53be07991c4aa55b2ebc140f49ec9ef216fdc969

SHA256
b1f5231e0a4ed6f913349ebae71db2da294528ba4119d552ca376e5b712bab91

SHA512
ab438c0f1064c217827d3f63bf147de4e2bf4f696b4c52bca433967bdd188c108917ad8955aaa2903a8f92052b33ec463bf801b566ca86ec293b01a82d974ebc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ee2d280dc33acbeec62719f978c7b1ff

SHA1
7a1eaf93c3a621036e5cc4e2cfa85b5d98672976

SHA256
d7a406c9f52d18ade8bb21f7ece80a6eb15998157680b60b2dfcf11c0809f110

SHA512
6986f880bdc4f9e4c6cf1b0abf7c41616e6285f7d514583cf918618ed04fb0c9f45f079b743fab916d94a826653caea0298675ba48822f308ae95e8140f5f368

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b8aab85189ff1eb77109669c9f2903f9

SHA1
b8f37ef08e0f6e8bd6059162e2935f98050cd480

SHA256
cf72f4920a1d3d2022aaf6c4dc09ce77552a4376112e91a461396b584971543d

SHA512
91e13e82a408bfdf85eea446a607fd6d7b55f871b76ac2c481ddfbe45dbcbd5c90f2d133728d92ba51f981850485d703076c72994a22a95c8717685b1d9a3f14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
041b725363af7c4aec99c49f1d7a224d

SHA1
2046ab31e375610c21f40a264a57c7d27364ea23

SHA256
4b08caacd312d1d6148ed52ea2a5d251a5507259dae9e3d20081a0e20a6856f8

SHA512
11707dc4a746c9cee4033530591cd6ccd498b56ba8ce7bc4e74aede55bb9d10822e1232c158734c7fc1e95fb964d7e961249ced365b413340a6afa5bd80e2b0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d6ff53e8be80266350bec80ac5483e0f

SHA1
6a89f11642050d07269d906396896e183341de51

SHA256
0d47941bc864290301dd2911085fd704d07a9bbdd5b32534f1fa8d12612c5b2e

SHA512
f74740b6a434d764ede5563c19a5a61e16bf48e2eec4855c0dfa12d736b0ab253e701426b4c65a35ac5e58495a0fc954e313a65363abebcd586eb06dd8d9cf7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f84aebb9e0e75878c8883e27347924a0

SHA1
d2b3e54772312cacfefa404dfe7ba4a8d9083b7f

SHA256
e49c556760420c983896925ff0907f5c9bbee0b333088262120a3901dcc44f57

SHA512
2c20df9f6c886a8d95ebb7c4dce1817d6635a61fb4e4a26974197e585c1e1408ba3cdbf5b137b5e8c0aef128c8ff1788a16376b0eb8141c747fea32884c531a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1d022ae6588fd884f1f744656d766afe

SHA1
c12e1d271ffbf7de6f6fd2771dfb5876b2b99ae5

SHA256
c182659bcbb7d6c78805514787c53a2ea8a487eecf271d90931748c0d082c422

SHA512
e9f073a0f78c17ae4dcbd0a347be60410f4b93a972f17510716518836b606114a4d0163ce098696e7d0a88cdb96e5dea48698f1ae273629321a510112e80bc28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
acc2eceacd174b73e2fab58e1f60101a

SHA1
b2464184fba5e58341398f6e7b7d776817e688a7

SHA256
b1d1914bdb3dfcf0ad3829167a37d6c4fd7778967dd609142711ac8454bbcf92

SHA512
485280f4c3f62092e65324bf88e168810d6bcb7d65105394e28ba2ac2e1784c236d280542c7892f70fb77bb0ea648046514f5720e4cb2b82524055a39c1dcfdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fb51c3bddc71b390450807418b3e17d5

SHA1
028ac7e4a8c6c33dbfc2e23056f03e24fbe80496

SHA256
dd6145a36baf383cfb068d31228b460a36612825952f062bb4e4360775a99784

SHA512
1d41bfdf64132617a75be8fe85c0acda97d6c884616d2dcb5c8add3a3cc2929a09ec7f5f41ac151ce6d2dc54a1c26e145e28e48a86a4df634846e75c9198c59c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
232f61e015b2f92748ddea4177dcc291

