Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://github.com/M...

windows10-ltsc_2021-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    517s
  • max time network
    519s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    25/08/2026, 06:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://github.com/M4lw4reT3sts/Windows-blockers/blob/main/Bonzify.exe%20virus
  • Sample260825-g6qepser21
Score
10/10
defense_evasiondiscoveryexecutionwannacryimpactpersistenceprivilege_escalationransomwaresuricataworm

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]

  • wannacry

Ransom Note
  • Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

  • 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

  • Family: Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 53 IoCs
  • Loads dropped DLL 13 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound 2 IoCs

    Network activity triggered a Suricata alert

    suricata
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Probable phishing domain 1 TTPs 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 3 IoCs
    ransomware
  • Drops file in Windows directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 3 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 63 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 51 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 3 IoCs
    defense_evasion

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/M4lw4reT3sts/Windows-blockers/blob/main/Bonzify.exe%20virus
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3348
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ff9c0adc188,0x7ff9c0adc194,0x7ff9c0adc1a0
      2⤵
        PID:768
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,6381730664428784255,9557269596257990122,262144 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
        2⤵
          PID:1668
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,8624578223941162017,6069322540465163702,524288 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
          2⤵
          • System Time Discovery
          PID:4100
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,1062297310805920864,3220716686402949391,524288 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
          2⤵
            PID:1724
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,5418400282269734841,2253850104362574518,2097152 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
            2⤵
              PID:4264
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,16208350503038205574,13109327622911980051,2097152 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
              2⤵
                PID:2312
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,16473660800955087447,13206200229832039316,2097152 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
                2⤵
                  PID:4560
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,607341235663907146,16636079963204642350,2097152 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
                  2⤵
                    PID:3644
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,13722261764323975412,18356923549275258171,524288 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
                    2⤵
                      PID:3580
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,9824315102644287714,5565846101745209041,524288 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
                      2⤵
                        PID:3608
                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,16958924046073158023,10684306317522145165,524288 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
                        2⤵
                          PID:1396
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,16958924046073158023,10684306317522145165,524288 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
                          2⤵
                            PID:1876
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,1054188923152014003,16714162258643776779,524288 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
                            2⤵
                              PID:4924
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4460,i,11272913076877658514,4030029159589001429,2097152 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
                              2⤵
                                PID:3780
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,7307783351919758676,6648366132467282538,524288 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
                                2⤵
                                  PID:3512
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,7642081624499602645,8661115064756724757,524288 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:8
                                  2⤵
                                    PID:2432
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,11214521830426549376,11687132124234605026,524288 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
                                    2⤵
                                      PID:1244
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,5860841882217605387,11557013549855772541,524288 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
                                      2⤵
                                        PID:2028
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,13436741491448586296,10111497621790147575,524288 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
                                        2⤵
                                          PID:6040
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,6168092282800140505,4869160897719452404,524288 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
                                          2⤵
                                            PID:4716
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=2164,i,13744724433920840519,3524301899774610132,2097152 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
                                            2⤵
                                              PID:5552
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,5464042564773935703,14093739836937003745,524288 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
                                              2⤵
                                                PID:5904
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,14842364927215353983,4926178362824533566,524288 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
                                                2⤵
                                                  PID:5296
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6420,i,1242062931061322165,283556451361415682,2097152 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
                                                  2⤵
                                                    PID:5592
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,15670003561987424883,7232988782310441884,524288 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
                                                    2⤵
                                                      PID:5832
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6004,i,1791661413477723154,11604794924722336631,262144 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
                                                      2⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5436
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4340,i,11766774429982233584,11799596401666335807,2097152 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
                                                      2⤵
                                                        PID:5092
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,9183379134255836187,9640406041259793944,524288 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
                                                        2⤵
                                                          PID:3056
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,12479457450842357331,3998497766314825594,524288 --field-trial-handle=2304,i,13533767343934732844,18253048871504348444,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
                                                          2⤵
                                                            PID:4376
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                          1⤵
                                                            PID:936
                                                          • C:\Windows\System32\rundll32.exe
                                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                            1⤵
                                                              PID:4320
                                                            • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\WannaCrypt0r.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\WannaCrypt0r.exe"
                                                              1⤵
                                                              • Creates a file in the Startup directory
                                                              • Sets desktop wallpaper using registry
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1308
                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                attrib +h .
                                                                2⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Views/modifies file attributes
                                                                PID:1976
                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                icacls . /grant Everyone:F /T /C /Q
                                                                2⤵
                                                                • Modifies file permissions
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4472
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                PID:5296
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c 136951787639155.bat
                                                                2⤵
                                                                • Executes a command shell one-liner
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5360
                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                  cscript.exe //nologo m.vbs
                                                                  3⤵
                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:5472
                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                attrib +h +s F:\$RECYCLE
                                                                2⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Views/modifies file attributes
                                                                PID:5964
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                @[email protected] co
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5172
                                                                • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\TaskData\Tor\taskhsvc.exe
                                                                  TaskData\Tor\taskhsvc.exe
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:5160
                                                                • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\TaskData\Tor\taskhsvc.exe
                                                                  TaskData\Tor\taskhsvc.exe
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:5300
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                cmd.exe /c start /b @[email protected] vs
                                                                2⤵
                                                                • Executes a command shell one-liner
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5952
                                                                • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                  @[email protected] vs
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5216
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                                                    4⤵
                                                                    • Executes a command shell one-liner
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5672
                                                                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                      wmic shadowcopy delete
                                                                      5⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:5688
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4144
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskse.exe
                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:5180
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                @[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Sets desktop wallpaper using registry
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:4588
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "zvvbofqhwmwdoro811" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\tasksche.exe\"" /f
                                                                2⤵
                                                                • Executes a command shell one-liner
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5168
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "zvvbofqhwmwdoro811" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\tasksche.exe\"" /f
                                                                  3⤵
                                                                  • Adds Run key to start application
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry key
                                                                  PID:4320
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1500
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskse.exe
                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:1044
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                @[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:1664
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5836
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskse.exe
                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4828
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                @[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:5396
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskse.exe
                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2276
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                @[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:220
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1476
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskse.exe
                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:1992
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                @[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:5532
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5764
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskse.exe
                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:3164
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                @[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:752
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:6008
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskse.exe
                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2056
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                @[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:6068
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4812
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskse.exe
                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4028
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                @[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:5128
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4520
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskse.exe
                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2984
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                @[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Sets desktop wallpaper using registry
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:5252
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5564
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskse.exe
                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4180
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                @[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:4232
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5524
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskse.exe
                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2220
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                @[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:5784
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2068
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskse.exe
                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5188
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                @[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:6136
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2180
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskse.exe
                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:6644
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                @[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:6652
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:6876
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskse.exe
                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:6320
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                @[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:6316
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:6680
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskse.exe
                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:3248
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                @[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:2416
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:3128
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskse.exe
                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2852
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                @[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:1320
                                                              • C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:800
                                                            • C:\Windows\system32\vssvc.exe
                                                              C:\Windows\system32\vssvc.exe
                                                              1⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5680
                                                            • C:\Users\Admin\Downloads\WannaCry\WannaCrypt0r.exe
                                                              "C:\Users\Admin\Downloads\WannaCry\WannaCrypt0r.exe"
                                                              1⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5728
                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                attrib +h .
                                                                2⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Views/modifies file attributes
                                                                PID:5960
                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                icacls . /grant Everyone:F /T /C /Q
                                                                2⤵
                                                                • Modifies file permissions
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5996
                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
                                                              1⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Checks processor information in registry
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:1880
                                                            • C:\Windows\system32\NOTEPAD.EXE
                                                              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\@[email protected]
                                                              1⤵
                                                                PID:5328
                                                              • C:\Windows\system32\mspaint.exe
                                                                "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\@[email protected]"
                                                                1⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:2648
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                                                                1⤵
                                                                  PID:2104
                                                                • C:\Windows\system32\taskmgr.exe
                                                                  "C:\Windows\system32\taskmgr.exe" /7
                                                                  1⤵
                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                  • Checks SCSI registry key(s)
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  • Suspicious use of SendNotifyMessage
                                                                  PID:5160
                                                                • C:\Windows\SysWOW64\werfault.exe
                                                                  werfault.exe /h /shared Global\d5866a99652349f9a2b4a046a8be3026 /t 3760 /p 4588
                                                                  1⤵
                                                                    PID:5620
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\CompressRevoke.mhtml
                                                                    1⤵
                                                                      PID:3544
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\Desktop\CompressRevoke.mhtml
                                                                        2⤵
                                                                        • Drops file in Windows directory
                                                                        • Checks SCSI registry key(s)
                                                                        • Checks processor information in registry
                                                                        • Enumerates system info in registry
