fantom | hxxp://www[.]e[.]com

Analysis

max time kernel
545s
max time network
549s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.e.com

Score

10^/10

fantom gandcrab backdoor bootkit evasion persistence ransomware

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-609813121-2907144057-1731107329-1000\IHBKJFD-MANUAL.txt

Family

gandcrab

Ransom Note

---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .IHBKJFD The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/ea2bc7585733c084 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAPvNoyYA0B61jsMtg2FPahX26suX1Ea3HA2qr/nWTy6l4vOM2u6LVCkmxrvBE7aUMsgFYB/KzvvXnQz1VMukcmaAqjWcTyajm6kBTOe3XoRnaKRkrkP7jihZZiIBcAY+kBO8kSYmOpOhN8vBXC1c6NH1KXR7k15oL41N6jJn0ZBYlgQ5cfXp+YmZU9m4IBNv3ZJh2Rqr2zb0E7KAACfZ/dEOSPzhwgRl8jAfJC/sDkXo3QMrpfyuisx8kzDGb6UKSB5R/4XdLJfvZxMNVsXJGaW2D+MX31+0xc1EQnGK1RQ0AbOVOBXuZZ4r/LKSr5WqAnjHgnYVumAe+J86Zaj8a2iDAxG6eybyhMdUN67tIUdxgP+iBsJDVRdQN2hm6P3xmEYnArCB3DQdum8EHV2gORIQxqYG4I6fu69W6hcm+RVc8YYEDDwX0+6ru53/wMJaZanoQ6YYBfG4JO26cT/UF0rqaNRetFWSgTMVxpHl9yZZ/rdtsKiTzOZ71xAQOVqIeGJxGEY9AZ/68NRgWj43QxIU2mPwPd+2mLz9L9+hyPvybqO8TjhElqR6dYEXVqn/BCIZcp3zb28MK9cZaDWIRAsM/9xI2+2L5ewqDstocIouhiE4Q7c3YvmA/sWpYjfsi/9JRd56XKinFsPg/x1N96SAUeJAIBX2MJTk8yUBQUAew8SFnQTK+3cDV6fvBV8l7Wlliwdjxke/P4YG4jkzyQHUQBurJQ1L0vzDDCPSDFXdFpDD5MfZoqaqZ2qakcdJLSNKtsltwIOfahG3mr1oXJN56hW2A2A8q9XRVOEDafFC8PJrUJ1vQPznuI+/F9uZ0MsQEtCzRil2j08NUeiQUvhHPF1XiyaQt/PjSTrjHY79IkoG0tj785VESKeaDamZ9ZZpX5pOgErgbDmLrqhj4h+b8PdCuiaDM6O888Swj+1LmwTpJVXyOLFhesrANLIeKg7s+WfnR7hnfOx0CkMIzjH9WItR02ksetqQoCwlpOEiFfe2+lWuMssv9psQESwSKRkkXXS2nM2tfz06XMf5caK8tPOKih9YPze3x2xyreBYPaJfUezaIsLE4ak5GDNufEVzaedwmw9MqhMod9y/7FOyzOL+sDAGl3dIcTHfwMLiG088ieJmQeEGLinPpGP+jV4bwRF0zE9N+Ryn9Gsd7ZnQD7HAPYOrbv7vQRfLxAc7CZk1QtltqxWz1ccx9i5A3nqCRQ8bkq5UsCjyiYfpJJs65DYwE6W9N4/KjMBlN1rnGolY8PXsbBkoIsYg3k0HXs2B7a/rJvQdzh4sX3yaKQG+tHsQoIObLNUicMb0rFCP13Pn/teMhyRWeDRrhLOnAxL/CYNJIZ1wfIO0M05GHo6P3wb/KT4l1qST2SFQWXUozF7fKJqbCI2jKcKlftBplKjxlLcPXuCJGdhyj3P+eB9O+rFrbTVhMgOCxB7lf5CuDbDud0AXB4U6msG72N/2qFV4HiqLK9zD2r+v0+DmJfK/YYrvQgFksz8eWoZTQ4Dyh1lGE86DXov+qQTAmVky/8qw8vXTnH37VIswGrLDZhqYPmNEfCty0veCWOhuDWZrYVGvKRVufX3mKt0i8jd9hKX4paTMWx2kBtzXwmmu+W3GbmRk5o9f4C8P1lL91Dlx3g6UFx6crf7L5sYFKs98mtHJ1tBrN8gJJ3PZ8MAJfU14M1QJ4nmk17Zxmebu1cB6+q8Gi5aECXgvlYaPGxmwuQHkHfjRz6r201f5F/KukfnGgCr1fO+LQzGLTV6ez3AKhLe5ltWSN9XmWHIdNlYU083bTza1hus9QLyP8WMQNwxyBuZ+87/KyO1kIEfNtz0MJ+e3+joYqBLonMAQu/BLFgNYt1MneZUuSLcWT2ALSwSDN9xRVv8RTNoLPHZR83j1J66bdOnBg9v+FlN6qHDUAfvnrrNwggrfTHqB5PuiN6SJMEkw6AtES6E3HOXhKfPNwurKNvUdndufQIt6Sof0RtMERpgLMEqnFAtU4fXMlathTNMEQfmpugwnhAs7fugLNx4CMVgvXfNWqatyCqSm7uctXzPLdjQmcGGy5j2MpNROlcHObyjDzgBd6cI1WiSHYuBJdgh7I/HQ41wQbIXEwrv3GCZyBNA1dSb2rjqySK2HwP+REprp8VptOOgbHESnFanABqmLDRpUWp3wVTnfKUqEPuJTvAnzjwhY/bNxdTgbHrhMzRqKz/pDyHb8oy+PczpC9b9mWaf/CHLZkf8yJMjKxgs= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDx9MbJMJDTAuWVtuDFRXzIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNx2WKAyu4W+5zlHFnKwMISBi1CwemOo6FrxnP+Z5F9bSR7OvDBsmLj7oYD6GBgpBqj3RSAVfvfE0yZSXyCRtLeJKNBcBiZq/MZtR+e3NLHEmdGRi0eDP9ryr/NlLLzjXaP0r1BW4eYoT03JrPa/L0B0wffnS0ez96BFoTHFq52HPDCx6yhEudvoPVoM6iaVy+mvqAdvYbwBrtkyoi8O1fKlXDmT7qd4Bew6gTmwK0yub5gfz9wpLQCj3bimwDPi8jPeKPiggI2bWKz+7QkWvC2ihYFfEuZEsyM4ANvhxNQXIE31UkGbyf6MN51c1gY/++QRe2kEznTbCqfrOdcnPBOVfcolLq8b/gmccCeV7bCGEZisVbSQnNiaPkJ9b5I041HXc2vSx6IODB3F1IH8qANwhkbcxMPGvnUSm+rK ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/ea2bc7585733c084

Extracted

Path

C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>bKRS+fUkVLtJInUnl9RYbukcDzQdMF1DdkjloLbvxV1eXU/0EsNmOW268pWOruNMULWw4/JQcgjQVQj5z4Gh2AuFcUz0XGrDwUgsyElLJVBYBxPeA7YJgoAlibLEeLN7dHZMFwEOyObN5INt4y9XNU2iPvRdeIZ8Dge4JqdZ+7N7+tEwX7t2R2E3ZaZidcLCfoPJyrdmF+loTSE5/EngnzGgFHmBI6GebMKFZcdCxXOPq7VlY0ovP/rKsWzV5c0MdTTE8owt4Eu3aTQBCVzZPKqJCZawMGcf1wqQ6l9Zse0W4GI10qiVD9XjIHYDpccOnJwvdOWlWLMGX4gL/V5ksQ==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Signatures

Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
ransomware fantom
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Renames multiple (1000) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Renames multiple (348) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
evasion

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5952	netsh.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
5172	attrib.exe

Sets service image path in registry 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\rbaqxkckfmofsmle\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\rbaqxkckfmofsmle.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\dwivslxeedyonoskm\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\dwivslxeedyonoskm.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\lynalntybbvdjdtto\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\lynalntybbvdjdtto.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\dukpxepvuewvheztj\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\dukpxepvuewvheztj.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mssql\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\mssql.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\gpiclgqdumyfrp\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\gpiclgqdumyfrp.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uonnmnrxqlplaf\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\uonnmnrxqlplaf.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\rcakigpkdkszxo\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\rcakigpkdkszxo.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mssqlaq\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\mssqlaq.sys"	mssql.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\IHBKJFD-MANUAL.txt	GandCrab.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\5733c7695733c0865a.lock	GandCrab.exe