SHA1
2aca571eac383b3d3c6af4c082b7e8e6930b398d

SHA256
3cb7910e465c3e6dce4c2b12107b8d62eedc0b91b31f1f0d476356c2ecedccee

SHA512
78d8146ecfc43de34f5df3cef8ebe4612cce251859e6d841eb958f9053d7880e9af5c649c1a136224e8c5fa929bfefb188e62571c6313d429357770ac22bf6fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b274e731921fbbf310098673267bcc24

SHA1
223eecf397cbc80e55348248dadb50cea1d24cf7

SHA256
6ffd2683d2f13d746bcd20c88ef5dcc0bc926cb8a90f8a71d9a4ead2cebe916c

SHA512
6753bb15f9e32cd0321711607cfac326ea759b42a3a650b5154b088bd341f404b752eeb609f89784e0df0902dcfeda512196f3040f4843d09de9a8b9a5b265fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6cf1a6db796a437a8f36498e268a6430

SHA1
306069bf0934bc6b84b823f39c8a18c55fa8ce3b

SHA256
aa650212528496560c39f60d408e73ae334b313c842273132cf00440f02bb369

SHA512
97a85c8f6702482194b71c43e1cea5be5de3830af6432a302d19c74eace0eaad9d25eb99755f0af26f5f3258bc20c35a7a3492cc0c9550241b07e9f0596f2805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
49e1593a955ba293d98e2d937238cda1

SHA1
527bceec5463ed4cea407d562d875b444f726aa2

SHA256
95db4b65300a2a795b3c7f5a605e60a551b9b2f9cf0d0a211994d8bbf10ab634

SHA512
fe278b58d0c3c2bb50202490efd62c769129e28f1f74b96e33b443eeaa527687c190c6b3bb9d529caca79922125c664912c95109bbdd02452ad8e1a1e3d47c74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
28f3c6667f17977eb88d3898c6824066

SHA1
394065efd5e6cc1896614c0a0f0c8f2b50c63418

SHA256
120eba60440b09be606fb5fb6bfc0bdde183a3cea90a0440accff5a22d717d3a

SHA512
c4d1f88ad92ce071ed786907f9241600e9ab662f9001e595b8b7e72a57fbab3ffa2e2dd2f8bae8c3e216bc015e605ceb67294470a7f0d461bf2ee6d932b49289

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cdc1ad97cf41b62f49fea063d15f7127

SHA1
112edb9c7bcae55bbd7d3459cfa596e11492fde4

SHA256
c63c1e4593b9e34cd5f709aefb41a0e6dd343d07520ab51e375f758230a38dfb

SHA512
a4c5d76f9faee75e6fbdce0046f06a08e1d8637f5369b984212fb1b9a32d94b31fffe5d7cf2a1921fe18cf1a48e8fc34450ea92db59c9811a6650475287a730f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2dd2102e0fc59f9e2545c45341839182

SHA1
4f6b79546cbad486f387213ad74dd9dbb58dc8f1

SHA256
619bad31aaac01baa1fa5d287acd26f1d951804c23c580c88ac808999f0ad015

SHA512
d13b79c92775d119066a4380e7fd7b0c2e859902e29b9df273d2b6477473a4f25a843337b170cc97baa1508005e62473be56305ee720feeb08f6b0eabf942a6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
661ac3f251cbe6fdfc45a5315e437c99

SHA1
7cd0d42df7f269d9ebefe515ac73ab4baf4ab5c6

SHA256
22866bba7dd1665468141acc2a9f875e9bc923a4bfd163bee2e8843ffdd1479b

SHA512
af120fa0f587e7dd99591e8fb6793c7c31c4932dbeb52034658f4c4e735b52f7592b2c2c930696fd5005ea1d766fdac7afc75ebb871f8e235c548d6a1f40dac3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3aa110b87d28f88f995079114eb577c2

SHA1
7d0d01387544c8a5645ddfe9ffffed851a5f29fa

SHA256
8f873d1f9dc2bfb033701564878eddbe60ff48d4b8f9a5021a338e65e2101963

SHA512
33ff7b34950d6234b66e301ba8c449f551479a7803f8d0185afdb2ada0d39a4bcb2816bffad61a11c8d542beb302b86a3faf8a5cb779b3ec661ebd87526197dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8e7372223f72a78127d3cbd97abae106