                                                                        • Modifies data under HKEY_USERS
                                                                        • Modifies registry class
                                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                        PID:2600
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x26c,0x7ff9c0adc188,0x7ff9c0adc194,0x7ff9c0adc1a0
                                                                          3⤵
                                                                            PID:2980
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,16736700455881794896,11659496035877521275,524288 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
                                                                            3⤵
                                                                            • System Time Discovery
                                                                            PID:3396
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,9972729276905904808,12889984905358769768,262144 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:2
                                                                            3⤵
                                                                              PID:4040
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,2010015520518934073,9727257537551033399,524288 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
                                                                              3⤵
                                                                                PID:4256
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3320,i,13493251314249713876,9676667861650113121,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
                                                                                3⤵
                                                                                  PID:5948
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,12684017523536569654,4687384603018562062,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
                                                                                  3⤵
                                                                                    PID:1844
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4768,i,7330542372196552634,6656040723422268630,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:1
                                                                                    3⤵
                                                                                      PID:4056
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,16506501193470730990,4399128720291646952,524288 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
                                                                                      3⤵
                                                                                        PID:800
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,11824196733205479271,7912946182184863787,524288 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:8
                                                                                        3⤵
                                                                                          PID:1648
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4000,i,1535676896378131648,2320823721022227798,524288 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:8
                                                                                          3⤵
                                                                                            PID:968
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,8336603536122746614,6435148545355159915,524288 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
                                                                                            3⤵
                                                                                              PID:4516
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,10945546161033644015,15191413815435356162,524288 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
                                                                                              3⤵
                                                                                                PID:4808
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,10945546161033644015,15191413815435356162,524288 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
                                                                                                3⤵
                                                                                                  PID:5412
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,17778131327048294396,467655537281519047,524288 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
                                                                                                  3⤵
                                                                                                    PID:2712
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,6595162116910625532,6175473844156815119,524288 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
                                                                                                    3⤵
                                                                                                      PID:2332
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,13527074509481315796,13112772753022171252,524288 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
                                                                                                      3⤵
                                                                                                        PID:1344
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,11909709535611559535,1405020902242747954,524288 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
                                                                                                        3⤵
                                                                                                          PID:1364
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,4460864258856726085,16493956104089192372,524288 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
                                                                                                          3⤵
                                                                                                            PID:5284
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6004,i,8440819353072645619,1822429430548592894,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:1
                                                                                                            3⤵
                                                                                                              PID:4652
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4976,i,8969674914492975859,2160436299795522012,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
                                                                                                              3⤵
                                                                                                                PID:5184
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6496,i,2132110618402738381,4167916808758929543,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:1
                                                                                                                3⤵
                                                                                                                  PID:1616
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=156,i,16841377909701887497,15847475142458674149,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
                                                                                                                  3⤵
                                                                                                                    PID:4688
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6344,i,3144318537074900031,1523164445365320168,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
                                                                                                                    3⤵
                                                                                                                      PID:1476
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6268,i,5470383478734584619,6894543667025511793,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
                                                                                                                      3⤵
                                                                                                                        PID:3940
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6500,i,10968044320398492075,13507018128522580693,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
                                                                                                                        3⤵
                                                                                                                          PID:884
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7000,i,3804609569628737068,11055397626395357064,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:1
                                                                                                                          3⤵
                                                                                                                            PID:3060
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7332,i,11783314806615979713,8423880606543419563,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
                                                                                                                            3⤵
                                                                                                                              PID:740
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6228,i,5179944684239765837,250615576090463592,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:1
                                                                                                                              3⤵
                                                                                                                                PID:5160
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7460,i,11376234276942087589,13947126495155703354,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:1
                                                                                                                                3⤵
                                                                                                                                  PID:1084
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7224,i,14572041181071379121,9316984136462173416,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:1
                                                                                                                                  3⤵
                                                                                                                                    PID:5924
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6616,i,6208834009587084138,5676227056206140422,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:1
                                                                                                                                    3⤵
                                                                                                                                      PID:5940
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6968,i,12089891157775691664,4656223987491042515,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:1
                                                                                                                                      3⤵
                                                                                                                                        PID:5428
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7568,i,14733574247638863665,2066089996844346932,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:1
                                                                                                                                        3⤵
                                                                                                                                          PID:5740
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7736,i,6602583516142656589,4776247142474332838,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:1
                                                                                                                                          3⤵
                                                                                                                                            PID:5464
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7896,i,3973530290255667149,737084621180765723,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:1
                                                                                                                                            3⤵
                                                                                                                                              PID:1972
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8032,i,8781605212987767177,10649072163695279175,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=8048 /prefetch:1
                                                                                                                                              3⤵
                                                                                                                                                PID:4160
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8028,i,2275097091830419251,14854623306060115718,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=8196 /prefetch:1
                                                                                                                                                3⤵
                                                                                                                                                  PID:2624
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8344,i,4126362437900874580,17698669699088594392,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=8348 /prefetch:1
                                                                                                                                                  3⤵
                                                                                                                                                    PID:444
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8616,i,16595611080120764647,7338990692431904687,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=8620 /prefetch:1
                                                                                                                                                    3⤵
                                                                                                                                                      PID:5688
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8324,i,6001558373112842697,12123202839684872146,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=8760 /prefetch:1
                                                                                                                                                      3⤵
                                                                                                                                                        PID:800
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8896,i,3323556084844036879,5644238950709246801,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=8900 /prefetch:1
                                                                                                                                                        3⤵
                                                                                                                                                          PID:5188
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=9100,i,3103107955281758903,6700911100286742379,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=9064 /prefetch:1
                                                                                                                                                          3⤵
                                                                                                                                                            PID:5180
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=9272,i,2330578848016474075,3899558116249098546,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=9256 /prefetch:1
                                                                                                                                                            3⤵
                                                                                                                                                              PID:5508
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9108,i,10210509396290350273,779997710682605161,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=8928 /prefetch:1
                                                                                                                                                              3⤵
                                                                                                                                                                PID:5540
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9536,i,5570072214922261491,5774266477743565577,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=9540 /prefetch:1
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:3144
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=9392,i,8191621834074738303,11340281900406825648,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=9700 /prefetch:1
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:6100
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=9544,i,13424104322385398457,10888288985505268348,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=9864 /prefetch:1
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:668
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=10020,i,16006378378217711243,5029611590986172238,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=10024 /prefetch:1
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:572
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=10132,i,13685300317871004536,16498123975988165692,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=8896 /prefetch:1
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:3200
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=10284,i,14843243619934501687,14101110741800505147,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=9400 /prefetch:1
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:4184
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=10288,i,1631196716984441205,3878491068245699348,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=10492 /prefetch:1
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:3104
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=10584,i,6202857986801881056,10006171377452381376,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=10580 /prefetch:1
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:4868
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=10408,i,2051501144667439798,15170010358418538769,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=10812 /prefetch:1
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:6364
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=10716,i,13253118436969768323,3276824000948682012,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=10936 /prefetch:1
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:6372
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10968,i,2553884012483273207,101191553277013922,524288 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=11088 /prefetch:8
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:6388
                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10940,i,14067226720523885207,17288634834681648623,524288 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=11104 /prefetch:8
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:6396
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10956,i,15379845514354726180,9606954546180465031,524288 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=11148 /prefetch:8
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:6404
                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=11224,i,6448161949711131255,4719748922967782627,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=11212 /prefetch:1
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:6700
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,7685077367900078498,11767581616081404426,524288 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=9776 /prefetch:8
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:6216
                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9732,i,6566536692732793676,17398619722443014460,524288 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=10356 /prefetch:8
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:6536
                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=9260,i,3512571659100168243,2739296496600769137,2097152 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=9304 /prefetch:1
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:4264
                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,10210479937171924950,10956135083141751183,524288 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:8
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:7012
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,656182333729833465,13677019057725070418,524288 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=10744 /prefetch:8
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:5824
                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7140,i,9909456042101908554,2216891127567299960,524288 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=9272 /prefetch:8
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:4988
                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=9228,i,10071789951905513056,7476824950542451090,262144 --field-trial-handle=2104,i,2916759458156806685,17138260584063556274,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:8
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                        PID:884
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:5876
                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:1648