Executes dropped EXE 5 IoCs

pid	Process
6040	nc123.exe
6616	mssql.exe
7032	mssql2.exe
3480	SearchHost.exe
4360	WindowsUpdate.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	GandCrab.exe
File opened (read-only)	\??\G:	GandCrab.exe
File opened (read-only)	\??\J:	GandCrab.exe
File opened (read-only)	\??\U:	GandCrab.exe
File opened (read-only)	\??\X:	GandCrab.exe
File opened (read-only)	\??\D:	SearchHost.exe
File opened (read-only)	\??\H:	GandCrab.exe
File opened (read-only)	\??\Q:	GandCrab.exe
File opened (read-only)	\??\R:	GandCrab.exe
File opened (read-only)	\??\N:	GandCrab.exe
File opened (read-only)	\??\P:	GandCrab.exe
File opened (read-only)	\??\Y:	GandCrab.exe
File opened (read-only)	\??\B:	GandCrab.exe
File opened (read-only)	\??\E:	GandCrab.exe
File opened (read-only)	\??\I:	GandCrab.exe
File opened (read-only)	\??\M:	GandCrab.exe
File opened (read-only)	\??\O:	GandCrab.exe
File opened (read-only)	\??\S:	GandCrab.exe
File opened (read-only)	\??\T:	GandCrab.exe
File opened (read-only)	\??\W:	GandCrab.exe
File opened (read-only)	\??\A:	GandCrab.exe
File opened (read-only)	\??\K:	GandCrab.exe
File opened (read-only)	\??\L:	GandCrab.exe
File opened (read-only)	\??\Z:	GandCrab.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
97	discord.com
98	discord.com

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	xpaj.exe
File opened for modification	\??\PHYSICALDRIVE0	xpaj.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\bxmeoengtf.bmp"	GandCrab.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\msdaorar.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Printing.resources.dll	xpaj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\chrome_elf.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll	xpajB.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak	Fantom.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\audio_filter\libcompressor_plugin.dll	xpajB.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\verify.dll	xpaj.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W1.png	Fantom.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-locale-l1-1-0.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll	xpajB.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\agavedefaulticon96x96.png	Fantom.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\D3DCompiler_47_cor3.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinTree.v11.1.dll	xpajB.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ug\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\MusicStoreLogo.scale-125_contrast-white.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-72_altform-unplated_contrast-black.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\FlatFreehand3D.mp4	Fantom.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\msdaurl.dll	xpajB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VVIEWDWG.DLL	xpajB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak	Fantom.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processthreads-l1-1-1.dll	xpajB.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\3039_32x32x32.png	Fantom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\libarchive_plugin.dll	xpaj.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\AppxManifest.xml	Fantom.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\x64\MSWebp_store.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll	xpajB.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Dark\Cavalier.png	Fantom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GKWord.dll	xpaj.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	Fantom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo.png	Fantom.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\LargeTile.scale-125.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageWideTile.scale-150.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteMedTile.scale-100.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSplashLogo.scale-250.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Camera_Capture.m4a	Fantom.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\clrcompression.dll	xpajB.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireMedTile.scale-100.jpg	Fantom.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\tmapi_xl.dll	xpajB.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_sk.json	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\msedgeupdateres_sk.dll	xpaj.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	Fantom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-200_contrast-black.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalStoreLogo.scale-100_contrast-black.png	Fantom.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\PresentationUI.resources.dll	xpajB.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-150_contrast-black.png	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	xpajB.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll	xpaj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc	Fantom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-64_altform-unplated.png	Fantom.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll	xpaj.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libaribsub_plugin.dll	xpaj.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libwave_plugin.dll	xpaj.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreSmallTile.scale-100.png	Fantom.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\pack200.exe	xpajB.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll	xpaj.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\autoconfig.js	Fantom.exe
File opened for modification	\??\c:\Program Files\7-Zip\7-zip.dll	xpajB.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6744	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6056	7256	WerFault.exe	187

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GandCrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GandCrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	GandCrab.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-609813121-2907144057-1731107329-1000\{8E76A43F-4FC0-46E3-B994-684E07A4B01C}	msedge.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2012	WINWORD.EXE
2012	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2972	msedge.exe
2972	msedge.exe
5016	identity_helper.exe
5016	identity_helper.exe
4356	msedge.exe
4356	msedge.exe
6844	msedge.exe
6844	msedge.exe
6844	msedge.exe
6844	msedge.exe
6400	msedge.exe
6400	msedge.exe
7256	GandCrab.exe
7256	GandCrab.exe
7256	GandCrab.exe
7256	GandCrab.exe
1512	Fantom.exe
1512	Fantom.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4496	xpajB.exe

Suspicious behavior: LoadsDriver 32 IoCs

pid	Process
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe
6616	mssql.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 58 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1512	Fantom.exe
Token: SeDebugPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeDebugPrivilege	7032	mssql2.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeLoadDriverPrivilege	6616	mssql.exe
Token: SeIncreaseQuotaPrivilege	1068	WMIC.exe
Token: SeSecurityPrivilege	1068	WMIC.exe
Token: SeTakeOwnershipPrivilege	1068	WMIC.exe
Token: SeLoadDriverPrivilege	1068	WMIC.exe
Token: SeSystemProfilePrivilege	1068	WMIC.exe
Token: SeSystemtimePrivilege	1068	WMIC.exe
Token: SeProfSingleProcessPrivilege	1068	WMIC.exe
Token: SeIncBasePriorityPrivilege	1068	WMIC.exe
Token: SeCreatePagefilePrivilege	1068	WMIC.exe
Token: SeBackupPrivilege	1068	WMIC.exe
Token: SeRestorePrivilege	1068	WMIC.exe
Token: SeShutdownPrivilege	1068	WMIC.exe
Token: SeDebugPrivilege	1068	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1068	WMIC.exe
Token: SeRemoteShutdownPrivilege	1068	WMIC.exe
Token: SeUndockPrivilege	1068	WMIC.exe
Token: SeManageVolumePrivilege	1068	WMIC.exe
Token: 33	1068	WMIC.exe
Token: 34	1068	WMIC.exe
Token: 35	1068	WMIC.exe
Token: 36	1068	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1068	WMIC.exe
Token: SeSecurityPrivilege	1068	WMIC.exe
Token: SeTakeOwnershipPrivilege	1068	WMIC.exe
Token: SeLoadDriverPrivilege	1068	WMIC.exe
Token: SeSystemProfilePrivilege	1068	WMIC.exe
Token: SeSystemtimePrivilege	1068	WMIC.exe
Token: SeProfSingleProcessPrivilege	1068	WMIC.exe
Token: SeIncBasePriorityPrivilege	1068	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
3480	SearchHost.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2012	WINWORD.EXE
2012	WINWORD.EXE
2012	WINWORD.EXE
2012	WINWORD.EXE
5140	xpaj.exe
5588	xpaj.exe
6616	mssql.exe
7032	mssql2.exe
3480	SearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 4192	2972	msedge.exe	83
PID 2972 wrote to memory of 4192	2972	msedge.exe	83
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2308	2972	msedge.exe	85
PID 2972 wrote to memory of 2172	2972	msedge.exe	86
PID 2972 wrote to memory of 2172	2972	msedge.exe	86
PID 2972 wrote to memory of 4112	2972	msedge.exe	87
PID 2972 wrote to memory of 4112	2972	msedge.exe	87
PID 2972 wrote to memory of 4112	2972	msedge.exe	87
PID 2972 wrote to memory of 4112	2972	msedge.exe	87
PID 2972 wrote to memory of 4112	2972	msedge.exe	87
PID 2972 wrote to memory of 4112	2972	msedge.exe	87
PID 2972 wrote to memory of 4112	2972	msedge.exe	87
PID 2972 wrote to memory of 4112	2972	msedge.exe	87
PID 2972 wrote to memory of 4112	2972	msedge.exe	87
PID 2972 wrote to memory of 4112	2972	msedge.exe	87
PID 2972 wrote to memory of 4112	2972	msedge.exe	87
PID 2972 wrote to memory of 4112	2972	msedge.exe	87
PID 2972 wrote to memory of 4112	2972	msedge.exe	87
PID 2972 wrote to memory of 4112	2972	msedge.exe	87
PID 2972 wrote to memory of 4112	2972	msedge.exe	87
PID 2972 wrote to memory of 4112	2972	msedge.exe	87
PID 2972 wrote to memory of 4112	2972	msedge.exe	87
PID 2972 wrote to memory of 4112	2972	msedge.exe	87
PID 2972 wrote to memory of 4112	2972	msedge.exe	87
PID 2972 wrote to memory of 4112	2972	msedge.exe	87

