wannacry | fb5422ac425f13f6ea041a30d25dbc22b8475ccd8d54c9b149f865db37262d21

Resubmissions

13/04/2025, 16:39

250413-t55t8azjv8 10

13/04/2025, 16:37

250413-t4ss9szxhw 3

Analysis

max time kernel
224s
max time network
414s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
13/04/2025, 16:39

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

realgangflexflex.exe
Size

540KB
MD5

8e86f171ff6f39682b5a2bc566bfc1a9
SHA1

925a6856382b1b1e139d3cdc860d5267366e30f9
SHA256

fb5422ac425f13f6ea041a30d25dbc22b8475ccd8d54c9b149f865db37262d21
SHA512

645481936f13195c07fa30938d93fae86b60b3fc646bb5769762fe29c99284886fd18d2e53073c46fe877b0384a8385799beb79001fd2b18e8e37c2880ce3116
SSDEEP

12288:5UiEotalUB8gOfa7NA4Y9hjmQ1VXCudD3ZwmsKDXMJ:yloclwP7NzY9hjmaVXCu5sKDc

Score

10^/10

wannacry bootkit defense_evasion discovery execution persistence ransomware worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry

Downloads MZ/PE file 1 IoCs

flow	pid	Process
102	2564	firefox.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDF5C9.tmp	WannaCrypt0r.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDF5C2.tmp	WannaCrypt0r.exe

Executes dropped EXE 3 IoCs

pid	Process
344	Monoxidex86.exe
2560	騩領陥芝到盌弊咎蕳墫浿猎鹦屮阮棿.exe
3076	taskdl.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2580	icacls.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
50	raw.githubusercontent.com
83	raw.githubusercontent.com
102	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	騩領陥芝到盌弊咎蕳墫浿猎鹦屮阮棿.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Monoxidex86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	騩領陥芝到盌弊咎蕳墫浿猎鹦屮阮棿.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCrypt0r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
12344	NOTEPAD.EXE

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000_Classes\Local Settings	firefox.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2612	reg.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\WannaCrypt0r.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\AppData\Local\Temp\騩領陥芝到盌弊咎蕳墫浿猎鹦屮阮棿.exe\:Zone.Identifier:$DATA	Monoxidex86.exe
File created	C:\Users\Admin\Downloads\Monoxidex86.exe.vir:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	firefox.exe
Token: SeDebugPrivilege	2564	firefox.exe
Token: SeDebugPrivilege	2564	firefox.exe
Token: SeDebugPrivilege	2564	firefox.exe
Token: SeDebugPrivilege	2564	firefox.exe
Token: SeDebugPrivilege	2564	firefox.exe
Token: SeDebugPrivilege	2564	firefox.exe
Token: SeDebugPrivilege	2560	騩領陥芝到盌弊咎蕳墫浿猎鹦屮阮棿.exe
Token: SeTakeOwnershipPrivilege	2560	騩領陥芝到盌弊咎蕳墫浿猎鹦屮阮棿.exe
Token: 33	3428	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3428	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe
344	Monoxidex86.exe
2560	騩領陥芝到盌弊咎蕳墫浿猎鹦屮阮棿.exe
2560	騩領陥芝到盌弊咎蕳墫浿猎鹦屮阮棿.exe
2564	firefox.exe
2564	firefox.exe
2564	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 2564	4400	firefox.exe	90
PID 4400 wrote to memory of 2564	4400	firefox.exe	90
PID 4400 wrote to memory of 2564	4400	firefox.exe	90
PID 4400 wrote to memory of 2564	4400	firefox.exe	90
PID 4400 wrote to memory of 2564	4400	firefox.exe	90
PID 4400 wrote to memory of 2564	4400	firefox.exe	90
PID 4400 wrote to memory of 2564	4400	firefox.exe	90
PID 4400 wrote to memory of 2564	4400	firefox.exe	90
PID 4400 wrote to memory of 2564	4400	firefox.exe	90
PID 4400 wrote to memory of 2564	4400	firefox.exe	90
PID 4400 wrote to memory of 2564	4400	firefox.exe	90
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4224	2564	firefox.exe	91
PID 2564 wrote to memory of 4796	2564	firefox.exe	92
PID 2564 wrote to memory of 4796	2564	firefox.exe	92
PID 2564 wrote to memory of 4796	2564	firefox.exe	92
PID 2564 wrote to memory of 4796	2564	firefox.exe	92
PID 2564 wrote to memory of 4796	2564	firefox.exe	92
PID 2564 wrote to memory of 4796	2564	firefox.exe	92
PID 2564 wrote to memory of 4796	2564	firefox.exe	92
PID 2564 wrote to memory of 4796	2564	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
960	attrib.exe
4752	attrib.exe

C:\Users\Admin\AppData\Local\Temp\realgangflexflex.exe
"C:\Users\Admin\AppData\Local\Temp\realgangflexflex.exe"
1⤵
PID:3992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:484

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {24f851f9-e66a-419e-abc2-47287a36a86e} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {666febd9-1a94-42a4-b2ba-94478cf621b2} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3816 -prefsLen 27274 -prefMapHandle 3820 -prefMapSize 270279 -jsInitHandle 3824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3832 -initialChannelId {9dc248f4-1a90-4a20-8243-a6d660091cec} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4008 -prefsLen 27274 -prefMapHandle 4012 -prefMapSize 270279 -ipcHandle 4092 -initialChannelId {a8ac3b1d-831d-4573-a1bc-82238ea37f35} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3068 -prefsLen 34773 -prefMapHandle 3236 -prefMapSize 270279 -jsInitHandle 3240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4636 -initialChannelId {0f0358d1-a9f5-41d7-b157-16c5e3e5ae01} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4672 -prefsLen 34876 -prefMapHandle 4844 -prefMapSize 270279 -ipcHandle 4960 -initialChannelId {6ce9d9d3-d9bb-4c42-a753-e66bbee23aa4} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1676 -prefsLen 32952 -prefMapHandle 5600 -prefMapSize 270279 -jsInitHandle 5596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5592 -initialChannelId {11ccdaef-b28a-4c46-abb9-10db42311dba} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5780 -prefsLen 32952 -prefMapHandle 5784 -prefMapSize 270279 -jsInitHandle 5788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5796 -initialChannelId {1e809fb9-9a5a-429c-935d-43e1dba5f97e} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5972 -prefsLen 32952 -prefMapHandle 5976 -prefMapSize 270279 -jsInitHandle 5980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5984 -initialChannelId {6bc5d80c-2a49-4bb0-968c-d8a04ad2c869} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6308 -prefsLen 33071 -prefMapHandle 6312 -prefMapSize 270279 -jsInitHandle 6316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6320 -initialChannelId {3bc2153a-4dd7-4b4e-9ec9-ed006eab619b} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6632 -prefsLen 36543 -prefMapHandle 2960 -prefMapSize 270279 -jsInitHandle 6568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4512 -initialChannelId {54c14f96-3d6f-458a-b536-662aaaf2b506} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:4604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6736 -prefsLen 36543 -prefMapHandle 1688 -prefMapSize 270279 -jsInitHandle 6464 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5312 -initialChannelId {bd9994e5-b46f-4817-8e68-3cdd2666a9b3} -parentPid 2564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:4692

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1692

C:\Users\Admin\Downloads\Monoxidex86.exe
"C:\Users\Admin\Downloads\Monoxidex86.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:344
- C:\Users\Admin\AppData\Local\Temp\騩領陥芝到盌弊咎蕳墫浿猎鹦屮阮棿.exe
  "C:\Users\Admin\AppData\Local\Temp\騩領陥芝到盌弊咎蕳墫浿猎鹦屮阮棿.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2560
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\ar.txt
    3⤵
    PID:3164
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\el.txt
    3⤵
    PID:3016
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\fur.txt
    3⤵
    PID:5808
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\uz-cyrl.txt
    3⤵
    PID:5388
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\va.txt
    3⤵
    PID:4444
- - C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe
    "C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe"
    3⤵
    PID:3912
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Program Files\CompressReceive.midi"
    3⤵
    PID:3392
  - - C:\Windows\SysWOW64\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
      4⤵
      PID:2496
    - - C:\Windows\system32\unregmp2.exe
        
        "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
        5⤵
        
        PID:3576
- - C:\Program Files\Google\Chrome\Application\133.0.6943.60\os_update_handler.exe
    "C:\Program Files\Google\Chrome\Application\133.0.6943.60\os_update_handler.exe"
    3⤵
    PID:1960
- - C:\Program Files\Java\jdk-1.8\bin\klist.exe
    "C:\Program Files\Java\jdk-1.8\bin\klist.exe"
    3⤵
    PID:2928
- - C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
    "C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe"
    3⤵
    PID:6340
- - C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
    "C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe"
    3⤵
    PID:6372
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Java\jdk-1.8\jvisualvm.txt
    3⤵
    PID:6884
- - C:\Program Files\Java\jre-1.8\bin\klist.exe
    "C:\Program Files\Java\jre-1.8\bin\klist.exe"
    3⤵
    PID:6948
- - C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
    "C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe"
    3⤵
    PID:6960
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Java\jre-1.8\Welcome.html
    3⤵
    PID:6256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files\Java\jre-1.8\Welcome.html
      4⤵
      PID:6540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7ff91912f208,0x7ff91912f214,0x7ff91912f220
        5⤵
        
        PID:6436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1984,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:11
        5⤵
        
        PID:6856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2056,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:2
        5⤵
        
        PID:5500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1852,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:13
        5⤵
        
        PID:3348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3428,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
        5⤵
        
        PID:6312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3416,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
        5⤵
        
        PID:6328
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4684,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
        5⤵
        
        PID:6772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4716,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
        5⤵
        
        PID:6148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5204,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
        5⤵
        
        PID:2848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5700,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
        5⤵
        