                                                                                                                                                                                                      Network

                                                                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                            Reconnaissance

                                                                                                                                                                                                            Resource Development

                                                                                                                                                                                                            Initial Access

                                                                                                                                                                                                            Phishing

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1566

                                                                                                                                                                                                            Execution

                                                                                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                                                                                            2
                                                                                                                                                                                                            T1059

                                                                                                                                                                                                            Visual Basic

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1059.005

                                                                                                                                                                                                            Windows Command Shell

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1059.003

                                                                                                                                                                                                            Windows Management Instrumentation

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1047

                                                                                                                                                                                                            Persistence

                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                            2
                                                                                                                                                                                                            T1547

                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                            2
                                                                                                                                                                                                            T1547.001

                                                                                                                                                                                                            Privilege Escalation

                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                            2
                                                                                                                                                                                                            T1547

                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                            2
                                                                                                                                                                                                            T1547.001

                                                                                                                                                                                                            Defense Evasion

                                                                                                                                                                                                            File and Directory Permissions Modification

                                                                                                                                                                                                            2
                                                                                                                                                                                                            T1222

                                                                                                                                                                                                            Windows File and Directory Permissions Modification

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1222.001

                                                                                                                                                                                                            Hide Artifacts

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1564

                                                                                                                                                                                                            Hidden Files and Directories

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1564.001

                                                                                                                                                                                                            Indicator Removal

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1070

                                                                                                                                                                                                            File Deletion

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1070.004

                                                                                                                                                                                                            Modify Registry

                                                                                                                                                                                                            3
                                                                                                                                                                                                            T1112