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5172	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.e.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad76e46f8,0x7ffad76e4708,0x7ffad76e4718
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3328 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7216 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7456 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7640 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2472 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7824 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8108 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8244 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8252 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8500 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8528 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9196 /prefetch:1
  2⤵
  PID:6268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9156 /prefetch:1
  2⤵
  PID:6276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9408 /prefetch:1
  2⤵
  PID:6284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9576 /prefetch:1
  2⤵
  PID:6332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9604 /prefetch:1
  2⤵
  PID:6368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9440 /prefetch:1
  2⤵
  PID:6376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9848 /prefetch:1
  2⤵
  PID:6388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9568 /prefetch:1
  2⤵
  PID:6588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10092 /prefetch:1
  2⤵
  PID:6600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10396 /prefetch:1
  2⤵
  PID:6612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10516 /prefetch:1
  2⤵
  PID:6620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10536 /prefetch:1
  2⤵
  PID:6628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10552 /prefetch:1
  2⤵
  PID:6636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11424 /prefetch:1
  2⤵
  PID:7352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11276 /prefetch:1
  2⤵
  PID:7808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9208 /prefetch:1
  2⤵
  PID:7816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10072 /prefetch:1
  2⤵
  PID:7912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12344 /prefetch:1
  2⤵
  PID:7988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9444 /prefetch:1
  2⤵
  PID:8060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8924 /prefetch:1
  2⤵
  PID:8128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12708 /prefetch:1
  2⤵
  PID:7648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12072 /prefetch:1
  2⤵
  PID:7324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11476 /prefetch:1
  2⤵
  PID:7292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=10524 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11772 /prefetch:1
  2⤵
  PID:6588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,3331063749726755082,8403943754572407093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3412

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x530 0x520
1⤵
PID:4580

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6948

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\WinNuke.98.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\WinNuke.98.exe"
1⤵
PID:3108

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Melissa.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2012

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Xpaj\xpajB.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Xpaj\xpajB.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
PID:4496

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Xpaj\xpaj.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Xpaj\xpaj.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:5140

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Xpaj\xpaj.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Xpaj\xpaj.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:5588

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Fantom.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Fantom.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1512
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:4360

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\GandCrab.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\GandCrab.exe"
1⤵
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:7256
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  PID:5812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7256 -s 1652
  2⤵
  - Program crash
  PID:6056

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Dharma.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Dharma.exe"
1⤵
PID:8044
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\nc123.exe
  "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\nc123.exe"
  2⤵
  - Executes dropped EXE
  PID:6040
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5384
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\mssql.exe
  "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\mssql.exe"
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:6616
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\mssql2.exe
  "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\mssql2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:7032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\Shadow.bat" "
  2⤵
  PID:5900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\systembackup.bat" "
  2⤵
  PID:3256
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value | Find "="
    3⤵
    PID:7360
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1068
  - - C:\Windows\SysWOW64\find.exe
      Find "="
      4⤵
      PID:1232
- - C:\Windows\SysWOW64\net.exe
    net user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
    3⤵
    PID:5248
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
      4⤵
      PID:1224
- - C:\Windows\SysWOW64\net.exe
    net localgroup Administrators systembackup /add
    3⤵
    PID:6580
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup Administrators systembackup /add
      4⤵
      PID:8188
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value | Find "="
    3⤵
    PID:3460
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value
      4⤵
      PID:6136
  - - C:\Windows\SysWOW64\find.exe
      Find "="
      4⤵
      PID:6084
- - C:\Windows\SysWOW64\net.exe
    net localgroup "Remote Desktop Users" systembackup /add
    3⤵
    PID:4108
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup "Remote Desktop Users" systembackup /add
      4⤵
      PID:4644
- - C:\Windows\SysWOW64\net.exe
    net accounts /forcelogoff:no /maxpwage:unlimited
    3⤵
    PID:7264
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 accounts /forcelogoff:no /maxpwage:unlimited
      4⤵
      PID:6248
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f
    3⤵
    PID:2700
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0x0 /f
    3⤵
    PID:5492
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v systembackup /t REG_DWORD /d 0x0 /f
    3⤵
    PID:1904
- - C:\Windows\SysWOW64\attrib.exe
    attrib C:\users\systembackup +r +a +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:5172
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add portopening TCP 3389 "Remote Desktop"
    3⤵
    - Modifies Windows Firewall
    PID:5952
- - C:\Windows\SysWOW64\sc.exe
    sc config tlntsvr start=auto
    3⤵
    - Launches sc.exe
    PID:6744
- - C:\Windows\SysWOW64\net.exe
    net start Telnet
    3⤵
    PID:5080
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start Telnet
      4⤵
      PID:3084
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\EVER\SearchHost.exe
  "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\EVER\SearchHost.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 7256 -ip 7256
1⤵
PID:8168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-609813121-2907144057-1731107329-1000\IHBKJFD-MANUAL.txt

Filesize
8KB

MD5
8ec6c7be998c19abedbbf3760a4a5804

SHA1
272fa9f47fe2c3510086d52b0889a97582eb5276

SHA256
3aecb2de3872fbc4ede8cd3ce57d14e610f19a3e576591245438697675766fca

SHA512
ae5dd9bbf844d3f57c92b0ccefd56b6b829004c55609a26579ab19367cb697874b22770a0072b0e4a1997a12c7c0e593b1b6dd55c297350bc93b0e7e9944cf64

Download Submit
C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
eaee84de4814bf93a4b6d21d98caadbb

SHA1
c6facd840a3dd48c2a8de216eebcf31764ec46e1

SHA256
372fa18e9d4496027115b3a43a653369ccf52a10a49292d0bf33d97492dffbcb

SHA512
cf5e6aae0679e39364fdb142421b7913f137133052da65c5e2c7c1f6b670ebbe2eccc2754b2cc69437970a9b5d58b82a63c4b764057ab0f8132aa9ba60f6cc1c

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
160B

MD5
33e0e59dfd2992787580692df18a9f56

SHA1
4118950ae0434d2c12de580f67da934c39e5eecb

SHA256
1d17a5994fdc893c3db492d7e12588691e7868a7255450bc66f30635d15ad425

SHA512
379e8771fde3bc31837cd4fc3eacf1c74843216d8ee57642c7f3c4aba9e7805c06d183f5d3482dad5ec6bd6ea9371a08ec92a9862f7aecad7ab5fad4619de6d5

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
192B

MD5
8125b9ca6a4227c16b9684e47006ef45

SHA1
b33b4e6cf5c1e4bfeeeeb483a132604f89342da6

SHA256
b937a2eb6881e8eff8072e202b76a855ac23b739fd8842902fe2b3586ca2cc2d

SHA512
3b8057e7038a2bcef856e9c9bf7eb8695ae2062e734d6140847c30d63a695ba02661c71db236e8432a156633c71cb2259246ce4a677b0ebc5b132a1f59ee2e30

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
192B

MD5
6642a62a2d0c813e5908e88ef61df70b

SHA1
f48249f2fb60dbfe749c57d083b1a561aa7df8d2

SHA256
b94347d2c25b717235e6b6c790db77846338b438cfae8b2905a731a24899617d

SHA512
f09a067c4336ee91c3a3c304387f9bdd41785b5ad8d6910d570cc0485426a147b17ce9342622e9af709c795245c36144301f69e6e8e6b7eaee78a78cb53f1d5a

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
d9cd335cae5ba0b3b1a16eab76ab322d

SHA1
5ed5479f2ad81310fb4abd46d8ff2135fd45198d

SHA256
2a5a8fd9d943c78d5516ad3543a032d211a1ef3059943fcc8a1aecad92350f48

SHA512
c8e6f00a68d26bd9c4eb2fc7410fdae752f3766aa7153ced014724cf4d43154b9bd82e213ad25ac2f2f012e8b7d35133d7504cd1ab13083fc8597a7ac29dafdd

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
98c46e2b225a9ad2419036476132f0d0

SHA1
de53194f892061ade03b8f8acb35b29b3c1f61b9

SHA256
5834397153ac92dced2a6843610bb1a5d685098bcfe047731cef7ae43c669caf

SHA512
fc97d753e20aef52cbfba58ecbf20c334198537786565a6fa1f7051cbd30a0f4a2056c676067db1ee36e9cce05509280deea94655d6c343df07f9447690719a4

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
f318cad64cb60a023c45eb3538f8b2a7