SHA1
3d4ffe5e85a6ef72db18d5394310c5d0ac28f415

SHA256
303e2a9c7956e21c0e354bf877a3fc7933958566e5a3ba57c637b08dc4101515

SHA512
fdea59bd8f1250d4025829f4135759d551ced86138a855020b5cd6649ca853783213ed6e5296f344dc28072f67e91ca7a858cac35f6c54937192e512c28068ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0275b90996c8c9c269fe0dfe3c9d8cb3

SHA1
60a53140bb1b3b08e222ff107f562369ce3de661

SHA256
55d92502da8296713b3815fbb9014c5301785119c9e71d832dcd8a7bae0be050

SHA512
db2eb4aa6ba7c653e66dcf23a66742554d5e597800fb794d7d4cd85423fad4bf609dac412318d28e8c61e42bba10a8268825d0b920a6a8dbca8134b3eb9e22d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2bc0887cfbff138ab0669157dff48975

SHA1
60e3767d1ccebae5c210a98c91255a6afc58ccde

SHA256
9f3261ef167c3b65477c5cd53811a96bf4d4b0afc9262c065d82ea5fd54fb85e

SHA512
df6d68635a6a2c9e06751599bc0bf725fa32aa3234f30880e8347d00d51f50f5730758c6c303753fdeb850110b677c15fd974cffb46e72c3d739350f1e0f3da5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5019bef06ae7cdd8f6c9bd4e7f79aff0

SHA1
9e8c7e45fa04cea1ae94390a40913ace30e455e8

SHA256
39c405c1f55c7ee5388916dfafeba7464952a991737a115b4c288319954f4238

SHA512
45ab22027fd80b95e55ddbdb419e6289afddd2b058c33b39a7cf783e2932f67a26c953864f420f39cb1b26414f8f311d830c22cfdf1c05a929b2545f76c752dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
156e7bb44ff47d6172e04117c0a0e8bc

SHA1
85865422aa7d7e622dac3ea15efb1f635b280125

SHA256
3fb4e769a8a763381515bc5e89e68430266d3e731709ad766e5390bea7a96f35

SHA512
a3522ea28927a66d7b5df206f71c291ad11464a4cafed6f0f09d4a4bcbf30e952908162b5dc3efe774894d608b53b5be7d51b75c1e7b2b2c8a767091aa97991e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
623e13fa9648d6c4b0cd89c2881e733b

SHA1
5b585e03dde7823e2436f9c69c7f2f182e2c5f3b

SHA256
760fb05cde5b9f625106ade0a3ddd6873c885234696f37233b56922ec519be1d

SHA512
ec92f119edbe9fac914a3581c1e2256e91007b791411e7ccd9f620ea5dd543428ca056c3649943dc0ad9d222fbe346dbda95b883fe43f6bc419fd29995891b1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
67474b2e70512d1a6d476026060f3d81

SHA1
bde83f178cf607c78b68c490f5ab10a0c24fee38

SHA256
009130b03e69bffaa7fdb9624d13ce09b33d5705e36ad70f787c9417f9f723ab

SHA512
852d28747042794284b270d2c76fb3ad8d612ea3c074a8e86d5920dca30144804c709e07901eebfee5caa139ac97337f4ac5cbcee50050a14aa64a90f3062b91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
90768f6edd3884ab311b714ea30c841f

SHA1
c6654830771e5090797e44d7478b8228dc393a2b

SHA256
7f07c45e858d3fede002233dab71f6390de119c389e3f2c8230793f15c7aa078

SHA512
f60b5f85f8ac28da3e36c626fb6e94993c3686af8cecc294233c94a4554592ce02db2971e5e30f390fde204748a8b39da33908e71b640019fc18a52d8a7ce027

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe60599d.TMP

Filesize
1KB

MD5
cd336fa0bf83257b3d93bb2568e28d78

SHA1
78919a6279244e28d10f347dd0941e0bda5f9280

SHA256
07ac77f3fa8419b1a26b02642ecb18d175f7be59276d2654b0d3be0ffce88cc2

SHA512
d2931850c5092a7315f4f1f547b738daa601d4693ebd08a0c38383d10262f39873d1ffcf6fe28bb8d0436f386ff1103ebb9637e18e237937ddab7a3061885f9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3a913636c2b062ffc5a290adae9386e0

SHA1
ac408d90a87ffd49267548056f6c25186a10f2c4

SHA256
a7d12e414f56dccd07c308580e5c45bf663b25427f055c10c2c7c7ceec046da0

SHA512
a957bd575cfac7c1ffb5617a3af6f595f0a85630bf84f2d50a460fdc246368f065a0dae2c0cbfcd78bb5ec9f2d27fd8675fe760c1ffa831715ce918a41f3e71b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
66e12cef385b13b0b6bea5519fe2455a

SHA1
4ada06df4ae07da66f7256b09d07e0a304273153

SHA256
8a95907fc9e3842c27d7ec59c9d2eff030fecbae48916d58cf61a8d32bd9a5b4

SHA512
84448f5027fcbc51770eba68847721523647f56a3a2cacd7f6f214876239c4581e8a3f540e038c812e71b21c31111d0d0364133e541b13252854dabeae5e877f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3667efa6a9f79790cf0ff69e6fa7160c

SHA1
5e9f9fb0c0780fc573d8cc4aad2f95222923eac4

SHA256
b422a3a55daedae2a1bf3ef38b9a7f405123d7a09942690c47c4c83e3301e326

SHA512
f8c733358768ee22b080804aa04c1ddf610ce62e67bd35c7eee61725b7359a4a6f84683f5230ae4e33f482f26ec8eda8115d2a2cd04337a96adda98d8b81bdcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e45531821a49f34441d0a192c396687a

SHA1
61bbe21760b3f74424fb1fbc60e0089ec88208d5

SHA256
2648efb6806898841d997d279cccd5e87f24279404cb2702915c1e1e59d2fa8d

SHA512
8e1edc17710cbc32ced921ccd361e87d578da8aa2d9ced564f7c70251c92e964a51876b6b880ebc6353b18419f917977b43f28f40380050c32e15db03cfae21f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
378e2193f12f49966ad02878ba7e823a

SHA1
f1fd9e0cdd1089d28814bc73e3c84c39d17f88bb

SHA256
64fe9bfa9827d89cc8e2a967525ad200c1190ad2174df5d257c74fd0cdaf6559

SHA512
32d22d7b8fd1352025fa1eea958155c21de3350125e046ce9e14c65195903874e882799f530fc0bd9c3f64c960eda5acf3709258b8c51e0e6e99cbd7d2c45e58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
955c73100ffc23fca786a94080a6c70f

SHA1
f52db5389de4faad317ba86b4a38f719976250d9

SHA256
0aba4533697118e88771f5ea6e9851705f536385782e70732b36550e81f90717

SHA512
de4a792d5ffe8474c233fdacf567b9ccf1a41b1abd5888f41f173ed41fbb73bbb60d2138f8456e54066d99cf5ab3331972683231fa11fcfb11a749bd8ac6e0e6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
18KB

MD5
47929e1ad02251e45e61a65cc33e821f

SHA1
42b0f797ba337ad3e5fbc3ce476ec5e441399cbe

SHA256
6b41ad5175c85d47ae72265a1f276b85dd25b5a624d700855ad1b8c7370c4c9b

SHA512
41052bceb7bcf3e1727bdc7ab799189018e38b18a4d8c838907e5715db6bf1d80e8fbf02d85c2c87bd4eddaa817ea10d8560fe850dcb0ecbd5c3604891e5769d

Download Submit
C:\Users\Admin\Downloads\!Please Read Me!.txt

Filesize
797B

MD5
afa18cf4aa2660392111763fb93a8c3d

SHA1
c219a3654a5f41ce535a09f2a188a464c3f5baf5

SHA256
227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

SHA512
4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 127479.crdownload

Filesize
224KB

MD5
5c7fb0927db37372da25f270708103a2

SHA1
120ed9279d85cbfa56e5b7779ffa7162074f7a29

SHA256
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

SHA512
a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 508258.crdownload

Filesize
211KB

MD5
b805db8f6a84475ef76b795b0d1ed6ae

SHA1
7711cb4873e58b7adcf2a2b047b090e78d10c75b

SHA256
f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf

SHA512
62a2c329b43d186c4c602c5f63efc8d2657aa956f21184334263e4f6d0204d7c31f86bda6e85e65e3b99b891c1630d805b70997731c174f6081ecc367ccf9416