                                                                                                                                                                                                            Credential Access

                                                                                                                                                                                                            Discovery

                                                                                                                                                                                                            Browser Information Discovery

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1217

                                                                                                                                                                                                            Peripheral Device Discovery

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1120

                                                                                                                                                                                                            Query Registry

                                                                                                                                                                                                            4
                                                                                                                                                                                                            T1012

                                                                                                                                                                                                            System Information Discovery

                                                                                                                                                                                                            4
                                                                                                                                                                                                            T1082

                                                                                                                                                                                                            System Location Discovery

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1614

                                                                                                                                                                                                            System Language Discovery

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1614.001

                                                                                                                                                                                                            System Time Discovery

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1124

                                                                                                                                                                                                            Lateral Movement

                                                                                                                                                                                                            Collection

                                                                                                                                                                                                            Command and Control

                                                                                                                                                                                                            Web Service

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1102

                                                                                                                                                                                                            Exfiltration

                                                                                                                                                                                                            Impact

                                                                                                                                                                                                            Defacement

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1491

                                                                                                                                                                                                            Inhibit System Recovery

                                                                                                                                                                                                            1
                                                                                                                                                                                                            T1490

                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                            blocklist
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                                                                                                                            • Size 105KB
                                                                                                                                                                                                            • SHA256 ae53e618032c667892ed21a0d220c217b0a8d7911b3dee86b08e6a49f9b5961f
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            settings.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                            • Size 280B
                                                                                                                                                                                                            • SHA256 cda6ac065af3cdca59d855e15e32c56853328459803d73f263875d7b4a281eb8
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            settings.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                            • Size 280B
                                                                                                                                                                                                            • SHA256 233ff9223a249d72eff0f5f5eab2068bdbcb55580771c6d25c28a99e552b5a2b
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            settings.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                            • Size 280B
                                                                                                                                                                                                            • SHA256 bd3eca2e7bd2dc774c600611c1a6ad1ca3544616bfc3661e838c7f792132650c
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            settings.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                            • Size 280B
                                                                                                                                                                                                            • SHA256 ce9a45431fb053f46812395470c2ff6c9ccd1803075551fd01e4a51c3c4ecd4b
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            settings.dat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                            • Size 280B
                                                                                                                                                                                                            • SHA256 c0f239c7ed32f1c492df19d463edf2073ad4d721081b4a3b14c372062cca32ba
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            252b677e-42d3-4acb-a8ec-e3ee99cfe4d2.tmp
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\252b677e-42d3-4acb-a8ec-e3ee99cfe4d2.tmp
                                                                                                                                                                                                            • Size 414B
                                                                                                                                                                                                            • SHA256 c9c469508303d4e6f908d8e33a4b3080006b3bf41ec79f2fdb0efc516232327b
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            CURRENT
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT
                                                                                                                                                                                                            • Size 16B
                                                                                                                                                                                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            LOG.old
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                                                            • Size 331B
                                                                                                                                                                                                            • SHA256 e74434d28274d32f2e54db6a5d406558a9d0d53a70caa2334c94d305db5a5daf
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                            • Size 6B
                                                                                                                                                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            temp-index
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                                                                                            • Size 7KB
                                                                                                                                                                                                            • SHA256 8348cfddce34bbb868eb33a2aa9df8f315a4574b95187e4f4647f290684e27ef
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            the-real-index
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                            • Size 5KB
                                                                                                                                                                                                            • SHA256 8c9c67914abb604ac6c5921f3bbece9f678d96466e60fc66f4e729160690e5b9
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            the-real-index
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                            • Size 7KB
                                                                                                                                                                                                            • SHA256 05c1dc35a0f2e20b91edcbaa92c0220b5ce5be9c7be6c45ad0d88b4b7c4dae76
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            the-real-index
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                            • Size 10KB
                                                                                                                                                                                                            • SHA256 c4a3d0a5ae7026856962d2021c4a59f1478836898bf7ee2739363665c6ea72a5
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            the-real-index~RFe587c11.TMP
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587c11.TMP
                                                                                                                                                                                                            • Size 3KB
                                                                                                                                                                                                            • SHA256 d2fbf48c347ff853e2eb21943f5f87a6f269d24d7aac8dc8e7c1a27cf7d06584
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            the-real-index~RFe5ef23d.TMP
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5ef23d.TMP
                                                                                                                                                                                                            • Size 5KB
                                                                                                                                                                                                            • SHA256 feb26f2a1943393df04ad3e6fb8c22953927a8bf3b8c8a372ce1b41222167f99
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            data_1
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
                                                                                                                                                                                                            • Size 264KB
                                                                                                                                                                                                            • SHA256 2f46b6c3c8c65f0057827c20f50e7b71c46bb3520f5f8db0b5e57aa6ab8eec39
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            SiteList-Enterprise.json
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                                                            • Size 2B
                                                                                                                                                                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Edge Profile.ico
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                                                            • Size 70KB
                                                                                                                                                                                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            EdgeHubAppUsageSQLite.db
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
                                                                                                                                                                                                            • Size 32KB
                                                                                                                                                                                                            • SHA256 0339ecfecd0f08f0d21ca82b32b4aa83cdfd8fb4e8b9ac4ba318e925aa822684
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            MANIFEST-000001
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
                                                                                                                                                                                                            • Size 23B
                                                                                                                                                                                                            • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            17393fad-2b19-4778-9522-43ef176b32a0.tmp