SHA1
72d5e9818cb5d8af87a38ddd84474ef5cee96949

SHA256
f21f8b564a69108106b7f0942195e25bd7b99cb4eb77183741be0191a443b340

SHA512
34245bb37ba8c891182d49729b3506a34aa9c113cd52b0ecc9d6c205e0a0b5092747c8aa1e251bcbd63899891272bb44f9b7b4089f06f35983e5bcadfc062424

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
ddb4b1df43d66aa95a0cd3cd5f6d9bce

SHA1
8bac239a3ad83f7a55b6b40de199b16a4bce2948

SHA256
f23aad67e54385fea2e6e6d7af1727979db24a31e0cc2c92b5a02b5796dc2729

SHA512
86e942b625d1080dc8e95fbda2e0c0b0e228fc11c2fd6b4de9b80bbe122c987774c0adf9b3a8cd12005fe4bc13b555756ba6d9ec54aac1d91b4fdd2460509c48

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
d5d79627cefce54ba3e602aa0da782a3

SHA1
f67e6fb33fccddd733d3b82971be75b57b6c7e34

SHA256
666fed978372e788030562f4d582f88f40c07fedf5ebf788666c5e29544fbfa9

SHA512
99e900879c7542e216013745781e2cb4eded26c60f0c11b40bd3ae8a9a3fd389132510414eb17ded552d737b20ab6dd7ebca5a9fdec48691329da1b3c5236c67

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
4f8ab1a02e07bb110ac4f1d8c5f28ade

SHA1
d95cd66d5962e629e394579bc9cbf86a375eca4b

SHA256
8348a04f01101b3ec427f8d67a19649aea2ac7b7f76b473c4b1c21e82e701bca

SHA512
afb35d13d98ef21377bbc0979315899de238fd4d7587a0b41273108953dc1f1db7c45f35ca5845d86cbb9c0d62fef3e99b08a28fba0efb2e3e5b566f1038b304

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
f167ff3cabf90f5b386636e27e3ebc0c

SHA1
59cee4ba41ffed1c8edbb1eed15ea26b0d221b4f

SHA256
0863e63a7badea9eb2422744fc3dd54e1ff49648965fb50b834e41a61afce8e7

SHA512
30c2e99480afad2826d7b9aa5c40d03e00366d5e0f6bd0db3e815b46e2f5d2a55265954e95a4469b7c4fd146fd1b4403bfb2752652fce575fdcd061ef6c49afa

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
913ea72e6e6bcb5eeb7f832613d59a1b

SHA1
0c960612c17e1727bad86c6e917ee029a192c95a

SHA256
9c3b85ba25484c754366a452578e70cba416bb973b051caf959924b7ac6d4fd9

SHA512
db57463b4a11736c39356ea3e001b83a0ad65ed3e622b764770bd012d45e312f684b470ca4bb9796f42d31d10b020c1ced884be5df77d470ea62ee753085b7a7

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
cab862cf0bf4417aab32822e6a9f1f7a

SHA1
45ccd3168cd69dd289778493321b760180ceea47

SHA256
d3f0b2146e539684b15c460ea7f800988a8d5598dc717779169cd3fa37129c11

SHA512
687a556aaccb319d94758d1733e3f3f0e2bc7f0f9e7b17f9a746f36480518c319825daa86980573e853ddc0163891d67daa8a8ecf58d0704f4ce92b506595e6c

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
8df5cc4881e487f43f823c9d8176b824

SHA1
aa7af968c03407c25a95b790ef5ecfb94951a334

SHA256
b43d9deb3c32d7132836e824ccdad27ffe2e699532994d5797e73beeb1a33f48

SHA512
32b43ace75f24d0eaa225b1ebc7125b91ef37dbd4f6369de39b0398cdb244fa011145a63b97efd515cd3083e567218d24d2defe04f73fb5a81cd4201a24e07a8

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
fa606295c469e01045528d012405014a

SHA1
3e59c58b5a32522f5d0785d574683c16669ccd38

SHA256
297299ee0c2b93ba94e0fb621a13dd3749c626473f08e439c3e640a232abd545

SHA512
226686edbdc302a57f383670ae80f116d4aaea10126938afe16f11e27eb9e3f8afba4196c66091002c332ba8a1a41454f4d8fb97d964d8075e3a9865f726e4fe

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
8262b138d66e0bb3a4ccf9478dbe919e

SHA1
a2912be737dbbfd12dc5ca9102d8cdf7d9315afc

SHA256
4756b8df12a04f495d98183b882eea9ec38ecd897c8a3087af3209dcff548da5

SHA512
22cd47db6a03db87ce89b98ba5d38b50ecac31c1278fa044f0fa10577d524854822b7ea161bffab361bb0e52ce7d5497c5880166ed77d9e84e4896e3e9476f80

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
415ab0376a7843af6d436b93625e85ea

SHA1
463ee718f64d31e253776417c727e25bf1ea494e

SHA256
c0cbc57b87fd126ead0cf61385243a94c9e1cea58824f114a08753e95659222e

SHA512
66e61a0cc9a7bde909f1d4e83783bc9d9bde322b5211a31e1c4ea097e742e3389c647ac53759d74156a198a6cf6360c34ca2d1017685dc49263a77494aced9aa

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
74644dd4963864dd78a52cdf4a9e33cd

SHA1
3f5b1acc9fbc8ed42508e09eedcf683333a954d3

SHA256
0846be723e1c8fb31cd5c376eed6eedcec5ac7b1cd76caeddc9da89f077ba737

SHA512
62374da16a7df0d5e37dc6d0b62a172987f5194db5124a8c378b0adcc5279f2657edf850a9c83a7f0a18c5f11720b6c068f388fc7f733bb30aeaadd236bbfb7d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
176B

MD5
64b1125c6dceafe37031fdf5fff2f4d6

SHA1
aaabdd170ddb8404988ce12ccb8d16c5413c4fc2

SHA256
3af3ab55bac77449176740350c35d3eb5738920b443bfb8f37d65f3d18e34a88

SHA512
1563866ab1588e24ff78d050b102f0a4bc9a54d27b3bee94eacf1e0989a3138dff3fc024212ad973daeca83242c4179dc6d2ebdb2afe9815203db25202cab7c5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
a51393b28ca15deef412730b3cd40fd3

SHA1
d6d6f04edae503a36e69ae33e215beeed83aad79

SHA256
de1a50ab0ec2aa45df0d4d74fcfcbffb5e3bb3c11e9054251f2c794550d960cd

SHA512
02a5c5e38df03d146bd0b88aacdc6402f29558d22dc2f627c42885109cddd3e17ba2544903593f3d974c05eefafb8ab7b723b3b724717157e87f0d4102a6c843

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
43fd7eb451e3ab32dfe82cb351ba208c

SHA1
62730e28f91a916c3daf8b82dacd10076edada04

SHA256
6507554ab88d533a2669e1fd35af4fe63a5180f896ee67f4265cced1838a0d1d

SHA512
3a4e8749efa43c22c2c548c294f242b55e681ed89a6cc5f7bbab5091bdae20016f5f1bf613009f799345396ab5fecbb0b5c3662fa2f1cf61d2a492ca400523c0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
fad7623b3700bc1bb8f12eaf9ec309eb

SHA1
838663192b66ee032cf9ec5a6a88c75b2b920349

SHA256
17b41d35707b4727cc5cdbb40e20b4fbb599498f806a912b78050b3805a920c4

SHA512
e7a0cd8ce55703ccb7703b22bd3abcf772e3cd83dc8e6f900fc22df4e33ed32ccd382c48111654a1e730f90d37dd81034349eb212d133cae91935073275134fe

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
48a283912a82bf8d80af56a68d47fe4d

SHA1
d7e3417d20b07db0de36877f697e0571726f6111

SHA256
0663bff26ecd86bef1e959de16e1e4fe1521b74bdab1ab15e8a496e87d3b290c

SHA512
595700f47b21b11f1261716a43e976d1e4fcd70f714474724242058861172e4463c07c1e22f5de438d69dcb147c93c2a2540fff490e798baf437ecd33064e9d5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
7c2f99f8c509b0d721ea19deb62d4ab2

SHA1
290a8559d03146b271bedc04128141888e936acc

SHA256
16b3540af2e090375622139146be7c981d7b12bd48d17e222adff214673b5276

SHA512
604934250634d30c3fc58cf01a024e6aefb0d6947013a5c9894a538ee4218245c1d4e350106f41231fd8f101f71e6907b6a97ef03fc7601e472f7d8f91a8294b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
2d2f02cf14170fc1eba7bbd5faffa79c