        PID:7376
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        6⤵
        
        PID:7840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5488,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
        5⤵
        
        PID:6224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5488,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
        5⤵
        
        PID:7644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5780,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
        5⤵
        
        PID:7764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6324,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
        5⤵
        
        PID:7536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6332,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
        5⤵
        
        PID:4480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6340,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
        5⤵
        
        PID:7240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6092,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
        5⤵
        
        PID:3856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4908,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:14
        5⤵
        
        PID:7492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=7048,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:1
        5⤵
        
        PID:7620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4748,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
        5⤵
        
        PID:7460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=4928,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
        5⤵
        
        PID:9124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=6072,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
        5⤵
        
        PID:7804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=6856,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:1
        5⤵
        
        PID:2460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=6128,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
        5⤵
        
        PID:9356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=7340,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:1
        5⤵
        
        PID:9432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=7764,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=7748 /prefetch:1
        5⤵
        
        PID:9648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=7916,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=7928 /prefetch:1
        5⤵
        
        PID:9784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=8080,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=8056 /prefetch:1
        5⤵
        
        PID:9936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=8320,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=8372 /prefetch:1
        5⤵
        
        PID:10104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=8256,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=8292 /prefetch:1
        5⤵
        
        PID:8768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=8592,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=8588 /prefetch:1
        5⤵
        
        PID:9316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --field-trial-handle=8756,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=8864 /prefetch:1
        5⤵
        
        PID:10228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=8928,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
        5⤵
        
        PID:10544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=9200,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=9252 /prefetch:1
        5⤵
        
        PID:10856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=9384,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=9388 /prefetch:1
        5⤵
        
        PID:10988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --field-trial-handle=9544,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=9560 /prefetch:1
        5⤵
        
        PID:11088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=9704,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=9368 /prefetch:1
        5⤵
        
        PID:11192
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --field-trial-handle=9880,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=9900 /prefetch:1
        5⤵
        
        PID:10480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --field-trial-handle=9948,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=10112 /prefetch:1
        5⤵
        
        PID:10720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --field-trial-handle=10068,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=10248 /prefetch:1
        5⤵
        
        PID:10876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --field-trial-handle=10388,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=10408 /prefetch:1
        5⤵
        
        PID:10580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --field-trial-handle=10668,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=10696 /prefetch:1
        5⤵
        
        PID:11308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --field-trial-handle=10820,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=10848 /prefetch:9
        5⤵
        
        PID:11424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=11096,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=11060 /prefetch:15
        5⤵
        
        PID:11536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --field-trial-handle=10588,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=10624 /prefetch:1
        5⤵
        
        PID:11964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --field-trial-handle=10636,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=11312 /prefetch:1
        5⤵
        
        PID:12068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --field-trial-handle=11484,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=11512 /prefetch:1
        5⤵
        
        PID:12240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --field-trial-handle=12100,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=12124 /prefetch:1
        5⤵
        
        PID:2216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=12544,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=12560 /prefetch:10
        5⤵
        
        PID:12780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=13908,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=13944 /prefetch:14
        5⤵
        
        PID:11780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=13880,i,13982970027598571156,3709283352554779361,262144 --variations-seed-version --mojo-platform-channel-handle=13864 /prefetch:14
        5⤵
        
        PID:8580
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt
    3⤵
    PID:6348
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt
    3⤵
    PID:6288
- - C:\Windows\SysWOW64\rundll32.exe
    "rundll32.exe" "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll",InstallVstoSolution C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.vsto
    3⤵
    PID:6788
- - C:\Program Files\Microsoft Office\root\Office16\msotd.exe
    "C:\Program Files\Microsoft Office\root\Office16\msotd.exe"
    3⤵
    PID:7288
- - C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE
    "C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE"
    3⤵
    PID:7328
- - C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
    "C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE"
    3⤵
    PID:7420
- - C:\Program Files\Windows Mail\wab.exe
    "C:\Program Files\Windows Mail\wab.exe"
    3⤵
    PID:6304
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtOpenCAT C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.4_2.42007.9001.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat
    3⤵
    PID:1492
- - C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe
    "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe"
    3⤵
    PID:1864
- - C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe
    "C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe"
    3⤵
    PID:6416
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\dist\fluentui-react.umd.js"
    3⤵
    PID:7604
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\ComboBox\ComboBox.types.js"
    3⤵
    PID:6636
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\DetailsList\ShimmeredDetailsList.styles.js"
    3⤵
    PID:5900
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\DocumentCard\DocumentCardDetails.base.js"
    3⤵
    PID:2328
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\DocumentCard\DocumentCardLogo.base.js"
    3⤵
    PID:8152
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\DocumentCard\DocumentCardTitle.js"
    3⤵
    PID:4932
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\DateTimeUtilities.js"
    3⤵
    PID:4620
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\HoverCard.js"
    3⤵
    PID:2848
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\Icons.js"
    3⤵
    PID:7252
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\Modal.js"
    3⤵
    PID:8124
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\Pickers.js"
    3⤵
    PID:6336
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\Pivot.js"
    3⤵
    PID:6240
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\ChoiceGroup.js"
    3⤵
    PID:5620
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\Breadcrumb\Breadcrumb.types.js"
    3⤵
    PID:7000
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\DetailsList\DetailsColumn.types.js"
    3⤵
    PID:6284
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\DetailsList\DetailsHeader.base.js"
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\Fabric.js"
    3⤵
    PID:6772
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\FloatingPicker.js"
    3⤵
    PID:7624
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\Calendar.js"
    3⤵
    PID:3488
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\Color.js"
    3⤵
    PID:6056
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\ComboBox\ComboBox.styles.js"
    3⤵
    PID:8068
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\ComboBox\index.js"
    3⤵
    PID:4136
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\ComboBox\VirtualizedComboBox.js"
    3⤵
    PID:6872
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\DetailsList\DetailsHeader.styles.js"
    3⤵
    PID:2380
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\DetailsList\DetailsList.styles.js"
    3⤵
    PID:7628
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\DetailsList\DetailsRowCheck.js"
    3⤵
    PID:7704
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\DocumentCard\DocumentCardPreview.js"
    3⤵
    PID:6500
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\DocumentCard\DocumentCardStatus.base.js"
    3⤵
    PID:7440
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\Dropdown\Dropdown.base.js"
    3⤵
    PID:7564
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\GroupedList\GroupHeader.types.js"
    3⤵
    PID:6112
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib\colors\FluentColors.js"
    3⤵
    PID:8056
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib\motion\AnimationStyles.js"
    3⤵
    PID:6560
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib\types\IAnimationStyles.js"
    3⤵
    PID:7608
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib\types\IEffects.js"
    3⤵
    PID:4500
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-amd\effects\index.js"
    3⤵
    PID:2656
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-commonjs\colors\FluentColors.js"
    3⤵
    PID:7164
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-commonjs\motion\FluentMotion.js"
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-commonjs\types\IPalette.js"
    3⤵
    PID:4008
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@fluentui\dom-utilities\lib\getVirtualParent.js"
    3⤵
    PID:7180
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@fluentui\dom-utilities\lib-commonjs\portalContainsElement.js"
    3⤵
    PID:7800
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\lib-amd\fontFace.js"
    3⤵
    PID:6796
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\lib-amd\transforms\kebabRules.js"
    3⤵
    PID:8196
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\lib-commonjs\IRawStyleBase.js"
    3⤵
    PID:8244
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\lib-commonjs\IStyleOptions.js"
    3⤵
    PID:8296
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\lib-commonjs\IStyleSet.js"
    3⤵
    PID:8336
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\AutoScroll.js"
    3⤵
    PID:8408
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\dom\getDocument.js"
    3⤵
    PID:8448
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\dom\getParent.js"
    3⤵
    PID:8484
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\dom\on.js"
    3⤵
    PID:8516
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\dom\setPortalAttribute.js"
    3⤵
    PID:8564
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\index.js"
    3⤵
    PID:8584
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\memoize.js"
    3⤵
    PID:8620
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\modalize.js"
    3⤵
    PID:8648
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\BaseComponent.types.js"
    3⤵
    PID:8692
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\customizations\mergeCustomizations.js"
    3⤵
    PID:8712
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\dom.js"
    3⤵
    PID:8760
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\test\injectWrapperMethod.js"
    3⤵
    PID:8792
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\Async.js"
    3⤵
    PID:8856
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\initials.js"
    3⤵
    PID:8880
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\safeSetTimeout.js"
    3⤵
    PID:8920
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\warn.js"
    3⤵
    PID:8980
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldNotBeNullOrEmpty.snippets.ps1xml
    3⤵
    PID:9052
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe"
    3⤵
    PID:9192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html
    3⤵
    PID:7804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html
      4⤵
      PID:9184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\rename.svg
    3⤵
    PID:9164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\rename.svg
      4⤵
      PID:6704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\next-arrow-down.svg
    3⤵
    PID:9168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\next-arrow-down.svg
      4⤵
      PID:8888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_ellipses-hover.svg
    3⤵
    PID:9268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_ellipses-hover.svg
      4⤵
      PID:9296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_empty_state.svg
    3⤵
    PID:9304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_empty_state.svg
      4⤵
      PID:9348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluCCFilesEmpty_180x180.svg
    3⤵
    PID:9412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluCCFilesEmpty_180x180.svg
      4⤵
      PID:9556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_listview_selected-hover.svg
    3⤵
    PID:9640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_listview_selected-hover.svg
      4⤵
      PID:9696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\delete.svg
    3⤵
    PID:9828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\delete.svg
      4⤵
      PID:9900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-focus_32.svg
    3⤵
    PID:10048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-focus_32.svg
      4⤵
      PID:10076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_invite_18.svg
    3⤵
    PID:10148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_invite_18.svg
      4⤵
      PID:10164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_reminders_18.svg
    3⤵
    PID:8348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_reminders_18.svg
      4⤵
      PID:9304
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\ui-strings.js"
    3⤵
    PID:9576
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\ui-strings.js"
    3⤵
    PID:9624
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\ui-strings.js"
    3⤵
    PID:9776
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\plugin.js"
    3⤵
    PID:9640
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\main.css
    3⤵
    PID:9828
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\main-selector.css
    3⤵
    PID:9960
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu\ui-strings.js"
    3⤵
    PID:10052
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\ui-strings.js"
    3⤵
    PID:8252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_radio_unselected_18.svg
    3⤵
    PID:10128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_radio_unselected_18.svg
      4⤵
      PID:10160
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sv-se\ui-strings.js"
    3⤵
    PID:10076
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\da-dk\ui-strings.js"
    3⤵
    PID:9408
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pl-pl\ui-strings.js"
    3⤵
    PID:9096
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\ui-strings.js"
    3⤵
    PID:9556
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\rhp\editpdf-tool-view.js"
    3⤵
    PID:9832
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\main-selector.css
    3⤵
    PID:10096
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nl-nl\ui-strings.js"
    3⤵
    PID:10232
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\main.css
    3⤵
    PID:9384
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\it-it\ui-strings.js"
    3⤵
    PID:10132
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main.css
    3⤵
    PID:10084
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\ui-strings.js"
    3⤵
    PID:10280
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\ui-strings.js"
    3⤵
    PID:10320
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\ui-strings.js"
    3⤵
    PID:10384
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\selector.js"
    3⤵
    PID:10404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Acrobat_visual.svg
    3⤵
    PID:10472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Acrobat_visual.svg
      4⤵
      PID:10484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\et_get.svg
    3⤵
    PID:10596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\et_get.svg
      4⤵
      PID:10680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit.svg
    3⤵
    PID:10688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit.svg
      4⤵
      PID:10708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-hover.svg
    3⤵
    PID:10724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-hover.svg
      4⤵
      PID:10748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\iw_get.svg
    3⤵
    PID:10756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\iw_get.svg
      4⤵
      PID:10808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\AppStore_icon.svg
    3⤵
    PID:10868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\AppStore_icon.svg
      4⤵
      PID:10896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\AppStore_icon.svg
    3⤵
    PID:10568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\AppStore_icon.svg
      4⤵
      PID:1484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pt_get.svg
    3⤵
    PID:2200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pt_get.svg
      4⤵
      PID:10768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\zh-tw_get.svg
    3⤵
    PID:10392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\zh-tw_get.svg
      4⤵
      PID:436
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\ui-strings.js"
    3⤵
    PID:10984
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nl-nl\ui-strings.js"
    3⤵
    PID:10736
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\cs-cz\ui-strings.js"
    3⤵
    PID:10700
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\de-de\ui-strings.js"
    3⤵
    PID:10572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf
    3⤵
    PID:11004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf
      4⤵
      PID:6172
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nb-no\ui-strings.js"
    3⤵
    PID:11352
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sv-se\ui-strings.js"
    3⤵
    PID:11652
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\selector.js"
    3⤵
    PID:11764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\az_get.svg
    3⤵
    PID:11848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\az_get.svg
      4⤵
      PID:11864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\bg_get.svg
    3⤵
    PID:11872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\bg_get.svg
      4⤵
      PID:11932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-tw_get.svg
    3⤵
    PID:11972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-tw_get.svg
      4⤵
      PID:12048
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ja-jp\ui-strings.js"
    3⤵
    PID:11292
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js"
    3⤵
    PID:7688
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\main.css
    3⤵
    PID:11556
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js"
    3⤵
    PID:11700
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sv-se\ui-strings.js"
    3⤵
    PID:4616
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sv-se\ui-strings.js"
    3⤵
    PID:11916
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\nl-nl\ui-strings.js"
    3⤵
    PID:12044
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\root\ui-strings.js"
    3⤵
    PID:12180
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nb-no\ui-strings.js"
    3⤵
    PID:12268
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ui-strings.js"
    3⤵
    PID:6172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\close-2.svg
    3⤵
    PID:2804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\close-2.svg
      4⤵
      PID:11272
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\en-gb\ui-strings.js"
    3⤵
    PID:11856
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\plugin.js"
    3⤵
    PID:6732
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:12344
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt
    3⤵
    PID:12436
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\notification_click_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\notification_click_helper.exe"
    3⤵
    PID:13232
- - C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\elevated_tracing_service.exe
    "C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\elevated_tracing_service.exe"
    3⤵
    PID:13052
- - C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\msedge.exe
    "C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\msedge.exe"
    3⤵
    PID:13096