Download Submit
C:\Users\Admin\Downloads\m.wry

Filesize
42KB

MD5
980b08bac152aff3f9b0136b616affa5

SHA1
2a9c9601ea038f790cc29379c79407356a3d25a3

SHA256
402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

SHA512
100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

Download Submit
C:\Users\Admin\Downloads\r.wry

Filesize
729B

MD5
880e6a619106b3def7e1255f67cb8099

SHA1
8b3a90b2103a92d9facbfb1f64cb0841d97b4de7

SHA256
c9e9dc06f500ae39bfeb4671233cc97bb6dab58d97bb94aba4a2e0e509418d35

SHA512
c35ca30e0131ae4ee3429610ce4914a36b681d2c406f67816f725aa336969c2996347268cb3d19c22abaa4e2740ae86f4210b872610a38b4fa09ee80fcf36243

Download Submit
C:\Users\Admin\Downloads\t.wry

Filesize
68KB

MD5
5557ee73699322602d9ae8294e64ce10

SHA1
1759643cf8bfd0fb8447fd31c5b616397c27be96

SHA256
a7dd727b4e0707026186fcab24ff922da50368e1a4825350bd9c4828c739a825

SHA512
77740de21603fe5dbb0d9971e18ec438a9df7aaa5cea6bd6ef5410e0ab38a06ce77fbaeb8fc68e0177323e6f21d0cee9410e21b7e77e8d60cc17f7d93fdb3d5e

Download Submit
C:\Users\Admin\Downloads\u.wry

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
memory/768-1147-0x0000000005600000-0x0000000005BA4000-memory.dmp

Filesize
5.6MB

Download
memory/768-1145-0x0000000000520000-0x000000000055C000-memory.dmp

Filesize
240KB

Download
memory/768-1788-0x0000000006320000-0x0000000006386000-memory.dmp

Filesize
408KB

Download
memory/768-1148-0x0000000005050000-0x00000000050E2000-memory.dmp

Filesize
584KB

Download
memory/768-1149-0x0000000004F30000-0x0000000004F3A000-memory.dmp

Filesize
40KB

Download
memory/1104-1146-0x00000000048F0000-0x000000000498C000-memory.dmp

Filesize
624KB

Download
memory/1104-1150-0x0000000004B30000-0x0000000004B86000-memory.dmp

Filesize
344KB

Download
memory/1904-4786-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/5008-6354-0x00007FFC8C7D0000-0x00007FFC8C7E0000-memory.dmp

Filesize
64KB

Download
memory/5008-6356-0x00007FFC8A400000-0x00007FFC8A410000-memory.dmp

Filesize
64KB

Download
memory/5008-6355-0x00007FFC8A400000-0x00007FFC8A410000-memory.dmp

Filesize
64KB

Download
memory/5008-6407-0x00007FFC8C7D0000-0x00007FFC8C7E0000-memory.dmp

Filesize
64KB

Download
memory/5008-6408-0x00007FFC8C7D0000-0x00007FFC8C7E0000-memory.dmp

Filesize
64KB

Download
memory/5008-6410-0x00007FFC8C7D0000-0x00007FFC8C7E0000-memory.dmp

Filesize
64KB

Download
memory/5008-6409-0x00007FFC8C7D0000-0x00007FFC8C7E0000-memory.dmp

Filesize
64KB

Download
memory/5008-6353-0x00007FFC8C7D0000-0x00007FFC8C7E0000-memory.dmp

Filesize
64KB

Download
memory/5008-6352-0x00007FFC8C7D0000-0x00007FFC8C7E0000-memory.dmp

Filesize
64KB

Download
memory/5008-6351-0x00007FFC8C7D0000-0x00007FFC8C7E0000-memory.dmp

Filesize
64KB

Download
memory/5008-6350-0x00007FFC8C7D0000-0x00007FFC8C7E0000-memory.dmp

Filesize
64KB

Download