SHA1
3b79c9062f17d59e1090a7ab36546bafe1874b77

SHA256
95782051631d2e29dac49ece7a3117919d69db2a19c819fcc0eafc35658c9e87

SHA512
2bb41c32d34b5c79378a6fabc3b97a0f695b67eeb92a862dfc0aab071f48fb79cd7e29df45e6635b1cd75cae84757d7f7645dc316aa57662f433a914f5d54a83

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
009fbaf8393832396a852ef169822764

SHA1
dd7f014982a0875112decc95714b5ad0399a8731

SHA256
4c133ab5abe881597c59d44ef4578e452977c104feb4afc20c0b038da0d76ce4

SHA512
8353dcbf443891d1be7dcf3c63411cac37b49119891009e5e17a6e2891572d62337e38cd78b1fa83795483336db785c43f91a8019a267e1622cfa4c9483e3c6f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
64265c1722bab28e72fc4ad7f20873d1

SHA1
4cb6174896dffba30d3241d98fb42d912e9d7abc

SHA256
9293f05d4ab24affeceefa5c3c013928a4c23b0e7c74c56a480a579a456e6889

SHA512
70cd2ebe4b803b14357f25ccda04b99860106e9c656943d4517670b12d7493bfcac90ad24c28b4a0f2909b069d81fac7dd3ba635e8328d563285d66029ebd17c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
0621f5c468ec9a5a8cbce463b736fefc

SHA1
2ccc2c2b5d8233a71076cf70b6b2304e9e924152

SHA256
06de62a88702b59ea0f897f099fc89eb023a2e060d071b51d1cba7a18ea403c5

SHA512
dd9b8ab5b19b3826090fd3bd2332efbce5be23f1be803ebb2802dece5432026e8b084ebc2c40f414fbe014d3d99428a22a66d3cb7901785f4b2bdaec43c20e48

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
f86e122d9245a6e6b7b0b20d174abcbf

SHA1
429734c181a53f7c15280a5957048a4bbe5cab4d

SHA256
de10f99269aa1bd85ac5fe22fde18778d6594445d182a8c9a46e16f0f121749f

SHA512
c7b7f3bde73f5db1775ec65c44cbe5899a2dd8df382b7890e44cc97a1356c2ad0898dea7896d20278dd4852ce1577fcfb43ac739528e7889d1fcee9b921c12c8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
0662fdac334518b10608345eb7ebe853

SHA1
e7965786883e4e83ec30b170a81aaba3e5e504d6

SHA256
829cd034323d15a716efdfa1435989567e338f4886fb75430c1b0c4eba581c0c

SHA512
174a4c36845e6c79143f3e9871e84e657d047b3a90476e3662529875424bc6ca814ac400cb5081f42d334647f91824aeae64cffdf5ad5db76a0b7c47154c06fc

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
b891badb7441e4b446bb1613f9d0cc7b

SHA1
fdc25a0f0cfac1ce3d2b079fa204fc7a40134672

SHA256
d90f44b8f0d2a6153074318dfe3b10ca35db4053f578b7e3a23ba2b64ca4bc95

SHA512
184daa55b2eee6a774bed21dcc0356d9f4b10d12caa4ce2a6cf5b563a86fb1874e43fda1195347f173548b699e4577b5eab43df56de460b87c2fab6d6caba553

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
11d22b465a08e1f76f5bb1012df0f52a

SHA1
13f6d3c94c08ba38af21f54e8852d628b65a67df

SHA256
bbff924548d3adf507ba193f1beac3eb0253f3eb2cc876e578c7d366ce0140e8

SHA512
b029f2c612eb9f8e91afc5f47c5f0a391292e9594d78316690db66c6ebcc0c423c3e6c13358eb0b71fd49d972c2814991e14355d3b38a8227ff8d4734de61f38

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
52f516659b7092572299df36eeeb85b0

SHA1
404b455ca7473ffc683355c891fff425bba87266

SHA256
3ef8f732145a1d078b74f1010766ed9f6397ed9b3ab882aaee8f548baa7ce487

SHA512
0f274e82a77514e7dcff3c80c290d362bedd8024a34b4e05f33e0ea925cfbd76dad6ecc7612fcbf9c0a441b8bed10c7f342bc2773a09a9e0cccfd41155e5d4e3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
2ef739ac7c7f61269e89797f24d9efce

SHA1
dd6a1267f402d199a8022bd2c41c481eac42cf30

SHA256
c6693302ebc06bb0646db34052f5c5ecd516cf75c3ec6bcb6a6baa60dc882992

SHA512
552f8c1ab2dae616c34cbe872d15069b66c4e61fd6151ea51267ed8266da7ad612029d66bda3a2cee0940e6237577b420bf505194d889dbe9b0f5fb0b5f5d889

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
52260204bcd95aa62e95744f866cb294

SHA1
23d516743823165cc1711761dc55027317e115e0

SHA256
a20d064c16e47cb6daddb9e73375c9b6d5d6165b1525b6fee2b0792d9e520310

SHA512
abd5f613e6213118925630b3adfda3cc8c294378114efba857b14cda7e1f18738248af44a89fbb03203d15d37aaf9722ce02c6f51dc0cfd5d3301793e1c41f63

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
2ed3e3436600f71425ae302f06b51f11

SHA1
0c159384d3d83dc49f6a728343ee7b9efaf317f8

SHA256
179e868d7cf8d8bf2e702a451b95ee94371a417c1ecd0114e43fec12d6776158

SHA512
0fdc74394264d858203b66ef8daca65d7e387f7b41c3b384c0ac77ed2802a5d7a3e14cc935a9f0fc2df581b2af974d4558f1c59dbf1e46e4721b344b21dcb612

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
9f36ef40440dfce5a64e73174e01decc

SHA1
f9a7f4e0350551903fac4902e784b7f767ee7c6c

SHA256
c17b926fa40d16c4770cf292cff099db4093a0bb90da9a904cb1e0a98cab1599

SHA512
32c1ce6e953179d127579d1991caccd0c2f9259b45724d8dc788a6997e42a7d48e2b749a032752b8b09a46f2782c64c5161faeb9d273ef2427c1bdbb53299b26

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
dea3d44c958a8f84ed5c5287371b5040

SHA1
e7a59205261dbe1024fedaa217ec84fcdb7f8f76

SHA256
8b04e6520fe4a02609928a35e119364032cb7a7b1db74becdb6b766fe72f5b93

SHA512
fb206da64d7333d7ffccb4c8178a72e30c3deeb91743e2d5cf13908bdd6bc451671f82b8ddd4ce6b9d0844cc64a97c48d2aa6a9337a3c5d06f61f459af3505c6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
b4decb79b7bdd5bb8d0d6ad1e24652e0

SHA1
3a5bcb9daf6e19d811dcc3a8e894d197cfa0485d

SHA256
26fdef45cb5e0079e4aa28623ce03521766ab21bd0283beeae7654e12f02ee11

SHA512
3af540ddc177d1535e2ae82b1826fd9fe70aa00c2c4f7c4c1643b02830815515b258cb9bc5f77ccf4bd025d6382f00c87c98217c58c5d9549734815401a7b8f7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
354c062b4b4d2fe6584bd1aff8bf7fc0

SHA1
4f9d8c261ac68a439608275b117efd9fa5f3bae0

SHA256
03b367e6a96c3267ea53e8875e1dbae65e18cccd90693679ad6a1542f8b95103

SHA512
22cc3bb518d63ff148c1be8012573e5e4670e0b057495979d7c050aadd94c787e2b82f6d287c09bf3961c99bbac6d4137c7418bbab0baee44c6fd88519bd6586

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
ff97b13cf21333d54932721c70a1960c

SHA1
48015facecff9f9418d2fddab0c171c66836e3c8

SHA256
df3881d9e69815b7f51fa7d00ab2e976d93fada01d68f48fd3c0fc8c7d087de9

SHA512
55781f2084d3d4c651e0fadcd73cee54c7c0f5af7180eda31b1cc21c799a506700e503313e86dd84b5da63f7e7111dcfe7b551d1c044decfc4e770df3ef3dcb1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
b0dd4e2b6c7d6875c0820f26f3ec0493

SHA1
54d8fecb9f1e1985404895ac04c25f9e8d9a5807

SHA256
8dc26191fd6e79747ed4d93348401260cf02ebdab650a136ecfe29e81fa41c47

SHA512
dd7c599ada2b71ddefce249194b6345f9daca67a556f021d7621840185118a2825f2d57c92b56cfff9be009d325396a17e5e557c583aab5fcb2db1b9c4f4f998

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
53d8b6b279426d2421eea7813fff9123

SHA1
74b0069594bf058300b602d74dca836af0f68b11

SHA256
bd968796c2e10280faaf377c84ab457b4f51ea2fa608ea538f3785646d8bc8b9

SHA512
1fc59858dad398cbc7565ce8c0a69c00ac0c56b1b14ecea4407a7accd4ab45820e073ad5802d4146a30c84747f2ab5c1e0d085487dc9aaa590716e6fbf8a936f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
1fef7be6a3ab7afcd04d6f60129f36b8

SHA1
33892dbf2b45ca6d49fa8bd1785cfc799e8e80cd

SHA256
efc26179a7f340c03bb627924bd1dbc92721939f271afab55ce7d87742b87f6f

SHA512
0fbc02371b3c3daff0a22e435c690eb549eeff89d65191d24333063ec0201fe65befb201a4a26386332e13cf28e7a4121dd1c2b09845604ca4162f80f74deda5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1024B

MD5
07b1208ea6751fe944c0932cd4cc1ee8

SHA1
2c1aba21db3a9c81f863b8876c08371ae9d9dc9d

SHA256
827f0f816d9ec70452b8376850a26e4fe093ba6791533cd9acee86a47a6da4c1

SHA512
72c9163fc3e808102d842db5dfd1db937592bc68aa71953000058e8a4e3894c371aad2e42b97d65763a54d337a82b7a74876ec6a06254f29cec04abfd927b056

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
48B

MD5
34ef339093e27621e8f6084afb4ccfc2

SHA1
161723005140c7fc8c21ac4a64df4e501e31e42b

SHA256
b9a424a0ec5aeb5b4cc1eafe9bac13dcf53dc0a174f00fc9da50cc856d840bca

SHA512
ae4d19bb317ece6ef2db6999d41998a7985df81e3c65f545df2509f96d38e250d2c7e8f7951d26d23ef1a7411f5f2376e5729fdcbbf04522434dc2e589e8d9fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
69KB

MD5
a127a49f49671771565e01d883a5e4fa

SHA1
09ec098e238b34c09406628c6bee1b81472fc003

SHA256
3f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6

SHA512
61b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
34KB

MD5
9c590e81df05114baac6d16ccfb3f4dd

SHA1
c0b04d7ae121b7f321f9d1b53eee61b796b77af0

SHA256
fe981022bd386f561ddac4e07c274d7334080296208d429f7d06f71141629026

SHA512
36ab5aea201370d1e74fafa75410237981287da3bc56583c5be64cf5d51407c685f67df2dc7844fe061668854d9a2c75f17161f435c4dca12ab1b29dbddc7c2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
1.2MB

MD5
8f4b4d5d848b49f72ec9d45000e45fb0

SHA1
6517ec20d81ce901746076948417cfafdbcc2d20

SHA256
dd35fa6ced81d040a5aaa4726885204f44abc7ff1f7a83874b76f34bcc4d1598

SHA512
9704356124a9f7df23cc91ff93b13fbcfbc0d09d92fa0a5d4c1dec65f7ab78ad2786ffd9ddc304bc24df4a0cfe43afa24cc0c6cc3c721088320feb5c6f7e7baa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
43568e123e8a0985d4c614ceea74bb50

SHA1
5b3e166fb557eb665ccf43efcadfa27bd8f3b196

SHA256
115c60e3fb6f0208cd1a2b50502aeabc3f43b0e174f8200606a5861bcadf54ff

SHA512
c1cb13ee4ee6c7d7514e3831c69129ecbe448967bffea17dbb0ec8205c9459b09777453f05385b6e199ca44f1681e39263309856616a620edb7e397a2be8cf35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
62a85087de74b23b791f0b60b5c751c5

SHA1
7ebbfbeae45fcd6da082006b774555ec1f6b3e3d

SHA256
44664cbef1d0a83555463288e3354d8549e7f64ad6a1d208665fd9d24867ee7b

SHA512
efabd138c1cf1785849ef72589c125a3932a8794fdae741a92330f17564cc42d4f353f0194a9d011a46592699c47b0f3da238387163add76354efd96986eee7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_prebid.a-mo.net_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.fandom.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
17KB

MD5
bb67de5b24ae5caba602694e4c6e5f34

SHA1
0bbe50a6467502c4bfe45c17b90f9b79bdde886d

SHA256
8f98e4a163d533cc11c453b893b6d0e365fe95640268656360bf8e30a92e5dc4

SHA512
22921ae578456054ed7e596b86ea26570c698afb11de558f8371cb9addb2f2ea8d8fbaa0b2f0bf0c637fdb261955d8bc6b05a617588a267b30ccffc7438eebd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
17KB

MD5
8e4cccd2ec5691becb35ca9968ec46a1

SHA1
fc315f7c4d901fe1fbe43056a179a7067241c253

SHA256
ba4e7489bbef7a0792a5ae6536bcc930e3870584eb1d220e738b3b0d7c24349d

SHA512
3b14c080e92643a5f4efcfa1b97c3e75038bda8ea51d57268b8c290c78911a663135283549eb6b039db29927aca29360b0be82cd5f348dede8bdf0836ea0228b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
222b69d9f3113fc666c7bcf2948b646c

SHA1
4c5727314d07b0629c80606cbf25276849e87ecc

SHA256
2519a95151d5de7f74c97a9226f1e982ef32467eef818c8619971a5c40bbb4d7

SHA512
d017a7f3ce2adc278d738dbe7d9c51e65b7c6e1cb84776c67a5ba70dcfce95b12c9be7954fea40d3e97220eac178f542cd1f8241d8b267b1910c5aaa7816ddf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b937b9b931feb2958d7946708c5596b3

SHA1
5c87e089590e72ee7d2ab44fb47bd0beaf2d6d0a

SHA256
e26eb9cb4dfcb5bfbba9531f4e8230e99e4f22d47398e1afa2766bef1a6f6361

SHA512
e49710a0ac609bc38d9ab6e5b375713763ffd80747629cf31b85e95d6b51fdd5b9867377d0706f2cd1683a74b8694bafe31a2da4a4bf71129d4e187d804a7fe6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8f5944aedc6cfcdadbb2bfcfd6b2a928

SHA1
d01c952929145d7c9b7b3f2de540d2b8c923b734

SHA256
142021a06168ad606241d84482635a3496ed8304e151918235c407d4f645355f

SHA512
46b5b30f1b5e7e424eff9bdc2ac376dcb7dc7d522a7ee9a593d417c8537b05fd938ce37c8fee22b01c86c95535e14ada1c1163a61e61bc8fde31750e3d639658

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
21KB

MD5
c9be54e6da172ff7b42a5c88791a3a1f

SHA1
4255b1f51381c6b135da0c960f0c216430702acb

SHA256
3066faf75b35025843f10e74a99a2573a025df8be5b54cfb04f6e4c9fd70e729

SHA512
4180abd5be90d00a862b13d07520eb4b0ca026bda1e428eeea4ae8377699e54914eb5fcf6b23e621b7fd62ad78b9fb950aec4af61f51586aa0a63ee0fb6cbc81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
21KB

MD5
9cf6ef434542f029735076d5568db100

SHA1
8662d162357f4098d062e6893a105e8412ab86d2

SHA256
6664512c3ba40404ecb274e8230d483d960f143eb9457ca673787dbb36535a88

SHA512
42c097436ad391019c26411e293fbbbd00a702f4e0d21ae1bb03390b51cbeb5a8ea3210e9e25c9c36cacaa3c13ad4d983b75d4a5bb1ffd825415a876cc6ab292

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
21KB

MD5
36dd7d51f904b9b6cbce0704558f925d

SHA1
77d81c4517774ef00739ca60e552ca60b74f8790

SHA256
ec7c5cd51b8b65e9409abd1aefc1b667ada164674e110f47f63af28a534d5289

SHA512
e9095910014bdddcf25c640e90680ec0db0ef57cec77e7ef4920711e98b78d94881e0d0bbceed127b4f3a69316efc8940fe481c9985013ceac52a46058eefdd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
9KB

MD5
9bfa173cd9d8a7f3d92b5f261d2a1b26

SHA1
43265e374c86dcfe64dd2cce8aaa56d44b4535ac

SHA256
2a653df7db615319c6e46a3848c47c64027a068f8f424a9b0876cf2b983e7f12

SHA512
c6f42ec711406dd1d89d8d0d75459d564986ab6bd936b3427bad432fbc1de31a2e03d2ab76f9665787d6a96c89fd4c754cf73c78466324e6cad8ad75d45e6f67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
9KB

MD5
ccb4722e0867ee76257aac3ed6c320c6

SHA1
2a3f7f7712caabdece7e838cf17c98d1bf2a9d33

SHA256
0c950b03deaf4841196bfb99616d5962017ce20bb83e8284c9075d5fef764236

SHA512
c69a17caef34a5aa69989539fc7b47784fbb7b8269ee6bcc24e1571f249e63b10efd93bc01c621835328d10161ef87c0f5a03a0df9c9669932ea31ebbf8ed393

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
106f940dad34059b6f8d624eafd3ae1b

SHA1
099f2873ef55baffadd8050c221f732c246c371e

SHA256
899c51965402b478ff715fdee681f338bbcb6c837d8350c076868da2ecd53286

SHA512
fa2885788a36d79f490add880f163595d41ddcc7fac481c39ecdb9f19046641123d3ce4356dd54e3b0e6d218f3910ef06c928ea91c7c4239eb8579e2a69f644a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
20a88e23a7a383736d27d1191c7832dc

SHA1
ce2459ef07ce9fbb778b2a30309608b7095f6a9d

SHA256
915821fc873ba260d36caff174e41517baa40b4fc154d8c8df7e9c82d07a72fe

SHA512
e60ee294d9940749ce94771a97076bad59788ea4d2d1fb4e4760087b3742b8933bbe9df7c0453e0dc01f502062111166a27918f68b96c111ce183baec20aa355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
9KB

MD5
4177304602bc10f574e38d4c929cf757

SHA1
3301a30e39e15aca44c48eacc7436f18f9b64e80

SHA256
d8fb4f6c0a316ea697d32b0637ea0684686c64ff608a6311b6d270daa8fa03dc

SHA512
25584e589a48f44c8947dc73a9d70ed61cca211876deea0c6ab5a03fa9f331e5a28681337805e0094570650d6f95e1aacadea233715ae69dacf44a38c4e25464

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
9KB

MD5
a1efdec099ff8f4f1ab699127e307120

SHA1
8a77ac8685a180dbd6b2e021c49402d0531e6187

SHA256
d6bcc36ae19f5e7a4f76da98bff9f09f58bc7d8513ded3cb57cecf8110985886

SHA512
105ba28dbc13b8d2ec2967fcd51d9560cb768d09a4603a041fb070807cd933ae1b251b8d09b164a77231d9eb0d10141acbb2a3182afa48f3ac269acb9081506f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
9KB

MD5
afa26172653cb8f2a81c50db6cb5bbf4

SHA1
712410abcef0267bb5aeaaddac80626df79600c0

SHA256
5ae96c5d7f7783104a607b6ae28df03a982cb55a93486cade825ebe48babb06f

SHA512
8213499b5475c0635db6d53d80d73a88f61bfee5454e7b24f3086278d8e90333d739e00f58b70d32d809ba93507eeac8bc6199b3ce1c3253c4f9cf9d92a2b3c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
04b52ee04fb54c03e6d7dc906a832a5e

SHA1
4cc1edbb230aacfe8c9936ec40f78c3f07e3a774

SHA256
77dd1e51eb5f56992870baae5f285f5df66d411329e1ca53bc8b72653baab140

SHA512
900914571bcc328e1e1e89da7e954434d96091576aa3f9b2c27dbad46ab81e4feab7137df06c056964d36a734fd4b427109ea7c1916b8f068ffcc9d64a964ff2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
9KB

MD5
86c563b4d209541a132c6efe22e1b8e3

SHA1
432a99c5e36a6f9ffa6bc54dbd5ccdc0d7ab43e9

SHA256
9cc7a02056764d637478ae5d6e38fe3a13e23f9cafbf2543d466e83fbee94113

SHA512
5b6f4865dad8fccb7ba4bec4e44dfe220ffbffdf173ec104ceabd7386f7465fb8b11cfa9ace26e0e16644ea5236347572844097c23d323b7203e7b7bc18b00d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5801a1.TMP

Filesize
1KB

MD5
0dc8b124e3f21b436151b617e1cb5d08

SHA1
3233f7fcb4bf38540ac231db56b7823c13640033

SHA256
51a0e74150ad92f530908301e8cbf85a0506344417e01ad85cdfa5a45e2665a4

SHA512
6f25c5e472e44342712f797bb8d573ad20b8b9d235016042a693d8faad499dbe1e056ae59b66eab1080ee081757324ada0bdf7b3e67bcfe7438e45188932f8ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c4fdf098f2a27c1472970b04dfcc95e7

SHA1
03732ef14d13ab0003420e2b0bd8335c6c5417be

SHA256
464d0a13bb691d574dcfefcf1c5b703eadd2fb95a2b080130af249498b4675d0

SHA512
f0a4caa86cb99afb1b1937b3cfc20b83fd783cbde6950d6bcd9a3c12a95d8d747bbc79f5b4b67cc8a369ca6ccaa5e34e817e591fa0108ac3359956b260c4902f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
af2c786c4dcca1a24754ccc28fc51431

SHA1
042a810d21de216dd916e68e584948c6e4dcda05

SHA256
f63bb7a257e38ee7d4f0a7f1d6e7b33487ea55d34802f3995a39aa7f6c1bcfff

SHA512
1503e45fb57ba45edf9b8dc06ef6811b8c2b723502240c589def209cb153d0ee5ef62cdf84b9466a06e5d818e71527266021dc4caf609c541a806df2ff7a227b

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

Filesize
21KB

MD5
fec89e9d2784b4c015fed6f5ae558e08

SHA1
581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

SHA256
489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

SHA512
e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
247B

MD5
d2d393b7b5d35d025ed98a03fa939638

SHA1
483c2ebfdd96bc4d86c49f9b0c1c08b7416a056e

SHA256
8df4ef0fae9e88abf12ba2689a6d053fa685073c0233412cc9c6061700922f6e

SHA512
f85e0759accc31ac0a004ff42f97ce44992f59d608eedb618d052bdab1d4d4200de2948d483324a8150d70b8acb5eb73830027ef23541a82461b48949ed850ac

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
708b20cae1332d7de9cf95ed0c796bcf

SHA1
35c79d450aa44b9be9d9f0e37c88bb04b311577a

SHA256
92fff88eb5281d32d0d1504759b4b66cd271bebad499a4202613d8b68e8c7408

SHA512
720a5d30ea0d6e8c4c0802f7c80c4946f3d427355b29658a8aa25fdbeff9b7409e6213d5a105a392c9fa3364308ef37629054888c42c641c5cf6372d00d7ad0c

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\EVER\SearchHost.exe

Filesize
1.6MB

MD5
8add121fa398ebf83e8b5db8f17b45e0

SHA1
c8107e5c5e20349a39d32f424668139a36e6cfd0

SHA256
35c4a6c1474eb870eec901cef823cc4931919a4e963c432ce9efbb30c2d8a413

SHA512
8f81c4552ff561eea9802e5319adcd6c7e5bdd1dc4c91e56fda6bdc9b7e8167b222500a0aee5cf27b0345d1c19ac9fa95ae4fd58d4c359a5232bcf86f03d2273

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\dukpxepvuewvheztj.sys

Filesize
674KB

MD5
b2233d1efb0b7a897ea477a66cd08227

SHA1
835a198a11c9d106fc6aabe26b9b3e59f6ec68fd

SHA256
5fd17e3b8827b5bb515343bc4066be0814f6466fb4294501becac284a378c0da

SHA512
6ca61854db877d767ce587ac3d7526cda8254d937a159fd985e0475d062d07ae83e7ff4f9f42c7e1e1cad5e1f408f6849866aa4e9e48b29d80510e5c695cee37

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\mssql.exe

Filesize
10.2MB

MD5
f6a3d38aa0ae08c3294d6ed26266693f

SHA1
9ced15d08ffddb01db3912d8af14fb6cc91773f2

SHA256
c522e0b5332cac67cde8fc84080db3b8f2e0fe85f178d788e38b35bbe4d464ad

SHA512
814b1130a078dcb6ec59dbfe657724e36aa3db64ed9b2f93d8559b6a50e512365c8596240174141d6977b5ddcf7f281add7886c456dc7463c97f432507e73515

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\mssql2.exe

Filesize
6.7MB

MD5
f7d94750703f0c1ddd1edd36f6d0371d

SHA1
cc9b95e5952e1c870f7be55d3c77020e56c34b57

SHA256
659e441cadd42399fc286b92bbc456ff2e9ecb24984c0586acf83d73c772b45d

SHA512
af0ced00dc6eeaf6fb3336d9b3abcc199fb42561b8ce24ff2e6199966ad539bc2387ba83a4838301594e50e36844796e96c30a9aa9ad5f03cf06860f3f44e0fa