C:\Users\Admin\Downloads\WannaCrypt0r\WannaCrypt0r.exe
"C:\Users\Admin\Downloads\WannaCrypt0r\WannaCrypt0r.exe"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1824
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:960
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:2580
- C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 113981744562591.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3964
- - C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5748
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:4752
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  PID:5480
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "muryuubrkh119" /t REG_SZ /d "\"C:\Users\Admin\Downloads\WannaCrypt0r\tasksche.exe\"" /f
  2⤵
  PID:4624
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "muryuubrkh119" /t REG_SZ /d "\"C:\Users\Admin\Downloads\WannaCrypt0r\tasksche.exe\"" /f
    3⤵
    - Modifies registry key
    PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:2372

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004E8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3428

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5612

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4608

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3692

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2808

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1096

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5076

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4168

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:424

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1468

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2368

C:\Program Files\Common Files\Microsoft Shared\Ink\ShapeCollector.exe
"C:\Program Files\Common Files\Microsoft Shared\Ink\ShapeCollector.exe" -Embedding
1⤵
PID:1356

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5180

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4916

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1960

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4752

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
PID:5752

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3168

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1508

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4476

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1772

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2184

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3412

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\WannaCrypt0r\tasksche.exe"
1⤵
PID:6160

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6224

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6412

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6480

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6548

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6656

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6728

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6792

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7012

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7100

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2612

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4000

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6284

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6332

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6556

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3868

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6452

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6784

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6236

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:236

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6496

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7368

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7448

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7504

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7600

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7928

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8000

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8080

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8160

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6304

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6668

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7336

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5124

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7684

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7556

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7788

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8032

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7304

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6468

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6848

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4252

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6716

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:6460

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8084

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1872

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7264

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4464

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7612

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3340

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6588

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7624

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7712

C:\Users\Admin\Desktop\@[email protected]
"C:\Users\Admin\Desktop\@[email protected]"
1⤵
PID:7224

C:\Users\Admin\Desktop\@[email protected]
"C:\Users\Admin\Desktop\@[email protected]"
1⤵
PID:648

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7320

C:\Users\Admin\Desktop\@[email protected]
"C:\Users\Admin\Desktop\@[email protected]"
1⤵
PID:7928

C:\Users\Admin\Desktop\@[email protected]
"C:\Users\Admin\Desktop\@[email protected]"
1⤵
PID:7516

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8000

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5272

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7612

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5372

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7652

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7172

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7796

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1872

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8084

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6892

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7596

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7588

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7236

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6452

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7704

C:\Users\Admin\Desktop\@[email protected]
"C:\Users\Admin\Desktop\@[email protected]"
1⤵
PID:7580

C:\Users\Admin\Desktop\@[email protected]
"C:\Users\Admin\Desktop\@[email protected]"
1⤵
PID:6976

C:\Users\Admin\Desktop\@[email protected]
"C:\Users\Admin\Desktop\@[email protected]"
1⤵
PID:8188

C:\Users\Admin\Desktop\@[email protected]
"C:\Users\Admin\Desktop\@[email protected]"
1⤵
PID:6832

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8108

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1112

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7612

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7696

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6468

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9060

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9204

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9136

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:8312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:12472

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12456

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12624

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12712

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12864

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:13096

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:13192

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12612

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12608

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12660

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12212

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12716

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:13268

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:13296

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8636

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:13196

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12460

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12996

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12636

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9896

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12920

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6820

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12804

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6536

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12472

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5848

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12988

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7836

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1796

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9200

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12592

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1516

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12976

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:13056

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
9e4597d6e9951c90f605fa4a330843b2

SHA1
c9a4c72aba3b9584e03d0db43aee91e51094c369

SHA256
272d838982199dc905b6eea7f57fc331c216efacab7d865cf427fa4972aff009

SHA512
adbf3948d11ce019ee5a0e8971b7b08567c7a3de742e03274ae0bd868f64f4d09e93e91e38681b34eb017af7d4708e5484b776b9b3828715d05f35621423fe05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
eccf25fc9d0bd9cef07e35813b395326

SHA1
9e3291f5985cfe650fb740192ddb4c78cd596ae1

SHA256
35accdd849f39e41a7388668218f5b756d49348ec9bb550a632a1b9613687ab5

SHA512
89c2d89b416c26a0a8c18f96a527165783961cf83227a4a67defb9a09fa9207df443a4bd0ee0a540940554b7bf2d4b6a8060319d45b36b41ac61c2ccb1b4b77d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5db4fb.TMP

Filesize
4KB

MD5
3bcf3b6ece51868e2de252f842fc9aa5

SHA1
625576531bddcc43209509226626b4f77f52cb49

SHA256
770833bf8765d7bf6508219592849c8f8bd5af29f4be3a30dee0a18c44147d07

SHA512
ee50ba6e5bd33c53511c657eab9ebc00bf4ac7088f5365968bb45a45094e5d813a3617d69f5edaa1b08301b2328a2655e59a79b505859e9f9d75a232aa8fae2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
a7fc71df81a07c72f88734dc1b37872f

