3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824

Analysis

max time kernel
300s
max time network
296s
platform
windows10_x64
resource
win10v20201028
submitted
10-12-2020 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
Size

425KB
MD5

8e2ccd9284e09ccc4e9eef325a83b435
SHA1

7710f609e7623a08f0dd7cb8fae1ff38d0c729ef
SHA256

3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824
SHA512

9827bdb32c04127ee0ccc41be9c84df40e7d2aa30c68dc9f9e5bfabcd920478884bbec0f3f8ddcbe5fba2eafafa3437b37af161d59fc39daa92202e2f884247f

Score

8^/10

ransomware spyware

Malware Config

Signatures

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\ApproveRedo.tiff	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File renamed	C:\Users\Admin\Pictures\ApproveRedo.tiff => C:\Users\Admin\Pictures\ApproveRedo.tiff.13E91832AA27BAE19DDEDB9A33D3F476600E3D47422944AEF7AC3DE37AE1626F	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File renamed	C:\Users\Admin\Pictures\RevokeEdit.crw => C:\Users\Admin\Pictures\RevokeEdit.crw.AF01B513AC6976B35F75240CF4746016D3E54698DF6DA35EC0C933F361415D5E	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File renamed	C:\Users\Admin\Pictures\OutDismount.crw => C:\Users\Admin\Pictures\OutDismount.crw.7CA5A0888EBA87C2AB1B78FB90E664C0C2225B43D10BA69E448341AAA82ACC50	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File renamed	C:\Users\Admin\Pictures\SwitchCompare.tif => C:\Users\Admin\Pictures\SwitchCompare.tif.6A847DA41947A90F3DFE79877CFF1A49611CC09E30B4B0C885C3260DC7B9930D	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File renamed	C:\Users\Admin\Pictures\TraceImport.png => C:\Users\Admin\Pictures\TraceImport.png.7B15AE420FEB683ED25853D45E4CA7B13D517BD4FEB9C36B7FB944EE52975A3B	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe

Drops startup file 1 IoCs

Processes:

3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\YOUR_FILES_ARE_ENCRYPTED.HTML	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 27 IoCs

Processes:

3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Public\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe

description	ioc	process
File opened (read-only)	\??\T:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened (read-only)	\??\I:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened (read-only)	\??\F:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened (read-only)	\??\H:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened (read-only)	\??\X:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened (read-only)	\??\M:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened (read-only)	\??\J:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened (read-only)	\??\L:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened (read-only)	\??\Z:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened (read-only)	\??\V:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened (read-only)	\??\W:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened (read-only)	\??\E:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened (read-only)	\??\Y:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened (read-only)	\??\U:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened (read-only)	\??\O:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened (read-only)	\??\P:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened (read-only)	\??\K:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened (read-only)	\??\Q:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened (read-only)	\??\R:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened (read-only)	\??\S:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened (read-only)	\??\G:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened (read-only)	\??\B:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
File opened (read-only)	\??\N:	3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe

Drops file in Windows directory 2 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdge.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

MicrosoftEdge.exeMicrosoftEdge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Colors	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Colors	MicrosoftEdge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies registry class 354 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 035186030bcfd601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{0831547D-825F-43DE-A00A-201AFB31D86A} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedHeight = "600"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = d0e4ff150bcfd601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesVersion = "6"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 998267c856add601	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 998267c856add601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

pid process

3628 MicrosoftEdgeCP.exe
3628 MicrosoftEdgeCP.exe
4552 MicrosoftEdgeCP.exe
4552 MicrosoftEdgeCP.exe

pid	process
3628	MicrosoftEdgeCP.exe
3628	MicrosoftEdgeCP.exe
4552	MicrosoftEdgeCP.exe
4552	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

vssvc.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeBackupPrivilege	3004	vssvc.exe
Token: SeRestorePrivilege	3004	vssvc.exe
Token: SeAuditPrivilege	3004	vssvc.exe
Token: SeDebugPrivilege	808	MicrosoftEdge.exe
Token: SeDebugPrivilege	808	MicrosoftEdge.exe
Token: SeDebugPrivilege	808	MicrosoftEdge.exe
Token: SeDebugPrivilege	808	MicrosoftEdge.exe
Token: SeDebugPrivilege	1232	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1232	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1232	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1232	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	808	MicrosoftEdge.exe
Token: SeDebugPrivilege	4828	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4828	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

808 MicrosoftEdge.exe
3628 MicrosoftEdgeCP.exe
3628 MicrosoftEdgeCP.exe
4300 MicrosoftEdge.exe
4552 MicrosoftEdgeCP.exe
4552 MicrosoftEdgeCP.exe

pid	process
808	MicrosoftEdge.exe
3628	MicrosoftEdgeCP.exe
3628	MicrosoftEdgeCP.exe
4300	MicrosoftEdge.exe
4552	MicrosoftEdgeCP.exe
4552	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	pid	process	target process
PID 3628 wrote to memory of 1232	3628	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3628 wrote to memory of 1232	3628	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3628 wrote to memory of 1232	3628	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3628 wrote to memory of 1232	3628	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3628 wrote to memory of 1232	3628	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3628 wrote to memory of 1232	3628	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4552 wrote to memory of 4616	4552	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4552 wrote to memory of 4616	4552	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4552 wrote to memory of 4616	4552	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4552 wrote to memory of 4616	4552	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4552 wrote to memory of 4616	4552	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4552 wrote to memory of 4616	4552	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe

C:\Users\Admin\AppData\Local\Temp\3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
"C:\Users\Admin\AppData\Local\Temp\3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Enumerates connected drives
PID:492

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:808

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:896

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3628

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1232

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4300

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4364

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4552

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4616

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4960

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log
MD5
ac3aee9240401d73ec13dae3a32897e7

SHA1
314ad904df25943f0526cce91f0342e9cb7ac15f

SHA256
5ef8f6f25b6cffc17d738f5af85359bab20dccd56f63862333b57f479a4eb7b4

SHA512
30dc8d49096d3c0d2c330b2fb168bd649803f07133a38324b0745de39e4cb5f2a081d5667d931b82513a431aad96f6586bbbce5993e65157caa35fc7f78f2220

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\edb.chk
MD5
c83fb3262e8a0d3d070c4254ae15acfe

SHA1
b9f8df4d5adc30466e5cc0161f2f0ac178b8506e

SHA256
59ccb316cc8327ec219da11099a5ccd1410346db538576ecbb1a613954dd1b37

SHA512
6beeaf279ff77740acb3e035cdd5a9e65639d3f211c054979ab1734ab1929883e4d8f6cec391cf4b9ca94d378c516e234aa97c21bc2ccdce041dbf5549658f49

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.edb
MD5
160cf1509cbecf98083bb1baf6eab040

SHA1
cf66bb4142f01ff07ff0f759da162b57f93d4ca7

SHA256
d127e6e8559af9f1786ea32b5f7fba80ae05817bc80f98d336143685b96b6336

SHA512
8ad2a9124fa10738ba1419ad6ed380b4d21f182c9fb0bf24dd4a55f71d8c8eeb353e0a4d95cc12a1d9b1050ca4824fe0cc97499073ebd982d1ef1e28f91fe4e6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.jfm
MD5
704f39853af13f78e6d6ae476bd805c1

SHA1
02b839e77c88cb52466bc92cc9b9831a1b948346

SHA256
06b6812edef3fac969a3f117b5ea441ae9131fcd85d21e7bd8e499bd43d2d78c

SHA512
48d853f9dc42f2c805cef5d75ba6f280818fd9db801c29d9b761a76300d0f797042b01b179794cb1a852fc7cdb2e72859c2f27869a48d7a673e0b44e10bb1ad1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\RecoveryStore.{AD74076C-9919-4A59-8013-556D901A0C55}.dat
MD5
92b77f605f1f6d20e5968c3598a4ed27

SHA1
a825a5c0936004944abd8571c5f64809e255c7bc

SHA256
3d010d2ef64cc669f1250be67302f805b913cf0f4af0e5af584652adfb5cffe3

SHA512
80f514b9cafe0f37f3a2326f582722bc6b8199efa1a5a25c10f72d38c938178d64e7cabc50077e052d9e504e175b9157d7abc0c6766076fc7b3ebddc41910a46

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\{63E15095-7D97-42BC-AE5E-5CB10E40AB20}.dat
MD5
eb29c991af09dfa7d98c9f7b12459560

SHA1
726c68f7d4238920873e30d5f57f7c550bfc94cf

SHA256
1e38f91e34e219564723b85227057ee4e94fd533bad5a024adbf5e8698c9a301

SHA512
79e08cd49300ce0e7c1948b5b3fb8ecb092772013e49eb42b43fd9da95e571d3cf8ac6adc33117f7829699d95245e01975a1182afcaba81560f3044c55abb650

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\YOUR_FILES_ARE_ENCRYPTED.HTML
MD5
a7399c28a49b723780edd82de862171a

SHA1
f047f0f71579e04a242d35cebb885f65864913bf

SHA256
95844858be75594d92a0bfac364f51fd2c05b4eb24dc861828e33af5b146dc0a

SHA512
6116eb44ccfca5270a25497e8af79c8fe46f2b39456f2a7e69c91bfe4858437c9687dfc6fe0515a920cb69a7752d2a39dec32010bd32d4c4a9fab54042a3bac0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\YOUR_FILES_ARE_ENCRYPTED.HTML
MD5
a7399c28a49b723780edd82de862171a

SHA1
f047f0f71579e04a242d35cebb885f65864913bf

SHA256
95844858be75594d92a0bfac364f51fd2c05b4eb24dc861828e33af5b146dc0a

SHA512
6116eb44ccfca5270a25497e8af79c8fe46f2b39456f2a7e69c91bfe4858437c9687dfc6fe0515a920cb69a7752d2a39dec32010bd32d4c4a9fab54042a3bac0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\YOUR_FILES_ARE_ENCRYPTED.HTML
MD5
a7399c28a49b723780edd82de862171a

SHA1
f047f0f71579e04a242d35cebb885f65864913bf

SHA256
95844858be75594d92a0bfac364f51fd2c05b4eb24dc861828e33af5b146dc0a

SHA512
6116eb44ccfca5270a25497e8af79c8fe46f2b39456f2a7e69c91bfe4858437c9687dfc6fe0515a920cb69a7752d2a39dec32010bd32d4c4a9fab54042a3bac0

Download Submit
C:\Users\Admin\Desktop\YOUR_FILES_ARE_ENCRYPTED.HTML
MD5
a7399c28a49b723780edd82de862171a

SHA1
f047f0f71579e04a242d35cebb885f65864913bf

SHA256
95844858be75594d92a0bfac364f51fd2c05b4eb24dc861828e33af5b146dc0a

SHA512
6116eb44ccfca5270a25497e8af79c8fe46f2b39456f2a7e69c91bfe4858437c9687dfc6fe0515a920cb69a7752d2a39dec32010bd32d4c4a9fab54042a3bac0

Download Submit