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\nc123.exe

Filesize
125KB

MD5
597de376b1f80c06d501415dd973dcec

SHA1
629c9649ced38fd815124221b80c9d9c59a85e74

SHA256
f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446

SHA512
072565912208e97cc691e1a102e32fd6c243b5a3f8047a159e97aabbe302bddc36f3c52cecde3b506151bc89e0f3b5acf6552a82d83dac6e0180c873d36d3f6b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 72748.crdownload

Filesize
1.2MB

MD5
71106352a8c047dd5023a70dc1269dee

SHA1
e2dde685252ccf1dddc75df6223097ac7662dd49

SHA256
efb76874512398e831955e8ac0a3330d76a3b0ffdcf76b2892eb17831891d48f

SHA512
710b9533887406a3edad0badc0cd632901deb856e5482c1e28eebb7e18549b6f998754d46049e1d1c487e578ba27308f00fb6ae89011d8a6f3a3f993b0f68110

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-609813121-2907144057-1731107329-1000\IHBKJFD-MANUAL.txt

Filesize
8KB

MD5
21ea8ccd967a79accde233bc3886c51d

SHA1
81a6872c3c6a7432efa4c3e3a5ea1dab5742e8e6

SHA256
c167b2fa585675a3f9aeb764ca50283c34aeedb6a1bd36e4e3d4c8a5ad2c209c

SHA512
8ea87b1b27348d957be13fb68882bbaad67440648513d1cea04b53336380ad473a7a23fb67724ece05f106898d934011a932badbc6c17265a3f89bd424140b5a

Download Submit
memory/1512-1544-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1634-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/1512-1526-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1528-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1530-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1532-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1534-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1536-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1538-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1540-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1542-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1522-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1546-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1548-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1550-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1552-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1554-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1556-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1633-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/1512-1524-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1635-0x0000000004B90000-0x0000000005134000-memory.dmp

Filesize
5.6MB

Download
memory/1512-1636-0x0000000005140000-0x00000000051D2000-memory.dmp

Filesize
584KB

Download
memory/1512-1637-0x0000000005270000-0x000000000527A000-memory.dmp

Filesize
40KB

Download
memory/1512-1639-0x0000000073300000-0x0000000073AB0000-memory.dmp

Filesize
7.7MB

Download
memory/1512-1520-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1642-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/1512-1518-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1746-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/1512-1765-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/1512-1516-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1514-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1512-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1509-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1510-0x0000000004AC0000-0x0000000004AEB000-memory.dmp

Filesize
172KB

Download
memory/1512-1508-0x0000000004AC0000-0x0000000004AF2000-memory.dmp

Filesize
200KB

Download
memory/1512-1506-0x0000000073300000-0x0000000073AB0000-memory.dmp

Filesize
7.7MB

Download
memory/1512-1507-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/1512-2709-0x0000000005460000-0x000000000546E000-memory.dmp

Filesize
56KB

Download
memory/1512-1505-0x0000000004A50000-0x0000000004A82000-memory.dmp

Filesize
200KB

Download
memory/2012-1423-0x00007FFAE5B70000-0x00007FFAE5D65000-memory.dmp

Filesize
2.0MB

Download
memory/2012-1429-0x00007FFAE5B70000-0x00007FFAE5D65000-memory.dmp

Filesize
2.0MB

Download
memory/2012-1477-0x00000170975C0000-0x0000017098590000-memory.dmp

Filesize
15.8MB

Download
memory/2012-1476-0x00000170975C0000-0x0000017098590000-memory.dmp

Filesize
15.8MB

Download
memory/2012-1415-0x00007FFAE5B70000-0x00007FFAE5D65000-memory.dmp

Filesize
2.0MB

Download
memory/2012-1414-0x00007FFAA5BF0000-0x00007FFAA5C00000-memory.dmp

Filesize
64KB

Download
memory/2012-1416-0x00007FFAE5B70000-0x00007FFAE5D65000-memory.dmp

Filesize
2.0MB

Download
memory/2012-1456-0x00000170975C0000-0x0000017098590000-memory.dmp

Filesize
15.8MB

Download
memory/2012-1417-0x00007FFAA5BF0000-0x00007FFAA5C00000-memory.dmp

Filesize
64KB

Download
memory/2012-1419-0x00007FFAE5B70000-0x00007FFAE5D65000-memory.dmp

Filesize
2.0MB

Download
memory/2012-1418-0x00007FFAA5BF0000-0x00007FFAA5C00000-memory.dmp

Filesize
64KB

Download
memory/2012-1420-0x00007FFAA5BF0000-0x00007FFAA5C00000-memory.dmp

Filesize
64KB

Download
memory/2012-1421-0x00007FFAE5B70000-0x00007FFAE5D65000-memory.dmp

Filesize
2.0MB

Download
memory/2012-1422-0x00007FFAA5BF0000-0x00007FFAA5C00000-memory.dmp

Filesize
64KB

Download
memory/2012-1424-0x00007FFAE5B70000-0x00007FFAE5D65000-memory.dmp

Filesize
2.0MB

Download
memory/2012-1425-0x00007FFAE5B70000-0x00007FFAE5D65000-memory.dmp

Filesize
2.0MB

Download
memory/2012-1426-0x00007FFAE5B70000-0x00007FFAE5D65000-memory.dmp

Filesize
2.0MB

Download
memory/2012-1427-0x00007FFAE5B70000-0x00007FFAE5D65000-memory.dmp

Filesize
2.0MB

Download
memory/2012-1428-0x00007FFAE5B70000-0x00007FFAE5D65000-memory.dmp

Filesize
2.0MB

Download
memory/2012-1481-0x00007FFAE5B70000-0x00007FFAE5D65000-memory.dmp

Filesize
2.0MB

Download
memory/2012-1430-0x00007FFAE5B70000-0x00007FFAE5D65000-memory.dmp

Filesize
2.0MB

Download
memory/2012-1431-0x00007FFAA3AE0000-0x00007FFAA3AF0000-memory.dmp

Filesize
64KB

Download
memory/2012-1432-0x00007FFAA3AE0000-0x00007FFAA3AF0000-memory.dmp

Filesize
64KB

Download
memory/4360-3156-0x00007FFAC3820000-0x00007FFAC42E1000-memory.dmp

Filesize
10.8MB

Download
memory/4360-2727-0x000000001AF30000-0x000000001AF40000-memory.dmp

Filesize
64KB

Download
memory/4360-2719-0x0000000000160000-0x000000000016C000-memory.dmp

Filesize
48KB

Download
memory/4360-2720-0x00007FFAC3820000-0x00007FFAC42E1000-memory.dmp

Filesize
10.8MB

Download
memory/4496-1483-0x00000000005E0000-0x0000000000604000-memory.dmp

Filesize
144KB

Download
memory/4496-1492-0x00000000005E0000-0x0000000000604000-memory.dmp

Filesize
144KB

Download
memory/4496-1479-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4496-1480-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4496-1478-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4496-1484-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4496-1485-0x00000000005E0000-0x0000000000604000-memory.dmp

Filesize
144KB

Download
memory/4496-1486-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/4496-1487-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4496-1493-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4496-1489-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4496-1482-0x00000000005C0000-0x00000000005C5000-memory.dmp

Filesize
20KB

Download
memory/5140-1491-0x00000000005C0000-0x00000000005F6000-memory.dmp

Filesize
216KB

Download
memory/5140-1490-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/5140-1488-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/5140-1494-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/5140-1501-0x00000000005C0000-0x00000000005F6000-memory.dmp

Filesize
216KB

Download
memory/5140-1499-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/5588-1498-0x00000000021A0000-0x00000000021D6000-memory.dmp

Filesize
216KB

Download
memory/5588-1496-0x00000000021A0000-0x00000000021D6000-memory.dmp

Filesize
216KB

Download
memory/5588-1495-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/7032-2330-0x0000000000400000-0x0000000000B02000-memory.dmp

Filesize
7.0MB

Download
memory/7032-2337-0x0000000075E30000-0x0000000075F20000-memory.dmp

Filesize
960KB

Download
memory/7032-3128-0x0000000075E30000-0x0000000075F20000-memory.dmp

Filesize
960KB

Download
memory/7256-1643-0x0000000005340000-0x0000000005440000-memory.dmp

Filesize
1024KB

Download
memory/7256-2707-0x0000000005340000-0x0000000005440000-memory.dmp

Filesize
1024KB

Download