SHA1
870b5ebb8931da173bafb989764c11018cb98db3

SHA256
8f7f15175015a8875b2c0f2408b17ea8d31f74f0d04d0f2224c2fb233da6254f

SHA512
982c820581b13c8965df15063fb15d4273cf65c70b639b608db83e435a343b39d80ca95672bcfb71d0297ab07fe7c00dad12a57ee43602c0942baffa00add580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
a9f44f58187c838c63ca14809aca2ac5

SHA1
36f771c409b2bf002db9d6e6196802cd4487b97f

SHA256
0cdf2fc4e92af2028bd55682b87cf42a29f297b47c61a417ab2d2151aee9adf5

SHA512
6fe8067f065e8cfe504114022b8d2edc589176fccc9093b6e168196469801d552a2b5e315216148a7a867a2e2c0c3aa4d85d2ac3484bbf6065609773b88edc3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
410e3fb921780f3d788fbdfe4f5ba80a

SHA1
82e1b3cd616fca4ec363c58b84d5195129cad43b

SHA256
6e62dddea0102fd70332fefabefbdb8fd5d689885c85d54bb2933eeee74342bc

SHA512
ab4749e697982b4ffcf299078d0ad2233ab10a6c316d68dec22f6e32c99c1bf98c4b965b91944c344353d9ff273cec3fd7ab89485b97c0e47e9d465f18cf95d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
04b37b08cd16aeaf152a415740b4a784

SHA1
d6e073e5c9b9e319ec6337d8a49a52a669a7bc8a

SHA256
8788f3677b083ac39221136a7cc203993a97cd7039a6d85077136c94a44aa0c5

SHA512
3b6be2bc770695e6d15d2d9988f76a45bffff58924ce14062d1a352fc6d4f07a8320e32b875f74d560d707a4da814f71a481d54d6b6aecc45e123211534174fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
e58fc13a7ae4d50c913ae9b5dec7c814

SHA1
7e269d55fbc6f0977fd58c2179b52be7d1586d5d

SHA256
48b87afcc89fd10955c962f73c42c44606d3eaa3333ff9138b167ed7b30b94e3

SHA512
c85db90d769873f2409897513d9efa1b39a3f121732ef0e924118ddc0ff954c4505c7090470daa8a1c04c24333f93dbd192dd2668d8db18bf746d56f08ba3123

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
02f62074f9428dce5b94741bc0c3bfb7

SHA1
3364dd7b6096be213f86686ba9f49a8e8b7bfae9

SHA256
27549bab553993632cf4ae9347c46f51092acaaf4b0cbe2dfdebc01bd8d8ac11

SHA512
a824c1d6b03a56401b4f1ad9607fabf6abb86342c30bb9f9514d7f4e56f230ed359d2bbec3074227852ea15d2fb0ae6b8650f176c07e328bee60d93018fefed8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
b59ebdf26ac76fd12293e39641b8e3b6

SHA1
d792b6c1c70b31ce561a44521edbf48f3d0d0e21

SHA256
19017a1aa9523323018c9453f2b8fda74b807755feaf85fcf5d8e21fd533e842

SHA512
efc50e102f9913277251857d2acf6a2b123204f7f608dcad29f8be2f7e6f6b3c69f4bde3780c2870df06e89456312aae49279cdbfd93b854aed5fb5d1ed64d90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
6d6b640323d65b17ef86d5886a5b7c97

SHA1
44ebf826b9501a1d245473e9493194e3ec2cb371

SHA256
306e6e1c3a751a8179acc66fae0521c45881288c02347aba85b3fcaaf9b94e8d

SHA512
5e1aa7510c9f038ad05b560e263392080ed6b2b38aa6752020fc2badf883b60e487a72414d4d51149c6437805de3743ee390af4f5ee4ffa0744f6f910eb25b5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
6d73fcf729dda63f5dd81b85b0017cfc

SHA1
b47c811d2578383b31e9d496d40fe007f46ddcd4

SHA256
a3d5ce1797705a1675ffcd404a3d4cebe0381083ae7fe3de71f9155733906d11

SHA512
60e16e114f67cf024b710063145389391d093022187d9f66e95245179819d3604f76f53a12e158f1fce9f5f9a308e51f183ff99e742f4c5854e4324598e91792

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
2f6f128813d77af8451d5b9a8485e478

SHA1
b38f7589f3b4441cb01af23322397da025bcde48

SHA256
a85358c29e8df15619ac56d045b62da22638ae77fa76f8dc6d1172fc3d937363

SHA512
8582b9fefb9c2c01c14dcd0f9021db08fa49b103ecded0067d2d50dbc14e491df4d0d57f6fab1d0fc86bac6e1ea04004fed81e338b13f8e5773bb1c276f35567

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
ebf92bcc8727f8466bcf0cd91ac10aea

SHA1
51cdd04b0f4bdd9146cf03a7d47098958260824b

SHA256
0464bed2a793def4a3c95804bfbcdaa3d919f210909034878446d5aca903600b

SHA512
66c23bee1442fcbde4ab5724c7661600dd51d2a2888fd771790ae9ef12ca0f7431d99e43a8f4691832c7b3acdce2be176fa28d9998e6c6e91b6a34b1812c4adf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
037d3a1ff69e88f306fff8a68f753d20

SHA1
b69eaaf9c6f0075295232a4bb420f7d99c0dc33c

SHA256
ba1cd55422caf5df8af054e6dfedcdce6467c58f6d44f84de7b82f897227c002

SHA512
f019c91fe5750531b161485c493282d1adb61ee3f90f114fb4e601e584bda82eedcda12930c1eb3833ce082d472c495a3fb2f1c0c7b45c96a04e349884c0abf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
460925e57862b70da2a660ea3e0b1372

SHA1
31848bdf3df27ea4ad1b63efeb7d47478ef8e2df

SHA256
78830087335df40127f83bff7c996d75639e1636cbab6db2d2f0f8e182149dc5

SHA512
5274ed33421e9fe980a97cc35c144dc4cc64a83200d511ffa18154f1970d691a56b6d5cc8048da2f89720ef01996a41a93a858b767f7e11198886d58b4dbbb50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
539aa38b06c3fb5852ac236752d737cd

SHA1
edfd2936fc017190cb2020a2178de4aaa575d779

SHA256
54415893227491988ef3577fdc6ab581b1cfda1f595a1a46b322ebfc0dd35c6c

SHA512
2078875acf7e8e8b38c008f2b8baf21d9b9cf3fdf90f15a13c96ff73baa0f1686471e8979ab381bdc9aa092128426703dbfc4b2e552c261875fba79ed1c5b9e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\24270abd-6e97-4201-a442-cf85511e90b9\index-dir\the-real-index

Filesize
288B

MD5
59b48c740ed6ac435dfd7570cf2e39ff

SHA1
8dbfead35ee63f932209872be40495570be74258

SHA256
f4e8ffa790f506139d837ff36c900fc0861a6d55c3b8709dbcecae2760ff6fb2

SHA512
243f76f7d5e8b081f29e18d61ecfe9e06aaa6a3bf20689d6c0fa84e8144e83195bd4518579e5a3da47b27ab8f411a2fd508f419ed0f35200a4a0958cbbc91b85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\24270abd-6e97-4201-a442-cf85511e90b9\index-dir\the-real-index~RFe5dce7e.TMP

Filesize
48B

MD5
6b142d29b3d63d5c3e84b0e2d1d7c00d

SHA1
2942725cb0d4196e6777393ffcf10c6019f05476

SHA256
5310d1ec2adb101c3748c47dd768a054e850d31593c070b712e8da4f2377968c

SHA512
545d2046810169c1d275aae18fdd582c86322f2807a28b81a7d32e89eafdaf347a77cc59a5f682185f06a7d600f113a0c0ae909964870ce15551f75ca926c7be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\65027ca0-9cc2-4a69-b87e-3d6dc1dd2ae6\index-dir\the-real-index

Filesize
72B

MD5
a6b6cdb38cabd94e8c2e9b209b8410e8

SHA1
a78163ca3ff645e7df9f86d44ece75eb47684b70

SHA256
64a7b7ec4d3bb10fe9998d76c3ee6c5fca0000720814f09e9b240e0bf586a4cb

SHA512
e30645d61ea5f4d2c90d4667faff0181de32df2d79f5633ec5a4994e6f2c2f27260b3a6149daba5227c2bb057cf2eae57eec7ae5f8cc98f04028e9a976d9521f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\65027ca0-9cc2-4a69-b87e-3d6dc1dd2ae6\index-dir\the-real-index~RFe5d4efd.TMP

Filesize
48B

MD5
086e6d09019900599fcf68326ec4b8d2

SHA1
077b875b4e23125d422e1ba6df9a0f3b795b562a

SHA256
dcb79f32c9cc6b0d01a3c247a5af613d7c86bee5fe40810b487b242c62cddf82

SHA512
5827bc39c20d084ece9f646d8a83571e45dba618d5d92dd7ff18fa421ea25889eddc233fc6f68cc5a671d27fa2b2c0df00ccf47b8caa660ce90833c57f3cad92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
182B

MD5
69e9b38cab4e08b9c4afc1fe8962d468

SHA1
039faf4bbfbc1c91a742500b5269cf321e985c55

SHA256
31318b797278b64e711f0a0ad565a7867917f4a1315def3efb13b9042974561a

SHA512
288fd97e85cd5e47bc78483ec9106be7b0a8d9d29383ff1f1c23cf2a6e4f3dd031996951bab64bc97bf6baef798424c7011ee063b4a8c8b3ab1d4144bec8da74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
257B

MD5
5b7a0abc0d5e216d3dbf3a5b0b74cf47

SHA1
2e4a1d169da380912cf9619ab58deda9ae0ff168

SHA256
f619e6a6910aa9d09d8a0a040662987599f0e19113a4e37dc04366d8b8bdc6f3

SHA512
1f1cd4fda988e0968c50ff3d62a3ac8bf40145667491f3e5aaaf9e526e1a7cb3b499a39e07ee8ccf2cb69479abcb52f6ca190bdf2dd8bc22b6bb9837de9ce2df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
253B