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\17393fad-2b19-4778-9522-43ef176b32a0.tmp
                                                                                                                                                                                                            • Size 40B
                                                                                                                                                                                                            • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Network Persistent State
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                            • SHA256 ba99a954d546920d58a0ec2d309dae3543de8d2691d9df08487d75018a1c7e0a
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Network Persistent State
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                            • Size 29KB
                                                                                                                                                                                                            • SHA256 eb0a8b668977a2f46103b22cca18b2d638873e84aa0eef96766e58ec6b646c24
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Network Persistent State
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                            • SHA256 450c797c3b052522ec323177ce6480306224a41d55757dabc0e0e5ae10f4f8a3
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Network Persistent State
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                            • SHA256 4f57ab846582df404529b085887e7ee3b5f1a14b63da168281e3c1061e5d6b5c
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Network Persistent State
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                            • Size 111B
                                                                                                                                                                                                            • SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            SCT Auditing Pending Reports
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                            • Size 2B
                                                                                                                                                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Preferences
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                            • Size 13KB
                                                                                                                                                                                                            • SHA256 dea0275567a0f6eb8eb28270a3bac67b9466a1b88e2dd6a0c86b7101ec71053f
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Preferences
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                            • Size 19KB
                                                                                                                                                                                                            • SHA256 4c1a37923f42e654179e6e58f0d47e8708b11e8f60c7e47ae1edff5e27e5e873
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Preferences
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                            • Size 15KB
                                                                                                                                                                                                            • SHA256 569830d8245acd9eadb40fe11fcf9f59cc4ddb8bb1b027f45a6796ef2791a8ae
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Preferences
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                            • Size 14KB
                                                                                                                                                                                                            • SHA256 389872421ad22e6902a079053f02dfee1608652baf618a00ab965f6738283b1e
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Preferences
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                            • Size 31KB
                                                                                                                                                                                                            • SHA256 61a5d2bad9d09560f33df6b87ff784d01c2e205367cb13d8e0eeaf64e8b67cee
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Preferences
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                            • Size 14KB
                                                                                                                                                                                                            • SHA256 20d980b10526dcf7fbc4cae7822229c7a0d9b42c840d590aa83dc5dfaadae0b8
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Secure Preferences
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                            • Size 30KB
                                                                                                                                                                                                            • SHA256 7db1c9b955833a15f6138a3bacb0b89d874468bb2e484489c6839e24f9da45b3
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            the-real-index
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0fe8a4c5-fbac-452b-862f-c32c59bd0619\index-dir\the-real-index
                                                                                                                                                                                                            • Size 96B
                                                                                                                                                                                                            • SHA256 ca1bbcbf2096ae207c18f068cd4bd95285f7a39c3f7479917bf7cb302faa5f3d
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            the-real-index~RFe5ff3df.TMP
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0fe8a4c5-fbac-452b-862f-c32c59bd0619\index-dir\the-real-index~RFe5ff3df.TMP
                                                                                                                                                                                                            • Size 48B
                                                                                                                                                                                                            • SHA256 184873a3c70db5865a76f3b8c48dfca12848cf22fb4780db0765a3f2ab9adc90
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            index
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2abbc879-b510-4c2b-a758-3698dd13c96e\index
                                                                                                                                                                                                            • Size 24B
                                                                                                                                                                                                            • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            the-real-index
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2abbc879-b510-4c2b-a758-3698dd13c96e\index-dir\the-real-index
                                                                                                                                                                                                            • Size 72B
                                                                                                                                                                                                            • SHA256 ef6f1bd84ce5c6a579ec2d2a770674b99520453cce879e4513d02e2076a28ba4
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            the-real-index~RFe5ff3df.TMP
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2abbc879-b510-4c2b-a758-3698dd13c96e\index-dir\the-real-index~RFe5ff3df.TMP
                                                                                                                                                                                                            • Size 48B
                                                                                                                                                                                                            • SHA256 e57298f5ed404685c57f2ebf4f9413c22043f43f39a0309d47fe090edeb1c309
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            the-real-index
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\42674071-e4fc-47f4-aaa7-f0a5c20d0fb9\index-dir\the-real-index
                                                                                                                                                                                                            • Size 3KB
                                                                                                                                                                                                            • SHA256 0099d556e09a780edf9b58b4de434c3d31998f1e54eac6d70ec0727de807db4f
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            the-real-index~RFe5fda4c.TMP
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\42674071-e4fc-47f4-aaa7-f0a5c20d0fb9\index-dir\the-real-index~RFe5fda4c.TMP
                                                                                                                                                                                                            • Size 48B
                                                                                                                                                                                                            • SHA256 b32a28cb382efe4905d76a1600b654a5ffd0731bc9825c7e7267e1bdc464c318
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            the-real-index
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\736e382d-15db-4b3c-83f2-4d6d9501816a\index-dir\the-real-index
                                                                                                                                                                                                            • Size 72B
                                                                                                                                                                                                            • SHA256 2eb26cf51b21178adf1b1d4090c00a8cab8b888dfe0a868714e0a81ece537f5f
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            the-real-index~RFe5feeae.TMP
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\736e382d-15db-4b3c-83f2-4d6d9501816a\index-dir\the-real-index~RFe5feeae.TMP
                                                                                                                                                                                                            • Size 48B
                                                                                                                                                                                                            • SHA256 36a0f10eeb9ddd3db8d19e3fc87791ad90ba1bc7d735ed14ff4a5f71264a0d2d
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            the-real-index
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fec505be-9195-4594-bf9c-ef5ead0ea8fd\index-dir\the-real-index
                                                                                                                                                                                                            • Size 72B
                                                                                                                                                                                                            • SHA256 579977258dfd8fe7fa101cf0286d83d1ef151219d893cf69bc58368f16db2829
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            the-real-index~RFe5fc944.TMP
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fec505be-9195-4594-bf9c-ef5ead0ea8fd\index-dir\the-real-index~RFe5fc944.TMP
                                                                                                                                                                                                            • Size 48B
                                                                                                                                                                                                            • SHA256 ef9fe1bec5b71b95aa284ac04d49b11e2074ce6534954b9e8c8773625018ecb7
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            index.txt
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                                                            • Size 624B
                                                                                                                                                                                                            • SHA256 5dc4ced300fbf31032c34ee3bc709e9b7932dd07a545814c2df607a4fa8b687d
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            index.txt
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                                                            • Size 519B
                                                                                                                                                                                                            • SHA256 1e992464657e5104dd396cb09df3ea0a4c7ae7ded6b1f1fcf11213aea90828f1
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            index.txt
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                                                            • Size 619B
                                                                                                                                                                                                            • SHA256 b5461871a0d985389d7b38d23c7d29dc8cc39e5f71cf57629dd415bc265435e2
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            index.txt
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                                                            • Size 279B
                                                                                                                                                                                                            • SHA256 64a549b6869f53ced97e768156d9c68020f1359741ce313a9ea6dc64b89bdbf4
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            index.txt
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                                                            • Size 375B
                                                                                                                                                                                                            • SHA256 21e6cb0a119b7628d901be8c28d071a8fd1c245cb13b27d460c5dfcfcebc6d93
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            index.txt~RFe5f797e.TMP
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe5f797e.TMP
                                                                                                                                                                                                            • Size 153B
                                                                                                                                                                                                            • SHA256 9ac15ee385051329129410ff4552da9e6f33dcd3604d836fc6a2031ba699529f
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            the-real-index
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                                            • Size 96B
                                                                                                                                                                                                            • SHA256 fb5c96fe931a413aabbe0bcbe375c603f87c2d7511c7c13b97fa0b1fde21953f
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            the-real-index
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                                            • Size 72B
                                                                                                                                                                                                            • SHA256 c91c0b545c967c53227e386235eb00f5a06dfd63a36fa20e4d52d89896c9e5b0
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            the-real-index~RFe5ec2d1.TMP
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ec2d1.TMP
                                                                                                                                                                                                            • Size 48B
                                                                                                                                                                                                            • SHA256 38a2986c478786f0a36883ff7ac760cd52f67b184c147e09f230fb2dbe069023
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            the-real-index
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                                                                                                                                            • Size 72B
                                                                                                                                                                                                            • SHA256 c934e3b05f7bcdce8ac7d83731e08aa8ec6b41f048e40205482da506c3461649
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            the-real-index~RFe5e8683.TMP
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index~RFe5e8683.TMP
                                                                                                                                                                                                            • Size 48B
                                                                                                                                                                                                            • SHA256 800bd99b6e82d5f145d9286c5e94b0a128ac989da7b778ab27d0736bb0168eae
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            sync_diagnostic.log
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                            • SHA256 865b5bc46e5643b79d0b6c3cc09bb6526e6dc3b7219f8b0bb2d51ad932677e56
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            load_statistics.db
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
                                                                                                                                                                                                            • Size 144KB
                                                                                                                                                                                                            • SHA256 091968b2f322fa1e3a71e93a554feb39495ff56992eaaa3e61e09cfd9cdc63d6
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            1d4437c1-2919-491d-a28f-4d13f80d2981.tmp
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1d4437c1-2919-491d-a28f-4d13f80d2981.tmp
                                                                                                                                                                                                            • Size 22KB
                                                                                                                                                                                                            • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Local State
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                            • Size 26KB
                                                                                                                                                                                                            • SHA256 ca78b953557d8eaa1703d5bfb8c5b61ecbd07b8e71f271e186fc05e3b2da125d
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Local State
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                            • Size 18KB
                                                                                                                                                                                                            • SHA256 ff3917c1cc220cd44e57e6b3ebf548af7f14d1ee6ccedbc6b09fd101f6c5bb9d
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Local State
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                            • Size 32KB
                                                                                                                                                                                                            • SHA256 15d35426a4ae231f80dc70a8fc1bf9e3abaab6961c7a9249bca831e700e3aea5
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Local State
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                            • Size 27KB
                                                                                                                                                                                                            • SHA256 6433f1fe323745a050046055ca25e6dfd140939273d7f1669ccdfc921d491ba6
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Local State
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                            • Size 26KB
                                                                                                                                                                                                            • SHA256 f519621fb92c7d4e0441c00a80989d3ac7372aa533168a2363b1e824a531fbba
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Local State
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                            • Size 8KB
                                                                                                                                                                                                            • SHA256 48a38a3cdbb661eec5b3a5bbfe43b9c2a9d0b667e7225bac216b9eef13d3d83c
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Local State
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                            • Size 18KB
                                                                                                                                                                                                            • SHA256 3599c51f7028e5920e3af321a16a16398f5a1b8d4c688e098ca7de83e4f1c30f
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Local State
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                            • Size 8KB
                                                                                                                                                                                                            • SHA256 f60394afae587dededf257a0861f2ac4b0e4611227c3b342dfb9aae85f86d816
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Local State
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                            • Size 30KB
                                                                                                                                                                                                            • SHA256 f6deae581be9a045c625f6d636f72623a2591fc779462093a1028636a7af3439
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            RevisitationBloomfilter
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                            • Size 392B
                                                                                                                                                                                                            • SHA256 4e6afdffc3b8827a96ed35acc7f0085361d8a72065469e3dc87827f5298d93e4
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            RevisitationBloomfilter
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                            • Size 392B
                                                                                                                                                                                                            • SHA256 d2582a08f877dd769d7981cde6de27299382ae6d08f379500e4595df5ca91050
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            RevisitationBloomfilter
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                            • Size 392B
                                                                                                                                                                                                            • SHA256 4d6ef0251b1f30ac2278f2ce09a058b54776a397103aecf9465d29d6020d61bf
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            RevisitationBloomfilter
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                            • Size 392B
                                                                                                                                                                                                            • SHA256 05d5b83c3758496aac323b8c3620d9969e820b10f6be99f1defea835c13a311d
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            RevisitationBloomfilter
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                            • Size 392B
                                                                                                                                                                                                            • SHA256 b0ed5ba74ce990c12c564c640a39c360557140f8aa7d9c80572b4da946c87b90
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            RevisitationBloomfilter
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                            • Size 392B
                                                                                                                                                                                                            • SHA256 64a3a180620595954031823e6530c3c51c5fc4cfc1cae0f77ed19edee11c0bd8
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            RevisitationBloomfilter
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                            • Size 392B
                                                                                                                                                                                                            • SHA256 61711e4dc71ea4d7c618b07af75ccd6909f88a94201126826ec95ba8879e487d
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            RevisitationBloomfilter~RFe596ba1.TMP
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe596ba1.TMP
                                                                                                                                                                                                            • Size 392B
                                                                                                                                                                                                            • SHA256 b7777482cc423461e807e09d7e428ecdadd79d6268b0888e7eadef9082b5cb79
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            metadata.json
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                            • Size 372B
                                                                                                                                                                                                            • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            metadata.json
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                            • Size 252B
                                                                                                                                                                                                            • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            metadata.json
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                            • Size 132B
                                                                                                                                                                                                            • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            0c16dee7-3f1e-410c-8d1e-0a07e7e52eb8.tmp
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0c16dee7-3f1e-410c-8d1e-0a07e7e52eb8.tmp
                                                                                                                                                                                                            • Size 13B
                                                                                                                                                                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            first_party_sets.db
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
                                                                                                                                                                                                            • Size 48KB
                                                                                                                                                                                                            • SHA256 b07a988f6371a745e8902eabb027907ef58b8e4f90f50ccbbb3b413e20a07100
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                            • SHA256 23edefb8b8dec86898d781d1569a911e6cee0bb85129bfa790bed3015b970939
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            7026e531-8492-44ac-99b8-55f27cd3e957.tmp
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\7026e531-8492-44ac-99b8-55f27cd3e957.tmp
                                                                                                                                                                                                            • Size 1B
                                                                                                                                                                                                            • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            00000000.res
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\00000000.res
                                                                                                                                                                                                            • Size 136B
                                                                                                                                                                                                            • SHA256 58ac5d007e7ca30f4ce0a93237d0c9a85179ef61a2e24506183f51904dd4f700
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            136951787639155.bat
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\136951787639155.bat
                                                                                                                                                                                                            • Size 448B
                                                                                                                                                                                                            • SHA256 4b4f5ec78d3a2174487676896ea9edaad869255e55820235a2d0462d869ffe24
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            @[email protected]
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                                                                                                                                                            • Size 933B
                                                                                                                                                                                                            • SHA256 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            @[email protected]
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\@[email protected]
                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                            • SHA256 f11051c7fdf429bedfe87c4183d975fdcaf9aa260301034ff0f513256acd6611
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            libevent-2-0-5.dll
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\TaskData\Tor\libevent-2-0-5.dll
                                                                                                                                                                                                            • Size 702KB
                                                                                                                                                                                                            • SHA256 77a250e81fdaf9a075b1244a9434c30bf449012c9b647b265fa81a7b0db2513f
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            taskhsvc.exe
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\TaskData\Tor\taskhsvc.exe
                                                                                                                                                                                                            • Size 3.0MB
                                                                                                                                                                                                            • SHA256 e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            b.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\b.wnry
                                                                                                                                                                                                            • Size 1.4MB
                                                                                                                                                                                                            • SHA256 d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            c.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\c.wnry
                                                                                                                                                                                                            • Size 780B
                                                                                                                                                                                                            • SHA256 ef0ed0b717d1b956eb6c42ba1f4fd2283cf7c8416bed0afd1e8805ee0502f2b4
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m.vbs
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\m.vbs
                                                                                                                                                                                                            • Size 327B
                                                                                                                                                                                                            • SHA256 d3052282877f7776145ebd803ccee14bda5c1c06c8e545f34913a46fefc8a056
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_bulgarian.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_bulgarian.wnry
                                                                                                                                                                                                            • Size 46KB
                                                                                                                                                                                                            • SHA256 40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_chinese (simplified).wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_chinese (simplified).wnry
                                                                                                                                                                                                            • Size 53KB
                                                                                                                                                                                                            • SHA256 845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_chinese (traditional).wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_chinese (traditional).wnry
                                                                                                                                                                                                            • Size 77KB
                                                                                                                                                                                                            • SHA256 5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_croatian.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_croatian.wnry
                                                                                                                                                                                                            • Size 38KB
                                                                                                                                                                                                            • SHA256 3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_czech.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_czech.wnry
                                                                                                                                                                                                            • Size 39KB
                                                                                                                                                                                                            • SHA256 5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_danish.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_danish.wnry
                                                                                                                                                                                                            • Size 36KB
                                                                                                                                                                                                            • SHA256 a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_dutch.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_dutch.wnry
                                                                                                                                                                                                            • Size 36KB
                                                                                                                                                                                                            • SHA256 2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_english.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_english.wnry
                                                                                                                                                                                                            • Size 36KB
                                                                                                                                                                                                            • SHA256 26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_filipino.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_filipino.wnry
                                                                                                                                                                                                            • Size 36KB
                                                                                                                                                                                                            • SHA256 d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_finnish.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_finnish.wnry
                                                                                                                                                                                                            • Size 37KB
                                                                                                                                                                                                            • SHA256 1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_french.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_french.wnry
                                                                                                                                                                                                            • Size 37KB
                                                                                                                                                                                                            • SHA256 9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_german.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_german.wnry
                                                                                                                                                                                                            • Size 36KB
                                                                                                                                                                                                            • SHA256 2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_greek.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_greek.wnry
                                                                                                                                                                                                            • Size 47KB
                                                                                                                                                                                                            • SHA256 e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_indonesian.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_indonesian.wnry
                                                                                                                                                                                                            • Size 36KB
                                                                                                                                                                                                            • SHA256 23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_italian.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_italian.wnry
                                                                                                                                                                                                            • Size 36KB
                                                                                                                                                                                                            • SHA256 49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_japanese.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_japanese.wnry
                                                                                                                                                                                                            • Size 79KB
                                                                                                                                                                                                            • SHA256 7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_korean.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_korean.wnry
                                                                                                                                                                                                            • Size 89KB
                                                                                                                                                                                                            • SHA256 552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_latvian.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_latvian.wnry
                                                                                                                                                                                                            • Size 40KB
                                                                                                                                                                                                            • SHA256 a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_norwegian.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_norwegian.wnry
                                                                                                                                                                                                            • Size 36KB
                                                                                                                                                                                                            • SHA256 cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_polish.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_polish.wnry
                                                                                                                                                                                                            • Size 38KB
                                                                                                                                                                                                            • SHA256 519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_portuguese.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_portuguese.wnry
                                                                                                                                                                                                            • Size 37KB
                                                                                                                                                                                                            • SHA256 bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_romanian.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_romanian.wnry
                                                                                                                                                                                                            • Size 50KB
                                                                                                                                                                                                            • SHA256 70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_russian.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_russian.wnry
                                                                                                                                                                                                            • Size 46KB
                                                                                                                                                                                                            • SHA256 02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_slovak.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_slovak.wnry
                                                                                                                                                                                                            • Size 40KB
                                                                                                                                                                                                            • SHA256 e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_spanish.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_spanish.wnry
                                                                                                                                                                                                            • Size 36KB
                                                                                                                                                                                                            • SHA256 72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_swedish.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_swedish.wnry
                                                                                                                                                                                                            • Size 37KB
                                                                                                                                                                                                            • SHA256 146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_turkish.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_turkish.wnry
                                                                                                                                                                                                            • Size 41KB
                                                                                                                                                                                                            • SHA256 6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            m_vietnamese.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\msg\m_vietnamese.wnry
                                                                                                                                                                                                            • Size 91KB
                                                                                                                                                                                                            • SHA256 1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            r.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\r.wnry
                                                                                                                                                                                                            • Size 864B
                                                                                                                                                                                                            • SHA256 402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            s.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\s.wnry
                                                                                                                                                                                                            • Size 2.9MB
                                                                                                                                                                                                            • SHA256 e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            t.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\t.wnry
                                                                                                                                                                                                            • Size 64KB
                                                                                                                                                                                                            • SHA256 97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            taskdl.exe
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskdl.exe
                                                                                                                                                                                                            • Size 20KB
                                                                                                                                                                                                            • SHA256 4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            taskse.exe
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\taskse.exe
                                                                                                                                                                                                            • Size 20KB
                                                                                                                                                                                                            • SHA256 2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            u.wnry
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c7309bab-0139-4252-a886-c87106542aa4_WannaCry.zip.aa4\u.wnry
                                                                                                                                                                                                            • Size 240KB
                                                                                                                                                                                                            • SHA256 b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            content_new.js
                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2600_783610812\CRX_INSTALL\content_new.js
                                                                                                                                                                                                            • Size 10KB
                                                                                                                                                                                                            • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            LivingDeath.zip
                                                                                                                                                                                                            • Path C:\Users\Admin\Downloads\LivingDeath.zip
                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                            • SHA256 ac79108ef399615d5650fa17a8f99d75b334652aded993ecad90d1f176cb76d8
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            Malwarebytes ANTIVIRUS.exe
                                                                                                                                                                                                            • Path C:\Users\Admin\Downloads\Malwarebytes ANTIVIRUS.exe
                                                                                                                                                                                                            • Size 99B
                                                                                                                                                                                                            • SHA256 ddf992727a43f13c00fd91a06e5705c9b27d25f9450ac0d936f96c98c9a5c7c9
                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            WannaCry.zip.crdownload
                                                                                                                                                                                                            • Path C:\Users\Admin\Downloads\WannaCry.zip.crdownload
                                                                                                                                                                                                            • Size 3.3MB
                                                                                                                                                                                                            • SHA256 c0d0291ed579c974d771ecf6d255fc21122301868e40dce5c09fc67479a488d1
                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                            memory/1308-408-0x0000000010000000-0x0000000010010000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2528-0x000001E4D7EA0000-0x000001E4D7EA1000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2532-0x000001E4D7EA0000-0x000001E4D7EA1000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2186-0x0000000073B60000-0x0000000073D7C000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2180-0x0000000000820000-0x0000000000B1E000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2150-0x0000000073B60000-0x0000000073D7C000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2144-0x0000000000820000-0x0000000000B1E000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2087-0x0000000073B60000-0x0000000073D7C000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2081-0x0000000000820000-0x0000000000B1E000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2083-0x0000000073EC0000-0x0000000073F42000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2084-0x0000000073E30000-0x0000000073EB2000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2085-0x0000000073E00000-0x0000000073E22000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2086-0x0000000073D80000-0x0000000073DF7000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2082-0x0000000073F50000-0x0000000073F6C000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2078-0x0000000000820000-0x0000000000B1E000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2076-0x0000000073E30000-0x0000000073EB2000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2075-0x0000000073B60000-0x0000000073D7C000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2077-0x0000000073E00000-0x0000000073E22000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2074-0x0000000073EC0000-0x0000000073F42000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2184-0x0000000073E00000-0x0000000073E22000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2183-0x0000000073E30000-0x0000000073EB2000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2182-0x0000000073EC0000-0x0000000073F42000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2185-0x0000000073D80000-0x0000000073DF7000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2534-0x000001E4D7EA0000-0x000001E4D7EA1000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2535-0x000001E4D7EA0000-0x000001E4D7EA1000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2536-0x000001E4D7EA0000-0x000001E4D7EA1000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2537-0x000001E4D7EA0000-0x000001E4D7EA1000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2538-0x000001E4D7EA0000-0x000001E4D7EA1000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2533-0x000001E4D7EA0000-0x000001E4D7EA1000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2181-0x0000000073F50000-0x0000000073F6C000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2527-0x000001E4D7EA0000-0x000001E4D7EA1000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5160-2526-0x000001E4D7EA0000-0x000001E4D7EA1000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5300-2192-0x0000000000820000-0x0000000000B1E000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5300-2187-0x0000000073B60000-0x0000000073BE2000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5300-2188-0x0000000073D30000-0x0000000073F4C000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5300-2191-0x0000000000820000-0x0000000000B1E000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5300-2190-0x0000000073C70000-0x0000000073C92000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5300-2189-0x0000000073CA0000-0x0000000073D22000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5300-2198-0x0000000073B60000-0x0000000073BE2000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5300-2197-0x0000000073BF0000-0x0000000073C67000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5300-2196-0x0000000073C70000-0x0000000073C92000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5300-2195-0x0000000073CA0000-0x0000000073D22000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5300-2194-0x0000000073D30000-0x0000000073F4C000-memory.dmp
                                                                                                                                                                                                            Download

                                                                                                                                                                                                            memory/5300-2193-0x0000000073F50000-0x0000000073F6C000-memory.dmp
                                                                                                                                                                                                            Download