MD5
64faef48cb3393aa314272637c634e66

SHA1
9c7a5cc3bd90e45073cefd3c537439410fdff447

SHA256
2f532a10c568fbdbd7c0e3686f199ed7b8c7dea43bd153d4ad58506fc4f8c8ec

SHA512
98c6c56c7482f550446ed82ec85c9d9b8a4d1188da28973e9592153dab0425e43283e5bb70da2c3c86c8ab6d91b6cdfe09c03acb76d415bbc02750e0d898b655

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe5ce101.TMP

Filesize
119B

MD5
5d37e4602158223f3398bf1ad690fca6

SHA1
a43e673a785bb5f03d0c5b998a07dcbdcb7c9da3

SHA256
8f17e7f49f0e854b9c86e43e8845d0ebc386d3ba13bbc5ab2eea0295dfcea6eb

SHA512
32b56edfc3bb766239885957c0a158c5d7768740b90f57d675f39db665543e70ebc97a0e41a9d61e850056945a8e7758a7d1beed5bcad687f37e1c968c0dce6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
bff5c51f680449be4062fe958578d961

SHA1
fa9dbc688942bd35ce6082949db8b51e89ad6db4

SHA256
b9f31c063eb794ca8a9f0640c0e482c68875bbde80362900e9809f1b78537b5b

SHA512
f726b47ae87fbcef791f196c2ad0ea6e8e59102aa1437fdff818298636556c2f0f4efa0922073865daaf878e8139f1a4ced6e6eb98d08859df7f81a3fc42d8fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5d2f40.TMP

Filesize
72B

MD5
c46d9ca27cf492499c40efb954ae6ee2

SHA1
0f09b59a334797a2d03c770cbe720d5a7f84bf61

SHA256
70211de257d5f781f50daed667b1d43b4aa958e3013c8e9677a13a8b7ee6ee55

SHA512
b392c4d4df31a7967bdd76d57da940247d6d7b368cba35f86a0efbc85aa3bb94f9d0b1e92e7c84f982484e0bbb6a9407201afc1213c963f423aba68f1e670762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
23KB

MD5
e84c7ff0b9caec6a7c3ccad6023a99b6

SHA1
a6eaf8b21ed1937d6d5832bbe84cddab5213e767

SHA256
a7d215c4ca24880665722a78b3ac9f1074f06fe65673d45d5fc1834a2787f35b

SHA512
af143a119926f51cb862f751a54ec0d946fd6303ba0c6460f0bc3f58519c263d8b39e4049751f20638d0ac0437acf94ceecba8e1ae0d1901c0c034257e1f93f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log

Filesize
2KB

MD5
7435a9874e90a4aed357d79dd3a2473d

SHA1
f59aff7b839b0448d34514026e94f18e2582cf55

SHA256
f5f4e73ecee4930ca98672011f1f7d02de7c9e60a94cddccafcc9a3e7d68425b

SHA512
655881e31e84f254306720e218a787206a3a0772a289983c8c036185d1f72f017e71c2278a9a9756c101e1c1e5c316f71d3d591c5bbc6d50d7c94a2019d5c9cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
1a10aea1757935afa3724e62114b8fa4

SHA1
c4552cfbb2c6ac5e9158e4843db44505d45907af

SHA256
a715d32e4978393cbc20a8a81ab1631a9de74bdfd4c4ed9157b8c2727e81f09e

SHA512
fcb997345ceb440e61e7d6337a47cc144a5ece4bac03cdb2bf54e2fc6a83ccb3866938696fd836420e728e233bed5a85b3df47f35373bb0f5171afa88fd52e52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
42KB

MD5
6c325af1048b7edd52888b96252fa15c

SHA1
2f961d33ed996718e60b83b0a9815295f7a9cc73

SHA256
ae5426564b343271079b5db12dc10b241a5d5442871511f11d9e7c2fd11273b9

SHA512
96adb051962a1e419b2dd1f3f58a7bf7b5b432bf2d699ed1811c6f934777b3b10d2badb0c6798d2ff8253acb3976eb7cb58bc19f320c875eb3c5a44c7752454d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
42KB

MD5
e57331416f5997aa80b64769fcbbc64c

SHA1
117d93d0cf4a3274ea56d986c34c9abefbe3bf95

SHA256
8a158ad331ffe0b9ab5a339a480a6c96195c8012d52284bf9ed41e6243186f97

SHA512
6c2b66a3d4e685a971c26c514e6d0daf97ae5b77d30c4bf387915ee816db1e791435f44a577b6c21cf86002c7f702ee785da2f066eec9689889a57e56d9da51a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
8b324a6acb64b3895d387498e3bce549

SHA1
03c36ecb33363319fe86671406614ab689f4dc8f

SHA256
b971b8cb79258788650aa95aa77b673ebf3f44332dc0b50aad8fb460663d76a2

SHA512
12825788fa4fc5eb370b67c69dd94f6f1ac7bd57f6329d1e918090af6e916bca99af6e6cde5a687b10247205a76282768f155f23b479a308b5cc0d773ea5cc31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
42KB

MD5
99b392d820db759c9cf0257f34d02e34

SHA1
3765aa0e520b6040cad472226e7e0b7068ccf2ff

SHA256
b24b3c43145c03fd5ea770f5a926ee5e05c792c7ed4042797800effef13a4db4

SHA512
c7177a2f6cada80a7e62a831ab6a5857818ca28588375d6f9e4795ace9a5364c031fe1723696b8b1de65ea808afb952b93537055c9660c9ea0eb40c00653ffa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
42KB

MD5
b4af2978575e5c2852cdf612593d4dcd

SHA1
2fb2d1ac0399646556d07d6b04b5f7633bf39e92

SHA256
a09769973c5fe7706aab927b6070341f34b06050dc747c622571feb4ad18fa77

SHA512
cdb85e1819986fa718ce0345aee19a7e3373f696b587192f5b633a5885ba7f63559dc75545b276020ba5d90656ffc1e2d071ec7ebc9bbe2aa1a7a240a6ac0e13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
c9e699fce35bbac2935eb157f7bec94b

SHA1
d574a247940ada3be5650170a2a3047f5d000979

SHA256
96d17fd2c9e5a86583129495063c24d9b2f92779ee665455a15fac1f0bb444c9

SHA512
6a9f1825eb429732fc54204af7ce4a3f953fac2a17b0c63c767af1fa797444c34e6877622863a3f505b77f2ebdf0dcc3acc555dacae642ab46a9197e681fd74d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\activity-stream.discovery_stream.json

Filesize
25KB

MD5
82258361f4fd31306a92b7ec813c23af

SHA1
acc945747f698aa15016e08c67485782dcd5d6f3

SHA256
756e8d12cf84d80ab5076f930d0017542291feadc59f4cc48cd0488c6ef6942b

SHA512
a566085ee53a3487f2aba63bd86b853ea4683c6129ff46ee44e9d4c00e9bbe0d4b77b927e9a2faafe98655d3084385d3ae272d1f9b014c0c92e6e3f9f3709473

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\cache2\entries\A585344A45AF937E3AB7D706291A9A3ED8D581D9

Filesize
13KB

MD5
beeae379ef41ae807d6a4c4e96a013ab

SHA1
ba903cccb375e4dc4144c0b914cd79bea10ba326

SHA256
6bffd0f2c7062163229aa5f112f431163387e0a6b966432006bed931c0299f52

SHA512
baaab02f4501aab1e14b44209bf68c36df205bbd07b75fe82de79aa13da2ec4ebc0910e1ca845a94549acf5b86b98827c68d839b72b8ea39f00f480b6fdd7966

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\cache2\entries\D9BE8A0190C9F0CDC43C7996CA57CAAE4DCA34C7

Filesize
114KB

MD5
9005ba12580a006d9df45280292ef75a

SHA1
0e912b1dfdb1174b80772401e37cfa16ab5b6fd7

SHA256
4af2d6bf986834afd8a3dbed8fe2158411defc33fba470cfcd03af2f8a2bf082

SHA512
fb07d6f3ff1099217aa2e713692c8407d839646e7eb128ea138fe11704f42c1c08d1a114faab163ea677144289eac6691142f69cf5ba3fdfeb8a120d693cce1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Filesize
3.3MB

MD5
05098733b42aa547546b3fd7d4eb95d7

SHA1
e756989fb205516b665610ea25f9e897295ad792

SHA256
c0d0291ed579c974d771ecf6d255fc21122301868e40dce5c09fc67479a488d1

SHA512
3730d6c96050c6480ddebf3c92549c7135c67b2058ec8ee88c9d7f1fd6eb606918ed25f4db9fbb111930707aff7b96db906ef301a4e8674cb9a321cde129b97f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
502KB

MD5
e690f995973164fe425f76589b1be2d9

SHA1
e947c4dad203aab37a003194dddc7980c74fa712

SHA256
87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

SHA512
77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
11KB

MD5
25e8156b7f7ca8dad999ee2b93a32b71

SHA1
db587e9e9559b433cee57435cb97a83963659430

SHA256
ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986

SHA512
1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
14.0MB

MD5
bcceccab13375513a6e8ab48e7b63496

SHA1
63d8a68cf562424d3fc3be1297d83f8247e24142

SHA256
a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

SHA512
d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

Download Submit
C:\Users\Admin\AppData\Local\Temp\騩領陥芝到盌弊咎蕳墫浿猎鹦屮阮棿.txt

Filesize
260B

MD5
85b28acb825a8cf9be9da81a02ea2391

SHA1
e1d9f895f37bade054ff5a52bd148666254806f3

SHA256
060e2b2613bdae348d28f8ae2e27724a7702be7be90662b941cf0f5c0eefbe97

SHA512
be260feae32f3954812dc86cbabbd5d8287ed8206632913aea886dbc6b242138bf380a9f670c975d580ad705446a01c789f4e58c936bccd5dd7ff0ea6a86a168

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
16KB

MD5
6136fdbfec1b46f396a8804a79016932

SHA1
68644d87ca3e47cbe5524bdb5878872f27a475b1

SHA256
de50979a88c71ce347aeedd4364283d4624bd361fa549d0a99202937c2dc52f3

SHA512
776504a70f34906e303338aba12c2c1241b35308ef602ce7ea473fb8b9233457c6690fd243744bd1358ccce82adfad38f1ee1b2cb691716aef3814b7f462cdd1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
16KB

MD5
bb51e75a2339542dda754294e6ca1a53

SHA1
d3e38466a1587c793768d4e0e009518994259d8c

SHA256
ddc409c176289e2bb7bda8cf7aab3388e74a69693afbdedd59b9d2680841732e

SHA512
ea51acf61f4ea41177e2585b24658884b2f1ab7d86d38c8dc8a03c8e4c771c7487af618ab7c4693b660353a0692e8e55919bf456d304d1c30ee162f53b3cc810

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\AlternateServices.bin

Filesize
7KB

MD5
dddc8b38c92a6abf62d43cf1ba112422

SHA1
9c8d021b3117eeb057a623ba03c6be7433dcba20

SHA256
dfa18514793bc963e3d51fc1824a41acfbeb24688f9c39e8b2bbf600e7123b6d

SHA512
a71a67a268a4b555ad98b75adf8c88b61daadcc276fbe625d9e73d9fc07e29ed1f14bfda967764d6a837d9eb4d7854ee8153fa4aba65d1d0a73b568552f6b1c8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\AlternateServices.bin

Filesize
11KB

MD5
a6082aee8ea0f1db355ceee5570bef16

SHA1
cb5f718c6172c6a52d8c8c1af7d192afd1169c0f

SHA256
ef373fb8fe15809fbc8232ac6799b27b32cc4bdffc46e4b5744b29dae38a4d67

SHA512
67f705e1a914b7368bc98dc0f217d2b77f0c43a471b4313ad837968d73c2bcebcb9835b78f2ed788a4c5bf45a3d8963beda051a25c4239b471ab673ec6900c28

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\cert9.db

Filesize
224KB

MD5
5c205f3943588522d3d43f929bff1de0

SHA1
07d30f75964dd30b456421fa6c802b722a6c706e

SHA256
c9db3b1ad1503ddd4e592b4f7ea29853e6ed7649fbe16ad28078b9e9886ff937

SHA512
263c93be6c373f3c6239d82cc6386cf0654e994b277141d5c53f35405bc2a442448b7ee1bea524380fe6c4ea86015d9dee1b5c10e39d66ff07e26f3c4f55a676

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\datareporting\glean\db\data.safe.tmp

Filesize
77KB

MD5
d698c839baf874053c44f0fa37af120b

SHA1
c82102f5d6f1b4dc2cab8530e154363165c3b597

SHA256
230e4b2c685fc8c4028f47c2ed7dafaa5ef7dfe45140f126484576d8f61a0e9c

SHA512
14e8abc6aaeedf2f2fc43207ea5828e08185a84d9185ae9518925587e7216e34678b61fb164c36ca6e59e03706cd60518a86eff4d71f335b774fd19c00d7d99a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
2ba234d8d0fa15fbda9b2c735f2532a8

SHA1
9efb161c6028efb96492b01ce9b442dbb866b599

SHA256
39ecba3e481857beaa82d40707643628ce3ee1fb29a1f5b5886102529cc333bb

SHA512
ed65b050e2ac879bfc2d13adb2e3345d7513c0a2efc01a80d5b5f7452e24ce6739387a688a6b914641f3a47bc64d0829d1d187bace952d9a6c19f1ef382d37b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
46559bc438a4d7fb1d830a4d15ae7f40

SHA1
153f92dce8b33f3e6fffdaf61db77334afe9539d

SHA256
7badcf1b759c6686cb83bed922e3dd6d50aeba79aadd21fcdaf081a2f0992d20

SHA512
6bed04a4e4082dd60ef943ae821ce11a412d0abedc010a5c5ecaddec60dd5c48672059c1aa7bfbb72e9adba5ff99cf21695ddc7abda07011b2e801403a5fcb47

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
c82960807512e325d0937e5b9b881f48

SHA1
18a296f7f5529467aed8e4668cadd83981985680

SHA256
6243773a885085892fb6e9cca4e438ea2996859308c155e3881ce1922b7f1bce

SHA512
758c46cec330777188467eae6632e159ac528e2da9976ad37ddfe1254aad534eb833c97cf19b574c3ea656341557b56505f20df86fa202f5d598a5c22a5f88c3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\datareporting\glean\events\events

Filesize
5KB

MD5
840f20c2bf9c84fc59af794b66813fb5

SHA1
32eae11c6c3b66e2d80a25fef755e3ce1fe0dcbb

SHA256
00c9ebdfcecc08732a3def4f73ebc3aea67c4f6a719dac0a3ca10dca41f3a67c

SHA512
5d9d309df9843cb6c1e1359f249b3f623d778bbff78fe99773c8c4c06956303c530a9efd4d586042b6a4b063e7d1ea3f3269693d52c2dcdfa8c8bf00d26bf60c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\datareporting\glean\pending_pings\165e31bf-4127-4b50-8528-144eacf8a09f

Filesize
886B

MD5
ed6a66136860fd899363cc7085160a8c

SHA1
f6c60c47206c6f839d9a87671fb0c36712f88839

SHA256
ca4136a0461f33b398aa19bc5c1a2217aab8b38bf9428ebfd9576f4a38f3fa07

SHA512
15d2579ad193af00c226a1882566c576f4cfbc3216c67828a34ec09d50567528cb813cd3781e51763baf67fdbc5b5c7cff03f4329e1007239cfe5027f0fe6ccb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\datareporting\glean\pending_pings\1ed79b4c-6949-46e6-ac50-12f2bf9ad415

Filesize
235B

MD5
596e46efe524b2e330caf803307e6aca

SHA1
e76c29f04b29c1b7b71bb9fb00d036f62077c53c

SHA256
ed92bef5a1e6a7527378c715e60cb5c78dbe05c30bf9e4ec7cdbb4467d2d0ab7

SHA512
60c367c47decf4bbb076dbd69dceb158411733040ca07d7f6b45dae81225d85627b44ea6b838b38f68ecf103533574bfcc2c9a46d5dd184e0a6240c57ed38b33

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\datareporting\glean\pending_pings\2dbd75f3-28bd-4def-978d-8078c4e045fb

Filesize
2KB

MD5
e6aa7fa113fe241ab39fed0542bc18c9

SHA1
e0b14cfdb4314eea3e71866cf27e85c89786c307

SHA256
5d144701284fbf66f03790b450e8f3f55217dc71e91bfa33af59e98fe792db9c

SHA512
63eef08599f73cee5de56e164b3c8453a2e1fdcf8dc09671a9360406d1d09e2a2713d1238b792a50b7fe8ae6eb2d34066b80471ebe2399aedde43c4b2def386c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\datareporting\glean\pending_pings\328d7bdd-5437-4fac-8f0d-3e35fa82eba4

Filesize
883B

MD5
30a581342f130e082abd82d4016aba87

SHA1
3f5e9fb8db90f0c8a86f5228d9ecdb8678b43dcc

SHA256
e67e0544c1e53033181b7459c686c9b4ce534546a379f553e6167b11b9ef7c82

SHA512
4886ba85f32b527169ec760274406c5244456baa669473fc637dca65af92331603b7fb29d13362b750fb5474097e40a908184324044fed27526b772406f96366

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\datareporting\glean\pending_pings\4b4607ae-f11c-4ef0-99f9-5a6547e0e0b6

Filesize
235B

MD5
a7003146dd24dd0e1a5076289dc421b8

SHA1
d27a7820e527650f6572bfe2fcd6ae6e9023e959

SHA256
ba576ffbecdb6f091eb7ee5cf4998c5daecb14a311f18aaa02d1cb466f618d8c

SHA512
366d36274f3d57b79061fade5b54750d1b64b892270010a3741f58318905340cf98e1679c4cd5de6d3909f3813f32a1ba6d7107fd5f9ed9a9242750f71d9d8f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\datareporting\glean\pending_pings\50e707dd-62bd-48d5-8423-4b9e30cf9416

Filesize
16KB

MD5
4d2da2f60b4ba104678ca248a7276ed4

SHA1
def6eebae4c2cb0bfeb12d64015d166c5ffdfd94

SHA256
e6dc28bcea0ccfae91e68b564289e65de262e62f4d2fba09a0ddb5283d46b80b

SHA512
d2b80f237246c8ba815282c1c9cc4fdf66033706ec59915b5957fe20600e5e3f480ca7084f4e54156c288eee1baf468188bdc3fbf885f8b44dd3f2145568b6c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\extensions.json

Filesize
16KB

MD5
5f41cf058d84082f8448388fbebc04c8

SHA1
d334c75705c150d70ad88184c9772aff5427582f

SHA256
379a31ecdfb52555fd935481374dba8f5e80aac25c23026ac18b0ca3af78c5f6

SHA512
b065ec85b7e82b6b802e4a464ec63f193ebf6e898516706f5bd390975f3f0b98c51eb7b514a4b3d7506e08f4d9a2a755877942857262f7f78403c2fea594d385

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll

Filesize
1.1MB

MD5
626073e8dcf656ac4130e3283c51cbba

SHA1
7e3197e5792e34a67bfef9727ce1dd7dc151284c

SHA256
37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

SHA512
eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info

Filesize
116B

MD5
ae29912407dfadf0d683982d4fb57293

SHA1
0542053f5a6ce07dc206f69230109be4a5e25775

SHA256
fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

SHA512
6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json

Filesize
1001B

MD5
32aeacedce82bafbcba8d1ade9e88d5a

SHA1
a9b4858d2ae0b6595705634fd024f7e076426a24

SHA256
4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

SHA512
67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll

Filesize
18.5MB

MD5
1b32d1ec35a7ead1671efc0782b7edf0

SHA1
8e3274b9f2938ff2252ed74779dd6322c601a0c8

SHA256
3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

SHA512
ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\prefs-1.js

Filesize
8KB

MD5
2354f8e06677cc48ee19a060ce48b388

SHA1
03934954aff8fc14fb51ba865091c4191533035a

SHA256
cd7c68dacd691f3ef4b5ffc65efdb9638003fe4f8ddcad8ee26d8792e0e28235

SHA512
4c50b418616fb6bf89536f376a5d0d9c3a39d18938d7060300f5bb7d10b026c8fcbda296c74a6729d59576dc3462dd0847fde33de517a1ac375dc407588fd8c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\prefs.js

Filesize
6KB

MD5
18ea63ae04a900c750c3a2ab44ea513a

SHA1
cb3e7daf501e60b753f7ec6ecd4f61d558114eeb

SHA256
06e9c79aafbbf8dfe5db241b233dae0e841743b8c6c0cfd84b7b726be41b331c

SHA512
915e6adc3f42b4f5e82b0123fb247d1eb4e195eafe18635710e67b84193ea011791a5d13fc9ac7c065da92eb25b931b7926064834802ebbb4ec0751c96f12323

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\prefs.js

Filesize
7KB

MD5
a983db5c0ced6dabdcc4befd9824d33a

SHA1
234eb15c1cc94651844c6bebd34e67158555d834

SHA256
1a6503bd6eef1a8c57c46d2cf015b6c8ba5b3724e9af42b83a31cd98bbf19bb0

SHA512
142c15fd1551b98603303ca50dec425c0f6a09fa138f1c243d90a4738cf04c9df710e38ec50bc199e30dd07ccb3a29d16bf323e5ba354eff3d29d90dbe9511f2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\prefs.js

Filesize
11KB

MD5
c0787b07fdd5b57036d37aedddba73cf

SHA1
cd93c3dba595bb6123f1bd68c37dbca621f6c256

SHA256
2d02b17a499763da8e38937b016359596d9b70c0fa19fecefb4d15940a6ac682

SHA512
293f993015df0fa8b82d475a1ffc5b6a01cf6a966fdc8951177f2a11da461a75595b9b31e9ec8ebad6665a576553829b73b870dd2fef44d1496455c2cd7ff861

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\prefs.js

Filesize
6KB

MD5
15aa8ed1e63caaa2d47173edb1a64f81

SHA1
5c75370dc71f654f1cf742569e53d219e91e243f

SHA256
fdafcf8c33cf8ae738b6a80ff8e627acdc12c090cb42162f5e4f77caec16054f

SHA512
752a85a1f88c046f3eb81b40c09a757df38b0f80b57e2ba6b40f128c8dc50c5a6b5f438b414f5c951812fe76c6c925249402207877a837e6c07239afaf95a119

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
26d45ad256aaa34b5179d3209de1797f

SHA1
f5a9825c503a4422f3b62c2cc9ea798fb45cfdfb

SHA256
d880f5d2679528bcec0ad8c80f1fd75a79ea0cd199c3b33af221faaa04f17f5b

SHA512
4b698d6917a229ce7dbf6f2cf74f2d7ac306b67551615b25ace35553205fa25ecdfd91cf7c478f187f55dd5a07c2c1ae24f1eda244d68809e3b3f6254a9e9654

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
01c2d3d8fa6f06ce6c1d4618da74cd48

SHA1
dbd9c67e9cf3e135162d9a8dea575a3439a582ec

SHA256
806a61b557ff166ad432ae8e7cbbbbd9d9ac3bdd252dfe96d0ea2541a51de0a8

SHA512
4ccf90950d769cc995d05b8f082ec4c185e3904be3fd40c12734c4c78f3c5eb0ae74525ecbd979fb6237c5eda9475233cac8df49a735b696e8dfe1a49b253b1b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
b6bd520e6e449b8f04d8aad32a1a7313

SHA1
01c16d0566c51d13b617ef02e2b6efd9fccf6239

SHA256
f806de6da779a56321e3765e75d960e8b2b1b70a127381ee6eb3fc56e2724246

SHA512
1aec7b9c54955c2557ea11313e9f51a79b453ef4b54475215b48e7003c7586affbb6559650b83ab952ff79b4254a63027eda43fb755f29adb1271e8b3f6bfed2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
c253a68ea2e7e53c9044a4dfc3ef1208

SHA1
96e09afa66d9665bb9b4ded2f9bac9626243e0c0

SHA256
5720ed8a0935ac8df1efad5431b958c18b5eb5fd1825a628db8c0a10a8a716e1

SHA512
5a6d5f8ef93b2d53b27dd4b615cc61ed2fa11c7494b044f9fa85131ed7f02aa91764f04527602798d5469b84e5dc7aaa413ed1afb77e03d79e22025aa84940af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
77d5086acd32c873a8cde7f5a407b81d

SHA1
947b193ec0aa789eee1a0fd56a95dec516f559d7

SHA256
0f97671dcb4e8b3fd7fd577dc023b5a9c1378275a0af82565896a260c8a84677

SHA512
0fbc41b54db73ac7f9e2efac17f614ded9932a6d7c3705962cc416dc584eeadcffb00491739d233c646a49c0b9e8f6b4fbf81e5f289fb3817e21859d0e525ac4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
3620afe17e0da50619efee4708bbd9e7

SHA1
5dd343691a6a776bae9d454a8338bd9411925306

SHA256
4c04f6533eae053f96a00d94ff343546df97e17866984f15ffdfda899d240724

SHA512
1fbc7956bc9d45a961af01c6b536167a6615e753eb1465d7d2cd4d33feb9514dc50a2ea203cd047899f823e6dea266221cd9357b665c268ad56df4f01af1c123

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
ea40d61005d7c0851253bd4926ef2284

SHA1
f4eec271ef156b9d882a61f4c1cb46215b6eb9f5

SHA256
cfd1680cb0ac122f7d4a90e86190ebd45b9eede02e6fed33431cba521d2d38af

SHA512
cf943e2259dad578e5a5bb90dd268f6c4fb6d770b4ac276f2807a1864ba73f547f46e88f389a1321719079bf6ff4eb86fa6bed6183ecf91d4c5955fa365e112f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ij0hd5dx.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
3.7MB

MD5
5d84a51e304859e667b7b1774c60e956

SHA1
222a790f856c65bc88333769147e3e16f772e59d

SHA256
e7c6378bbc595f04bf2dc9e98e7039f6eb8662f3fb4e17246515afa03c5dea31

SHA512
2b72e1b1dd1aab7a108dd6ae78a9cba03ca79b4d6a925caa0646be2d205d77cf75763ed72ca8ecb098f4d2bddbe52179fb79767850aa1dc0be70053060bfb726

Download Submit
C:\Users\Admin\Downloads\ConvertToReset.asf.WNCRY

Filesize
546KB

MD5
c427f6b3846b578b86199a92660d4c50

SHA1
d6367b9300ab907bd306efcf42c2deac644f2b34

SHA256
85ce04de69dd12aed29d46698b243e0f8726cb3700db42b8b605d275da608568

SHA512
1d1ddeb8cfd822546176042be0cea37edd5565adf640b11388ea20807d3297c0e040bdaa4ae2014ac2af9ac129c03807c473a8b7ce21a70a3ba747dabd3b0a91

Download Submit
C:\Users\Admin\Downloads\CopyNew.xlsx.WNCRY

Filesize
401KB

MD5
dda1a438284506f5de547b2ab93a3049

SHA1
085e491ed1074f47d3ea4683dafae0edb0eed878

SHA256
e2022880aeaf931a583117984e6eafd3389c764b589961b16f6aefa809065138

SHA512
be7127d0552478b51eaed86d7bfca29472ef0c2aff5d59994981aceda41892f4c3e632cb21579c62f08b2af116235b9be6170066e1dd7c6f071d4597ff1ab80d

Download Submit
C:\Users\Admin\Downloads\HideGrant.bat.WNCRY

Filesize
270KB

MD5
49893ecc777e5c1c7f9496f57cebe287

SHA1
5007ce05c5985720147fbdba35dcc480fdfe457e

SHA256
bd8e497b4072ee966c49f82506913cd8b5cab893a9339e284a6ce527b489878b

SHA512
29c000006767b3786a3d6d2215f9aeef2a158b111d69a8e59174d59993acadbd850a8aa98ea267d4e7f19c4c877bb0b61e0ab02dd656cd8aa4085a5a52a708c3

Download Submit
C:\Users\Admin\Downloads\Monoxidex86.exe.vir

Filesize
289KB

MD5
5c378b11848ac59704c2000b4e711c30

SHA1
6a46c53fd89b1f66d3fdab7653181e8a3e56d418

SHA256
bd764fe2f9734d5ac56933ce68df0a175bfa98dc0266ae3cd3a5c963267ea77e

SHA512
c6fe33ff3825e9018abea99ea49dc5221f2abd96bd1099def898425b82c05f9b9ca1aacaba0b7ffb7d09a7d097eae9937abdc13bbf3e7643e24e37edc7841c48

Download Submit
C:\Users\Admin\Downloads\PingGroup.tif.WNCRY

Filesize
335KB

MD5
e6b31c45e62f0a2e10f2ed936d6caa8c

SHA1
6f7b8e9d4db0d9aadc89b9a164704f766fc74115

SHA256
553edde66d4621360a6935d9afefb39a4d8e89ca9e5052906a0b23f791021db0

SHA512
824bc841367e3fd155f38c896a2677d106ab4a6530824c36448fe83e2bd0a7b0c902c6ee21a57235aac8e766cf627275a45778c66f1225c6896f1c38ac10ce2d

Download Submit
C:\Users\Admin\Downloads\PushRegister.xltx.WNCRY

Filesize
507KB

MD5
5bdd4f39fc277943bb516a4a6d7591f7

SHA1
763fc8d25a146ac4f04d37893023a17b6b7cd4f2

SHA256
8eaeba5399bb3792aa68dadfd0172f67d10346667a5b61a6c14edb07f3f7b485

SHA512
3ab6eff1ab642615bfa8c6052f514a05a24793a306fbbe1da325555d7129175304be3b361b0efe49e2d89db6a4bb290c8ededca0dbfee189a4c9d3cb5881b8d5

Download Submit
C:\Users\Admin\Downloads\RemoveReceive.png.WNCRY

Filesize
349KB

MD5
cb8a0441a40fd38c12c2555218b6475a

SHA1
791519cb4807008790b44806b5fba3067de388eb

SHA256
4caf2db84929da5da7f0dd2413245a1e7921c6fe001259fb59e64925e73624ab

SHA512
1f1e3b4b771a34199fa39015a9324336c6386b5aa83b72f5e7bc7bdeae2adb434806c98bf5ec6499bd81f2335ecd4cdb8c869dadcbef30a2bf65e77609bb3952

Download Submit
C:\Users\Admin\Downloads\RemoveSend.jpg.WNCRY

Filesize
362KB

MD5
3e47502230f95d4792c9dff93a2289a0

SHA1
6980113db59065273264c86fbaff4e7fccf5b1a8

SHA256
501f41523cf6c731ec4bd061a7310fdfa5fae8251f5b7727e29037bc0eb928c7

SHA512
9bea646969e045c0a47a8e7deafdcab27390f4bb318bcfb74316bc2777e595755d66f9feaef37076a2e5f3b947327505eda3f98212cb48ba47662b6df95d612f

Download Submit
C:\Users\Admin\Downloads\RenameSwitch.potm.WNCRY

Filesize
612KB

MD5
c9b32c921e6e277e463b307972e8e818

SHA1
143584adc1f105d8efaaddfa35dfc3ade7e3d86d

SHA256
22f6faf31cd98d441627c249efcb3a575785bce6d1fa8a79641659070cb51222

SHA512
973d9dd8353c90fec32cfd7e80784ee603c69989a49ced69a0e558d2239f06a894dcf9cdd5c63747f49061d40f0d349aa823ffbe3ce644e944133395f68e2801

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\113981744562591.bat

Filesize
348B

MD5
16a4cb5a158a7f698730b0b63fe9c53f

SHA1
c22fe5bbf3ee4509c185e493a799c0a9ac779c7e

SHA256
0d0541fff4b5c257cfa41cf2aab38ca207804e7bc3251d3aade104beca73b137

SHA512
4a8049b0ace11a074b8648ef9515fc06fb771ade4ab11fb6f123d6ff76cb581295f01de4c8b6c5eeb445d9f7c0dfcb1ebd6fadb08f56b4239d168d4bd1106afe

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]

Filesize
933B

MD5
7e6b6da7c61fcb66f3f30166871def5b

SHA1
00f699cf9bbc0308f6e101283eca15a7c566d4f9

SHA256
4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e

SHA512
e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]

Filesize
696B

MD5
c0ded0093044768ce213df8f896babc1

SHA1
0f706212b3ddcebb95bfbdc656f1e1eb01def649

SHA256
a47403ae6f883fb73bd8952329995ddee2252039567c6243003e09c9c5a15da9

SHA512
65047feb5816e58b5a583233cc13dd437a8a6b4b8b7b806b52bf82692c3394ab21e3e7fc5bd115cd1794c8b7bcfeb390da62df300119eb6d62781295a14ef8da

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\b.wnry

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\c.wnry

Filesize
780B

MD5
93f33b83f1f263e2419006d6026e7bc1

SHA1
1a4b36c56430a56af2e0ecabd754bf00067ce488

SHA256
ef0ed0b717d1b956eb6c42ba1f4fd2283cf7c8416bed0afd1e8805ee0502f2b4

SHA512
45bdd1a9a3118ee4d3469ee65a7a8fdb0f9315ca417821db058028ffb0ed145209f975232a9e64aba1c02b9664c854232221eb041d09231c330ae510f638afac

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\m.vbs

Filesize
227B

MD5
93e7789ba451ff2677469765ae70f4c5

SHA1
ae58d6905d8de2541de0b54bc405bba0d04072c7

SHA256
365e4a23210e544d4b0df2cc58b74595d5bf19d7b42097da13f5abf6472d5bbe

SHA512
1417fa2c57b3abc4a8c545835cfb623a38d1fcb7e81f6065d0fd80ab70dd6a3f4a104037a6f6212d4e61115e74792acc1d56836c2f7d228b595650f5be39debc

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_bulgarian.wnry

Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_chinese (simplified).wnry

Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_chinese (traditional).wnry

Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_croatian.wnry

Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_czech.wnry

Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_danish.wnry

Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_dutch.wnry

Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_english.wnry

Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_filipino.wnry

Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_french.wnry

Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_german.wnry

Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_greek.wnry

Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_indonesian.wnry

Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_italian.wnry

Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_japanese.wnry

Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_korean.wnry

Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_latvian.wnry

Filesize
40KB

MD5
c33afb4ecc04ee1bcc6975bea49abe40

SHA1
fbea4f170507cde02b839527ef50b7ec74b4821f

SHA256
a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

SHA512
0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_norwegian.wnry

Filesize
36KB

MD5
ff70cc7c00951084175d12128ce02399

SHA1
75ad3b1ad4fb14813882d88e952208c648f1fd18

SHA256
cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

SHA512
f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_polish.wnry

Filesize
38KB

MD5
e79d7f2833a9c2e2553c7fe04a1b63f4

SHA1
3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

SHA256
519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

SHA512
e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_portuguese.wnry

Filesize
37KB

MD5
fa948f7d8dfb21ceddd6794f2d56b44f

SHA1
ca915fbe020caa88dd776d89632d7866f660fc7a

SHA256
bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

SHA512
0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_romanian.wnry

Filesize
50KB

MD5
313e0ececd24f4fa1504118a11bc7986

SHA1
e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

SHA256
70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

SHA512
c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_russian.wnry

Filesize
46KB

MD5
452615db2336d60af7e2057481e4cab5

SHA1
442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

SHA256
02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

SHA512
7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_slovak.wnry

Filesize
40KB

MD5
c911aba4ab1da6c28cf86338ab2ab6cc

SHA1
fee0fd58b8efe76077620d8abc7500dbfef7c5b0

SHA256
e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

SHA512
3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_spanish.wnry

Filesize
36KB

MD5
8d61648d34cba8ae9d1e2a219019add1

SHA1
2091e42fc17a0cc2f235650f7aad87abf8ba22c2

SHA256
72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

SHA512
68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_swedish.wnry

Filesize
37KB

MD5
c7a19984eb9f37198652eaf2fd1ee25c

SHA1
06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae

SHA256
146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4

SHA512
43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_turkish.wnry

Filesize
41KB

MD5
531ba6b1a5460fc9446946f91cc8c94b

SHA1
cc56978681bd546fd82d87926b5d9905c92a5803

SHA256
6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415

SHA512
ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_vietnamese.wnry

Filesize
91KB

MD5
8419be28a0dcec3f55823620922b00fa

SHA1
2e4791f9cdfca8abf345d606f313d22b36c46b92

SHA256
1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8

SHA512
8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\r.wnry

Filesize
864B

MD5
3e0020fc529b1c2a061016dd2469ba96

SHA1
c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade

SHA256
402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c

SHA512
5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\s.wnry

Filesize
2.9MB

MD5
ad4c9de7c8c40813f200ba1c2fa33083

SHA1
d1af27518d455d432b62d73c6a1497d032f6120e

SHA256
e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b

SHA512
115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\t.wnry

Filesize
64KB

MD5
5dcaac857e695a65f5c3ef1441a73a8f

SHA1
7b10aaeee05e7a1efb43d9f837e9356ad55c07dd

SHA256
97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6

SHA512
06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe

Filesize
20KB

MD5
4fef5e34143e646dbf9907c4374276f5

SHA1
47a9ad4125b6bd7c55e4e7da251e23f089407b8f

SHA256
4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79

SHA512
4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe

Filesize
20KB

MD5
8495400f199ac77853c53b5a3f278f3e

SHA1
be5d6279874da315e3080b06083757aad9b32c23

SHA256
2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d

SHA512
0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r\u.wnry

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
memory/1824-1333-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/3392-2890-0x0000000009240000-0x0000000009250000-memory.dmp

Filesize
64KB

Download
memory/3392-2891-0x0000000009240000-0x0000000009250000-memory.dmp

Filesize
64KB

Download
memory/3392-2886-0x0000000009240000-0x0000000009250000-memory.dmp

Filesize
64KB

Download
memory/3392-2885-0x0000000009240000-0x0000000009250000-memory.dmp

Filesize
64KB

Download
memory/3392-2887-0x0000000009240000-0x0000000009250000-memory.dmp

Filesize
64KB

Download
memory/3392-2888-0x0000000009240000-0x0000000009250000-memory.dmp

Filesize
64KB

Download
memory/3392-2889-0x0000000009240000-0x0000000009250000-memory.dmp

Filesize
64KB

Download
memory/3392-2884-0x0000000009240000-0x0000000009250000-memory.dmp

Filesize
64KB

Download
memory/3992-0-0x00000228E0520000-0x00000228E0521000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads