chaos | a78d6caa0a4b98ca054410bc97416093e9ed3746215f621d67c1b6da93c58427

Analysis

max time kernel
1053s
max time network
1063s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
10-04-2024 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

freddo.exe
Size

14.3MB
MD5

54624a787c53efc6b2b2f0adb02303c3
SHA1

f9ac2cb0fab7d6024a5e9e078edede8e1bb8848c
SHA256

a78d6caa0a4b98ca054410bc97416093e9ed3746215f621d67c1b6da93c58427
SHA512

987e73b269889c2668bb626edbef4dfeb589b36361b58f8f983a08bcd2120656fd1b85b33f92fb6ae86878b2c7d60eef945d1c0ca274f7740ce56f5e77882ed6
SSDEEP

393216:YHFuDKw9va/tx9L+zn7DJTa1TsUS4uPVJGbahsWPJ2i:YHFuDKw9vUtvQn7DJT0sU7u9c5EJ2i

Score

10^/10

chaos evasion ransomware spyware stealer

Malware Config

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 4 IoCs

resource	yara_rule
behavioral1/files/0x000300000000069d-492.dat	family_chaos
behavioral1/memory/2668-503-0x00000000009C0000-0x0000000000A4E000-memory.dmp	family_chaos
behavioral1/memory/1952-3202-0x0000000000B90000-0x0000000000BA4000-memory.dmp	family_chaos
behavioral1/files/0x000700000002aace-3218.dat	family_chaos

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2340	bcdedit.exe
640	bcdedit.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1444	wbadmin.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\darkestpedo.txt	freddo.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\freddo.url	freddo.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	freddo.exe

Executes dropped EXE 6 IoCs

pid	Process
2668	Chaos Ransomware Builderv4.exe
3532	decrypter.exe
2684	Chaos Ransomware Builderv4.exe
3532	Decrypter.exe
1952	freddo.exe
6860	freddo.exe

Loads dropped DLL 6 IoCs

pid	Process
2740	freddo.exe
2740	freddo.exe
2740	freddo.exe
2740	freddo.exe
2740	freddo.exe
2740	freddo.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 39 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Videos\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	freddo.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-627134735-902745853-4257352768-1000\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	freddo.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	freddo.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	freddo.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-627134735-902745853-4257352768-1000\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	freddo.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	freddo.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	freddo.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	freddo.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
4	raw.githubusercontent.com
45	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\89brxmyzo.jpg"	freddo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3188	vssadmin.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Pictures"	Chaos Ransomware Builderv4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Chaos Ransomware Builderv4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 040000000500000002000000000000000300000001000000ffffffff	Chaos Ransomware Builderv4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\FFlags = "1092616193"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	Chaos Ransomware Builderv4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	Chaos Ransomware Builderv4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Music"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Chaos Ransomware Builderv4.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	Chaos Ransomware Builderv4.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9	Chaos Ransomware Builderv4.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Chaos Ransomware Builderv4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	Chaos Ransomware Builderv4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Music"	Chaos Ransomware Builderv4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000004000000030000000200000001000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Chaos Ransomware Builderv4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Chaos Ransomware Builderv4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	Chaos Ransomware Builderv4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Chaos Ransomware Builderv4.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "7"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Documents"	Chaos Ransomware Builderv4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\SniffedFolderType = "Pictures"	Chaos Ransomware Builderv4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Chaos Ransomware Builderv4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\LogicalViewMode = "1"	Chaos Ransomware Builderv4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\GroupView = "0"	Chaos Ransomware Builderv4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Chaos Ransomware Builderv4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Chaos Ransomware Builderv4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Chaos Ransomware Builderv4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Chaos Ransomware Builderv4.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\5 = 14002e80922b16d365937a46956b92703aca08af0000	Chaos Ransomware Builderv4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\5\NodeSlot = "8"	Chaos Ransomware Builderv4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Chaos Ransomware Builderv4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\NodeSlot = "9"	Chaos Ransomware Builderv4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	Chaos Ransomware Builderv4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Chaos Ransomware Builderv4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\IconSize = "16"	Chaos Ransomware Builderv4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Chaos Ransomware Builderv4.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	Chaos Ransomware Builderv4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\LogicalViewMode = "1"	Chaos Ransomware Builderv4.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\frdre.jpg:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\favicon.ico:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Chaos_Ransomware_Builder_v4_Cleaned.rar:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2864	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6860	freddo.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
1400	msedge.exe
1400	msedge.exe
3564	msedge.exe
3564	msedge.exe
4876	identity_helper.exe
4876	identity_helper.exe
4240	msedge.exe
4240	msedge.exe
2068	msedge.exe
2068	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
2876	msedge.exe
2876	msedge.exe
2768	msedge.exe
2768	msedge.exe
200	msedge.exe
200	msedge.exe
3724	msedge.exe
3724	msedge.exe
3992	7zFM.exe
3992	7zFM.exe
3992	7zFM.exe
3992	7zFM.exe
5464	msedge.exe
5464	msedge.exe
1856	msedge.exe
1856	msedge.exe
2020	msedge.exe
2020	msedge.exe
1952	freddo.exe
1952	freddo.exe
1952	freddo.exe
1952	freddo.exe
1952	freddo.exe
1952	freddo.exe
1952	freddo.exe
1952	freddo.exe
1952	freddo.exe
1952	freddo.exe
1952	freddo.exe
1952	freddo.exe
1952	freddo.exe
1952	freddo.exe
1952	freddo.exe
1952	freddo.exe
1952	freddo.exe
1952	freddo.exe
6860	freddo.exe
6860	freddo.exe
6860	freddo.exe
6860	freddo.exe
6860	freddo.exe
6860	freddo.exe
6860	freddo.exe
6860	freddo.exe
6860	freddo.exe
6860	freddo.exe
6860	freddo.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
2740	freddo.exe
3992	7zFM.exe
2668	Chaos Ransomware Builderv4.exe
2684	Chaos Ransomware Builderv4.exe
1856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeRestorePrivilege	3992	7zFM.exe
Token: 35	3992	7zFM.exe
Token: SeSecurityPrivilege	3992	7zFM.exe
Token: SeSecurityPrivilege	3992	7zFM.exe
Token: SeSecurityPrivilege	3992	7zFM.exe
Token: SeSecurityPrivilege	3992	7zFM.exe
Token: SeSecurityPrivilege	3992	7zFM.exe
Token: SeDebugPrivilege	1952	freddo.exe
Token: SeDebugPrivilege	6860	freddo.exe
Token: SeBackupPrivilege	7000	vssvc.exe
Token: SeRestorePrivilege	7000	vssvc.exe
Token: SeAuditPrivilege	7000	vssvc.exe
Token: SeIncreaseQuotaPrivilege	336	WMIC.exe
Token: SeSecurityPrivilege	336	WMIC.exe
Token: SeTakeOwnershipPrivilege	336	WMIC.exe
Token: SeLoadDriverPrivilege	336	WMIC.exe
Token: SeSystemProfilePrivilege	336	WMIC.exe
Token: SeSystemtimePrivilege	336	WMIC.exe
Token: SeProfSingleProcessPrivilege	336	WMIC.exe
Token: SeIncBasePriorityPrivilege	336	WMIC.exe
Token: SeCreatePagefilePrivilege	336	WMIC.exe
Token: SeBackupPrivilege	336	WMIC.exe
Token: SeRestorePrivilege	336	WMIC.exe
Token: SeShutdownPrivilege	336	WMIC.exe
Token: SeDebugPrivilege	336	WMIC.exe
Token: SeSystemEnvironmentPrivilege	336	WMIC.exe
Token: SeRemoteShutdownPrivilege	336	WMIC.exe
Token: SeUndockPrivilege	336	WMIC.exe
Token: SeManageVolumePrivilege	336	WMIC.exe
Token: 33	336	WMIC.exe
Token: 34	336	WMIC.exe
Token: 35	336	WMIC.exe
Token: 36	336	WMIC.exe
Token: SeIncreaseQuotaPrivilege	336	WMIC.exe
Token: SeSecurityPrivilege	336	WMIC.exe
Token: SeTakeOwnershipPrivilege	336	WMIC.exe
Token: SeLoadDriverPrivilege	336	WMIC.exe
Token: SeSystemProfilePrivilege	336	WMIC.exe
Token: SeSystemtimePrivilege	336	WMIC.exe
Token: SeProfSingleProcessPrivilege	336	WMIC.exe
Token: SeIncBasePriorityPrivilege	336	WMIC.exe
Token: SeCreatePagefilePrivilege	336	WMIC.exe
Token: SeBackupPrivilege	336	WMIC.exe
Token: SeRestorePrivilege	336	WMIC.exe
Token: SeShutdownPrivilege	336	WMIC.exe
Token: SeDebugPrivilege	336	WMIC.exe
Token: SeSystemEnvironmentPrivilege	336	WMIC.exe
Token: SeRemoteShutdownPrivilege	336	WMIC.exe
Token: SeUndockPrivilege	336	WMIC.exe
Token: SeManageVolumePrivilege	336	WMIC.exe
Token: 33	336	WMIC.exe
Token: 34	336	WMIC.exe
Token: 35	336	WMIC.exe
Token: 36	336	WMIC.exe
Token: SeBackupPrivilege	6628	wbengine.exe
Token: SeRestorePrivilege	6628	wbengine.exe
Token: SeSecurityPrivilege	6628	wbengine.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
3992	7zFM.exe
3992	7zFM.exe
3992	7zFM.exe
3992	7zFM.exe
3992	7zFM.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
3992	7zFM.exe
3992	7zFM.exe
3992	7zFM.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
2740	freddo.exe
2876	msedge.exe
200	msedge.exe
2668	Chaos Ransomware Builderv4.exe
2668	Chaos Ransomware Builderv4.exe
2668	Chaos Ransomware Builderv4.exe
2668	Chaos Ransomware Builderv4.exe
2668	Chaos Ransomware Builderv4.exe
2684	Chaos Ransomware Builderv4.exe
2684	Chaos Ransomware Builderv4.exe
5464	msedge.exe
2684	Chaos Ransomware Builderv4.exe
1856	msedge.exe
2020	msedge.exe
6812	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 4500	2620	msedge.exe	83
PID 2620 wrote to memory of 4500	2620	msedge.exe	83
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 3140	2620	msedge.exe	84
PID 2620 wrote to memory of 1400	2620	msedge.exe	85
PID 2620 wrote to memory of 1400	2620	msedge.exe	85
PID 2620 wrote to memory of 2988	2620	msedge.exe	86
PID 2620 wrote to memory of 2988	2620	msedge.exe	86
PID 2620 wrote to memory of 2988	2620	msedge.exe	86
PID 2620 wrote to memory of 2988	2620	msedge.exe	86
PID 2620 wrote to memory of 2988	2620	msedge.exe	86
PID 2620 wrote to memory of 2988	2620	msedge.exe	86
PID 2620 wrote to memory of 2988	2620	msedge.exe	86
PID 2620 wrote to memory of 2988	2620	msedge.exe	86
PID 2620 wrote to memory of 2988	2620	msedge.exe	86
PID 2620 wrote to memory of 2988	2620	msedge.exe	86
PID 2620 wrote to memory of 2988	2620	msedge.exe	86
PID 2620 wrote to memory of 2988	2620	msedge.exe	86
PID 2620 wrote to memory of 2988	2620	msedge.exe	86
PID 2620 wrote to memory of 2988	2620	msedge.exe	86
PID 2620 wrote to memory of 2988	2620	msedge.exe	86
PID 2620 wrote to memory of 2988	2620	msedge.exe	86
PID 2620 wrote to memory of 2988	2620	msedge.exe	86
PID 2620 wrote to memory of 2988	2620	msedge.exe	86
PID 2620 wrote to memory of 2988	2620	msedge.exe	86
PID 2620 wrote to memory of 2988	2620	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\freddo.exe
"C:\Users\Admin\AppData\Local\Temp\freddo.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb5e633cb8,0x7ffb5e633cc8,0x7ffb5e633cd8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2068
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Chaos_Ransomware_Builder_v4_Cleaned.rar"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3992
- - C:\Users\Admin\AppData\Local\Temp\7zO89F99509\Chaos Ransomware Builderv4.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO89F99509\Chaos Ransomware Builderv4.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2668
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\a3dfq0ff\a3dfq0ff.cmdline"
      4⤵
      PID:6044
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mzzqh0xu\mzzqh0xu.cmdline"
      4⤵
      PID:5252
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\elatpmsi\elatpmsi.cmdline"
      4⤵
      PID:2428
- - C:\Users\Admin\AppData\Local\Temp\7zO89FFAF8F\decrypter.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO89FFAF8F\decrypter.exe"
    3⤵
    - Executes dropped EXE
    PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1752 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2128 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4428 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7432 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1048 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7828 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7196 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7360 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1244 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7152 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7400 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7476 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7412 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7848 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1956 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7836 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8008 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8096 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8044 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8020 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7576 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7312 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8504 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8696 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8856 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9080 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9284 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9280 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9000 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9528 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9540 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9100 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10176 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9584 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9696 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10760 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10824 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9916 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11248 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9844 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9840 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10124 /prefetch:1
  2⤵
  PID:128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9532 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10116 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10088 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8420 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10112 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10100 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8100 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10128 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10144 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9828 /prefetch:1
  2⤵
  PID:6664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12076 /prefetch:1
  2⤵
  PID:6784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10764 /prefetch:1
  2⤵
  PID:6980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12560 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8008 /prefetch:1
  2⤵
  PID:6256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12352 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=12892 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12372 /prefetch:1
  2⤵
  PID:6940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:7156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13188 /prefetch:1
  2⤵
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7164 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12216 /prefetch:1
  2⤵
  PID:6328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13180 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13260 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,14713097115789577724,17071586913634812704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3888

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4596

C:\Users\Admin\Music\Chaos Ransomware Builderv4.exe
"C:\Users\Admin\Music\Chaos Ransomware Builderv4.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2684
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\znfsce3n\znfsce3n.cmdline"
  2⤵
  PID:7152
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCDF4.tmp" "c:\Users\Admin\Music\CSC6EA9056C83E74E45A6E69ADA8AF15F6A.TMP"
    3⤵
    PID:5824

C:\Users\Admin\Music\unfreddo.exe-decrypter\Decrypter.exe
"C:\Users\Admin\Music\unfreddo.exe-decrypter\Decrypter.exe"
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
PID:3532

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004E4
1⤵
PID:6436

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:6812

C:\Users\Admin\Music\freddo.exe
"C:\Users\Admin\Music\freddo.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1952
- C:\Users\Admin\AppData\Roaming\freddo.exe
  "C:\Users\Admin\AppData\Roaming\freddo.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Sets desktop wallpaper using registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6860
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
    3⤵
    PID:5604
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:3188
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:336
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
    3⤵
    PID:6304
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2340
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:640
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    PID:6324
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:1444
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\darkestpedo.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2864

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7000

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6628

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:5980

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:4776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
577e1c0c1d7ab0053d280fcc67377478

SHA1
60032085bb950466bba9185ba965e228ec8915e5

SHA256
1d2022a0870c1a97ae10e8df444b8ba182536ed838a749ad1e972c0ded85e158

SHA512
39d3fd2d96aee014068f3fda389a40e3173c6ce5b200724c433c48ddffe864edfc6207bb0612b8a811ce41746b7771b81bce1b9cb71a28f07a251a607ce51ef5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d4604cbec2768d84c36d8ab35dfed413

SHA1
a5b3db6d2a1fa5a8de9999966172239a9b1340c2

SHA256
4ea5e5f1ba02111bc2bc9320ae9a1ca7294d6b3afedc128717b4c6c9df70bde2

SHA512
c8004e23dc8a51948a2a582a8ce6ebe1d2546e4c1c60e40c6583f5de1e29c0df20650d5cb36e5d2db3fa6b29b958acc3afd307c66f48c168e68cbb6bcfc52855

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
67KB

MD5
d2d55f8057f8b03c94a81f3839b348b9

SHA1
37c399584539734ff679e3c66309498c8b2dd4d9

SHA256
6e273f3491917d37f4dbb6c3f4d3f862cada25c20a36b245ea7c6bd860fb400c

SHA512
7bcdbb9e8d005a532ec12485a9c4b777ddec4aee66333757cdae3f84811099a574e719d45eb4487072d0162fa4654349dd73705a8d1913834535b1a3e2247dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
35KB

MD5
a053b626552864ee4e93f684617be84c

SHA1
977f090d070e793072bfb7dce69812dc41883d4e

SHA256
25b3ad881a0a88c6228e12688078638fe0b96210d0f0e20721e3c911a5b37dd4

SHA512
f7b444b1a1c465a4614cd1b9bd678875251f44e227abaaaf1fa6b35bb67bb25932b9b11cc8fabd19d2d5d6e80c6ad0b15149869e6e41f6345db3d49f08683e36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1.1MB

MD5
d404b61450122b2ad393c3ece0597317

SHA1
d18809185baef8ec6bbbaca300a2fdb4b76a1f56

SHA256
03551254e2231ecd9c7ee816b488ecbde5d899009cd9abbe44351d98fbf2f5fb

SHA512
cb1a2867cc53733dc72cd294d1b549fa571a041d72de0fa4d7d9195bcac9f8245c2095e6a6f1ece0e55279fa26337cdcc82d4c269e1dd186cbbd2b974e2d6a70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
32KB

MD5
bbc7e5859c0d0757b3b1b15e1b11929d

SHA1
59df2c56b3c79ac1de9b400ddf3c5a693fa76c2d

SHA256
851c67fbabfda5b3151a6f73f283f7f0634cd1163719135a8de25c0518234fc2

SHA512
f1fecb77f4cdfe7165cc1f2da042048fd94033ca4e648e50ebc4171c806c3c174666bb321c6dda53f2f175dc310ad2459e8f01778acaee6e7c7606497c0a1dea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
75KB

MD5
cf989be758e8dab43e0a5bc0798c71e0

SHA1
97537516ffd3621ffdd0219ede2a0771a9d1e01d

SHA256
beeca69af7bea038faf8f688bf2f10fda22dee6d9d9429306d379a7a4be0c615

SHA512
f8a88edb6bcd029ad02cba25cae57fdf9bbc7fa17c26e7d03f09040eb0559bc27bd4db11025706190ae548363a1d3b3f95519b9740e562bb9531c4d51e3ca2b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
24KB

MD5
2763764dfde10eb91482b385a0dd9867

SHA1
872cb4593ef3a13c45817added8dd7faf92fab65

SHA256
d3d35a89d9df3f3f0dc8f26196c5288761f11ba525c04c74a1e23739e0835099

SHA512
53aad46e8550c6482705c0df9d9d89421c2c2f6b846fc559bcb1ea7bcc566839275e6ae6364815fe7c8fe2d6aefca2572085199332a896a220890888f9cfedc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004d

Filesize
198KB

MD5
319e0c36436ee0bf24476acbcc83565c

SHA1
fb2658d5791fe5b37424119557ab8cee30acdc54

SHA256
f6562ea52e056b979d6f52932ae57b7afb04486b10b0ebde22c5b51f502c69d1

SHA512
ad902b9a010cf99bdedba405cad0387890a9ff90a9c91f6a3220cdceec1b08ecb97a326aef01b28d8d0aacb5f2a16f02f673e196bdb69fc68b3f636139059902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000a1

Filesize
1024KB

MD5
4322f0449af173fb3994d2bef7ecb2e4

SHA1
b6ee5c6f76b8eee448f6b4b2b56fa1ec39653934

SHA256
0502e6e2f3fc54a30dea0eb07eb19a395c7ea6fc273321a49a4cc977a59b7cc9

SHA512
d8bae6131a5a8a1fcabb2d7efebc6cdbba27955fb77484a5d87dbce7a237c0cd5e19b74b4dad28312929ad732d3b80cf3d7f15f059c88438d0bc6ff9535ceeef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000ac

Filesize
243KB

MD5
930b5b08297c63eaaf8e90c77ed8af3c

SHA1
58cf1869e79f3630701e6d844eb39a5f057bbe2d

SHA256
95c957668d3149a2e067d1a293f07c1dea10c7bc54ac86da7f2bddd53c211243

SHA512
77f1fab10725a809f4d00bc94d5178d7c2b1ee48edb252d4f88dc50d76285c1d1380010cae949b9b2ce42ab0dba26eee17e59d575190427bd368ab7635662206

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000b1

Filesize
65KB

MD5
68b24c33a1084c384158245ee07e703f

SHA1
1f40cdfc988534806606faf81344ba79a1528ed9

SHA256
f95947735f1ba1e43b46a1ddc7229b71d37aee7821495f87f1f2d25563d47fcc

SHA512
1af1c596736b46a538a06285196d05054c062f29335080d136d325dc305d2d65d266517386d8d54a37de94036c878d9ababa76d9a5f5e8d8d07236d5ac0bb9ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000c9

Filesize
19KB

MD5
9d43bb045f7444664c73333b4fc58220

SHA1
bdcf0fc36256f6893fc367dac9e4e439a78cd370

SHA256
f9034ce9158cc96e9733081513717b58b14f843d82bc6b06e89e8e421f68f7da

SHA512
fd886e47eb0ba8401db2f8a8fca40a3d046922e6825f200f6cbebed7f8a79d09f8f8f65cbb9a3e8d2eb7e36470bac0f8c185898084cecdde59b4997ac1ac41af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\01883903c07cc694_0

Filesize
291KB

MD5
3d9e32f761b0077c603e440ebd7f5ec2

SHA1
f265eb3aa5d0e2a42b28ab3a1b4619a0090a60cb

SHA256
8aad34476821af112f6e848712d888c58db07528983e67d5c6e56ad50e236483

SHA512
aaed97467f79b2b088c071421867ca835f03eab8eee25aaf529dfb443d2c6525f9bc3f9886f2cdbcdfa1a7bf423db1e1a55780020ae24ed38eadca15147c81bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\02735674612cbc52_0

Filesize
1KB

MD5
00e374bcb01825557c984bc28e9b06fc

SHA1
8732eaf2ff748555bf18d11c495b6006202b4fa5

SHA256
ee2c03ffff86b154c829c949eb6c85e40f091c889d2ea0edff0aab1b17ef645f

SHA512
a46e8635298b7b20e96ca6dd42ce9eedd5e2d54d2397f7e0f595a26f0404952ff9cc3d3a5d91377407ee4c32925a1f7ba5430b4e8f0bd4bb66e10e2d2cad7e87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0580a8e1646d7bcd_0

Filesize
14KB

MD5
d6da0286f08f2bb48987e573d7c01d57

SHA1
822f64655d77c5a57fbca14ddd64f0f07b5ad8c3

SHA256
547e1dc01241e48bc4fb00f2457ec95175f8348c6c47e2f5e6a42c36b8271d54

SHA512
2ff1f367fa85514393cb5dcfdc9021b44b754e9e81acbfdfb7b74bb62cbf88aac1e24d67d24933d92b174035c590ea86799b8af9e402ea14231c3e0d90637b20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\06450eb6a7b09545_0

Filesize
2KB

MD5
4a52c278befa4ee9941058c11892d12d

SHA1
841138d1721ea0eacb0ffe6d6d4afa8db8c68af6

SHA256
a27609ef4134df0bd6ef8259614c8de3a7807510483aa27845f9d0651ea549ed

SHA512
93aea2f49fa24054e391cd10b555dfae60e01260a9d84065351153987592fd42a1811d4a8655835014feb4b34d740db6f8ccc20aa55a95a05236eed116f167f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0

Filesize
1KB

MD5
076634936e777bcba6cd2ee05153162c

SHA1
2e2ae57de0dfd94b5463ff84706df35b18b12cbf

SHA256
f74b6553daaeae864e7aaf214561b4f015b0099316c77e8d32fbe6eb0d3d0cd2

SHA512
a369709d77f98feeb6aa403f6440d930228ce635e61437161a11d4ad3cac029d1c1549c5bddaa4f885bcd97dfcae370f80df5c82ffc098cd547eb25cbdd510ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

Filesize
1KB

MD5
e1c95c7144c839e1730cea936fccc6de

SHA1
6bcb6e42216189cdebb88bba101f738b660652c9

SHA256
aa85750132a5b64ef63a16791b2a26db62cba3de40d6ced8ebef56c700282759

SHA512
03d2ecf34f4ed99d9ea3ebe5fc2130d885dde3bad52895f178290ac6ea9d3cb3f0803e5bda3ba30d96c07592e0505649d97ee8b48545a1e45a98a98f5baf90cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\48b1105b4c2874b5_0

Filesize
1KB

MD5
02e8b74c8d1bb12c82e7c274b200fe3a

SHA1
a441c5a67bae2d8e1c0231dcf1a5f8409ae1d6e5

SHA256
ab0ac8ae01c2e919b9d6d330c7724de8885f3653a6520f4c8ba6b59718e03f6c

SHA512
f31704365ad341351066a80392aa72ebcee2024f96992a1dc08596863d72a3e038f29bae3ae5eb10e5e27aad50acbf88ade66a6d7ec357e3cc77947349c8d1f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4c693273baa0190b_0

Filesize
5KB

MD5
46bc3cec81c54593a4c6d8431cd319ea

SHA1
46ab0db3a9772f19db591afc718be227afec0501

SHA256
1b876190179fded279add4cf26a24f1fbd53adab40b100047da7806710e3e9b5

SHA512
c6563ce304b3db9617dd4ea8efbcf565475940f8acddb85b14db9c3d0b183902c7432ce4492bba42986d6ccd06b5f1fcdab24236f7ab655091d9877873adf7f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ac5abc87e80789_0

Filesize
2KB

MD5
ee106501e9f245df4e0f340ba0952752

SHA1
7eaa99264f1668ab053a0a8aafe73faa01164cde

SHA256
57b6aa33b2c7ce6d7063a938397998354f695aa13f1f4d682d7282f27a98f263

SHA512
7f3e692cec14578992fa1190a258a5372e7dceb468d2b5c625bd3b7536c64c3d0550f5503a5ca9dbe4dcb367a3b827ee011ef22961845d5a1732fbaeb90b24ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\64fa70d4ab69732e_0

Filesize
6KB

MD5
1630b447ce4c6e4b98e6e04f7298dd1e

SHA1
6b15f8da8e49dbfad2e85ebc8392ecd7927d24fb

SHA256
d51d709b379e203ec73b4e5a25212e88ed9788ec2fe312ffc8be8ed169c462a2

SHA512
6f2dc9f896d7aeea446af2b32541b5cb2186cf75aa4733da98e8c60e54eac78b16a281005500924dfab456425fea4edee21ef2d1746eca9780f2a2fed3245560

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\695c42f61090a800_0

Filesize
6KB

MD5
ff09efe9a888b8d5da98a754faa0413f

SHA1
8afa53ad1ea5cab5c28007d0ccd386fa9afe4128

SHA256
2fa6664ef9b9ec808dc513bb044fac5ab19716e3f270fdca0b6780b861180840

SHA512
fcbcb82467647abc1210c22263a7a51791e7d3dd9fffa187abc5058fb0304e906820db99ccabef384eda77a66f6bb08e092e534a4fba9768f03f3b05d52f332f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\733a2ebc15407e86_0

Filesize
3KB

MD5
3f2b87505e1da03d2d37a9ca620a181c

SHA1
d00be30fa4abe539b487d52b7608b589cfb48529

SHA256
5e5707ad9751dc7f8d9d114201fd63d654f27f49e2db2a5b09f70fc17747b0ab

SHA512
47005198c8088d656fb891f03a9e4d50abc087c6f1f7695ebe0b16cb93d7ab012d83689cb8f4849455907eb3006aeeb1f32e076a5f30357d101dbc88ad996434

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74b88724f60b0383_0

Filesize
1KB

MD5
bb9eb74c02438c0f9740a36383f1285f

SHA1
29241f9fa4d74653b609e9b34ed4c3e1cd208009

SHA256
e6bc2ca361d1488295e9ae3e909e3113f546ecd42a8a2e99ce4cc30f2320c62d

SHA512
4acf7f2cef39b763771ef5ebbc20eb3b7d4663315abca378d871638b3bd7500374763e4ec5faecd854ed9f2a266d00a55b5e536fba70f1f3b7a8f6e820511f75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7f05d59e6df9a390_0

Filesize
26KB

MD5
4697c9257785d41bace2352a967aae3b

SHA1
9348c30ead6d7e4e259e3873a9bc4f20ed7d82c6

SHA256
1db9c103ecfdda1a538ba64ff2fffcb643a70ad85d22b72ca801e7cebd46ada5

SHA512
608a1966201ee56b96888acfb97020a3edb0920034d55909cc58d9ad0df0692dad7be71533e0f91198bb0841a5518910442f0c3a20ea076babc515d0ecc3a1bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8e5987d08f7b6e11_0

Filesize
1KB

MD5
951806c80126dec2c13c9f002dee95a2

SHA1
b5baab48d8ac9ad2b4875eb68838254d9390f1ce

SHA256
983c3cdba4e562cbe0e2bcd377e8adeabab80ce9d57d99df79d49902031a794b

SHA512
75883572686d98a53e9d6ec1c1e6a519312e83f0b78a829885bfb0da17418d27a851ae99c5949f92c356435cb324d525296f2eb2607d8f1bb77e8a1c313fbb9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9412c8b664751f90_0

Filesize
1KB

MD5
cff1e99a6d26a4bf2a0f9e335ab8f5ce

SHA1
b4900990db6086b68d4c763fc1f8812c7c6697fa

SHA256
e4cf959d883d7176262a37d75af7bba6f23da8ccaa2e926b035c4c1f34e341f2

SHA512
f58a30a108cba89bcb17923c2c6c06e21f3fe41bd354bb96acac890e3839f72824be995c3095a34e81850f992717621d839a7455cafcf39a3af4696e7c28d68f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\94ebe1630900d094_0

Filesize
7KB

MD5
eead8ba1a93a2ab31b6ff141d26fdf04

SHA1
ce1afae0686a26ab2fb3ba72bec086cf38507e25

SHA256
3715db8a7235d45d42357a3d40758ea48c5226b608fe7baa21efd6f0a4fd83f5

SHA512
2a31d2510995ca5035186fce321ab7f5960c5052a48066a7f31eec9b7518c63ea310f66b0175f7b23486e2e0c105d2279f60c4a3053f99187b3c2018facea12a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\af2cfcaf6d9b18bc_0

Filesize
2KB

MD5
6d13069c8460fc051d5ad2119d5e0db2

SHA1
da2d82f074fb476bfd53df3990eda076ff923fd6

SHA256
878460fbff45d184b720cb0729e296efebba8405f379ad431f173e590d473df3

SHA512
e8503b1ca6a79ae4b56d3e2633b496a948ff0f365420e9b4cb08c7a1936016c3972c111ff82f56211a4bf142076f99afaef2b80f7ebd3ab6fa6515ef2099e65f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c807b8e9088e4030_0

Filesize
26KB

MD5
7d14efa7bd52161aa4ac916a7fc4f1aa

SHA1
dfee404b595d5e680c6eda2213a185f960b6af7b

SHA256
d30c0773bbe2ba32e3dd17c9a77de5623245f4cb9a1418b988c56c483ba6c675

SHA512
438c3ba857093e68666e637d62fb91ee7f19b709379371d5b9da6cb76244ee94374bbdffe90581aae40fb5ca00ca84e658e9d2c9dc2a6a608019ac3c19a6707c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cb67f29248a9c898_0

Filesize
1KB

MD5
bc3961e716b8f71ee3ffe09da90b9e34

SHA1
88683de91157350667522afc09512456c5923bcf

SHA256
09102b972c2e283a733eca6ff8da4332e49d571ac423dfeaf7e708cc85584ab8

SHA512
57f537cb3adf2711a911c2274ef8042fefe08f3cd3e5bc0aa75cc99f5724109d73a3fb86c55228adc718103b0bc55dda0ccf1a3c701eb8a3401fdb5a0d266866

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d5e42077b85df235_0

Filesize
39KB

MD5
6a25ff62473b9e38754c265ed7f5579b

SHA1
e1a4fbb314cec05e41dc2dbc27fd5917364b3d20

SHA256
4b83eb573a9fb2c8249830583b33dbae90cd9e38b2e331b124f40abbd6875fff

SHA512
7d85d6f11b6596a7fe86e0e039f66302455ba1934ece56fb0f2f40a6806222d6a9c123a85f04556988163e34b0389327f7aec1b05cb5fe6a8f485f903971a7f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d7a29efad91a1117_0

Filesize
262B

MD5
5baacdcbecb963e2e3a06114a175e6a5

SHA1
53d1f4733f1a235e2b76edca8ae3e7e951dc100d

SHA256
a04189b72f8470d5a5a86c6726eaae816eff4d628a31a09d299da56bd331edba

SHA512
2d1544407bab146398024e1e6298f9dfbea15290dc8044546615dabd8e0b64bbb8528659e8d3122134dafc657a60ad24137060efbb4124bdb9313004d64a4da3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\db70d675c8a8462f_0

Filesize
6KB

MD5
b8a67e34352ac5d7eb94ffd2db1eade7

SHA1
cb35e3f66f26014bbdbc27bf89cf54e15bfcd9f0

SHA256
ec9eb6562a53058686a5e1aecdb3d12b8c1b2581cabb6f43d5b1807ccdd42166

SHA512
14a3949a3d6eb6ab4d09b7706f17397266006b9073420e44253367f7c9e9374dbbbd1aadaaf76401f3c52261aa73711979ab9d23775b3c734a63b0ac110e0c1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e55f0a6d1b533c66_0

Filesize
2KB

MD5
b57bca88473d49d5eafc93d1f0bf44d6

SHA1
f8d6c6874795ec89a92e109cf898b937e602f991

SHA256
6b52f2245779115a13cf43fdc32df34677d1305436494dcd57f0e66f2ceaa553

SHA512
2cf8da69f9e39a794f7dd8cd7f25eed7e5750a53866dd56054dcb015c24fbfdca1f96e3b40d743d92f2fe004bd1b4eb8fd33c804377a0e8406b449666a5dc1b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f078f5fb70fd150f_0

Filesize
2KB

MD5
08571cf44a364bcdf170b1af15bbe73e

SHA1
fa4e38304040584e55280ce92b5990088a8ded5d

SHA256
31d9a98d00ea6255657b8aee42fba10a9df454a6e033e38d7ebd6115a0bc6cda

SHA512
92113bcf522e05ef464d639f045c32b20456463ef44abc30e42d54f2c2ab62f7dabf9059ed5091e670a26eef026ad1d108884c12eab814c34f9e3fa3e923dda4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f6802c7ab43b35b3_0

Filesize
19KB

MD5
fac68d064923184b33bcca9a0278a4a1

SHA1
2662c0443223009c3b47d7b68eed6d1b7119e5a0

SHA256
ba3f11f82a36475b393dac2ddccbbe4b038051c9f28ae9665103af3043111b33

SHA512
5a5e6bb09441c5aa78978a3489a3fe7a03fbb0af7dd795ea1135cfa7e7064f667ef9ccb79c8fd2da02380af27e7a43a8c2cb9d3c56434f372202bd3442235cee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f89251fac2b69325_0

Filesize
3KB

MD5
85f9bb3fdf8c3a1dcc29eccd1277afb5

SHA1
6921b98a14ccd60bb10bc6fc80edfc1d4966d826

SHA256
e0b26086c1f4ee9b783b5a57ea532817d7fab6d6f9f5c84634f745af13ee4c9c

SHA512
99269d3b3c9319d179aaf8c5596d9aadcdace4c9ebaf8dca78fd755986f23e39b374c1771190b36fd5011a47b34a5a3622a88f3ffb79938efe00424633760622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
db67ce930ab8cba169ba31021d219783

SHA1
5780f5d16c3d9122e6784fc2c7ed9415be62cdb7

SHA256
8cc0a2e310b1e276b051fbae1a4567e2bad7772098de4046493b360c320662c7

SHA512
3d8433e65a6599b41fd9d3b9c904a43b587404a08774a6edce617f4b7778745258a38439dafa0f04ce1641669f2b6131a0a34e2c76ba5f9f1d014901a3261ca8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
9KB

MD5
2029196b20272fca202e3d270ab2cd41

SHA1
92ba01fde8041ae426ff5defa69e2ddfbf0aa87b

SHA256
7193d78e1a2a656b3a920e75bfae8be141da00aa8e445fb2c343745c59a8c1eb

SHA512
d924aa7917a6d70ab7b96cd46443690b15254adb6f158f37b548b7716067f98a95db2ba9fb535d8473f6372c6e1ca8d8b831e7df87793840e33e240db13bbba0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
9KB

MD5
85c40465ae23818487c1f9147c8fa22c

SHA1
d8e068b107792a2647f1d96c94a73f42589d27d1

SHA256
bd3e4b3a2494bc0be0e4615e92e2554ecceefb126ed7f53c2c5314c0dc7dd4ad

SHA512
931c32b96be688685459d71fb80904ba0473d21989230d6505185d41b9eb1da94f1cd6936ee4a0ccaba5d1b882b4dc7b4c82d4c236c889f3587959ab4d3384b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
3e370cf6ad7d0f3b6917808b390cd4a2

SHA1
7b956c2e9e7d67b1440285f25a592b3dd2f37610

SHA256
8e951ea3bf3f9a3a5603b78beea088908061d2763536a26579efef76d928833c

SHA512
fa8b3bb34f2b318824f2b2afcd590134b0641454abb673e165ee964acf1366cab439b40071c65248673d8c7ad6f3c5d6a9b64f1bd4589d39d5f4cc73b00220b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
acad79e1b072f1a3450c0c3ebe2b1728

SHA1
cbd5175ef32002e53f90e4b006533a4ef96bbfe3

SHA256
61ed16ce487aad51b445acbc44a3712594f871d2937f0a82163331be9d688558

SHA512
65e0262a8d1856650d4e745ded903938444331bc57e1be33f8f686fd0df3ac7ef064dce0ccbf0163be2acec53a6bd46a026d0c3b833b8d2fca67765fd8df9c68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
4b5e2555dd8dbef4b00f92271d8172cd

SHA1
fa919acefd7e5103877361e171d38645a7beaf9a

SHA256
8724b7a8535a83bd5f2451003b8e411dc1c7290ecaa1d6b90ff4424545cc588b

SHA512
11857e387ca5f7fdad4de93da6d0c5058d8703f9f91fba993d7121c3c920df0146be350e3eb1adf7222467d6ee6aa1d56c242f525e87476a4c21788cb5783ca8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
51593a210dd1155642f4602a1b46e021

SHA1
04a2a4f64f97fdeeedeab4c0d332477bb8a16522

SHA256
456cfa7c97353a9648d39ffd392cdb1a2caabce0155b72732b10363421ab270d

SHA512
7364fb10919c4f26b77ffe0ebe2e31cb66a03e35bb5bd1b08ee0c05c8a9d00c008413eb489034b053f863eb5bfae502343a198e379eb619c0bedfe7561664707

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
c477f243159feb2bf1b76d527b811c20

SHA1
ea9ff3878095f1c66f23d9e61f0b026dc9334edb

SHA256
465d18dd914c571e7098892b7499ce54c607168409ce8217e48b0d26a46786a4

SHA512
97b5a4b84bb99d8036133c49339665ce786ed59bf4da4353509ea90724c6e5e93e1df0cbd90aba9dcf770713fcace2704e341fd0da02c2169843b9e845438ed5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
7a37927d7145e9e980559d5dbdfff8c1

SHA1
ff64925b2292ab5e6214e32e56c16a6d9113f821

SHA256
00edc1d93762147b5af870660c4b657ca4417171ca1c21dcfd1390607ee2f8d9

SHA512
10e34de10300fa055fcbd67cfa3d926994b82747fd282365b880835136f343f988afa36817337b186edffe58ab22bc556a4073a1f66c9b33481f0b98dd06bcab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_prebid.a-mo.net_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
49e314d0518f7e8557d82e0d86485316

SHA1
eccd8d3574cf8e77a7b3052ec9ef8af109567f63

SHA256
f5e7e153f6b21f43410007596ca9e3fcf01e623a6d401ec4477ecb5c2e0827da

SHA512
92444d9bf021e430d9c12c670e3cf4789be8fff5cc9c9d7a55795ce59d98a77b98dd8c736892cbb058da61ba7f07b3f6d40bd013c32ccaf1f898dbf8e5f1b2fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
20KB

MD5
38e0abbb22085140a98c7dc720c1d44b

SHA1
0665d7a6291036bc3f84db477721a591f12d7f33

SHA256
45b50346bd53a818006c16ade36de670088c138cf778194ebcff045886416e13

SHA512
e33820fa5a7346869718ab12e1190751dca4a51705aa6a058d11b29e9377e550daccd7b6a5de4813433b87369c76814174ac5e41591598bbcde63dd9fb837524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
29e59b4780e202738a6d98755a93a8ee

SHA1
1910e6ae01e4df640902da1840257ff2ea28b276

SHA256
aafbb211a04d3787fb04df0333e7538a5c3782b55da7743300960824f2129a86

SHA512
dc56ebbe3315b6ed5bbfdd0f4fbf7e173496d950c91c9080add53a24c18cde1f7d951dcd43398574df72093cdc630ed12de015897d8669496389c95441735693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
19KB

MD5
868710f8840f33c2fa2b41251dd9cb47

SHA1
332a11c18fb682d8d2d23fba1caea6a7e50c3edd

SHA256
199249dbb3893f9b5ffd1e66e9dbc66e7b48579d8132519870eb9ecc0cee747f

SHA512
2748873d43e7f4710c6bf7911a8a641e1dd9bcb0535e2f0a78ac12d12d43f0f5b97d1c4b7bf82539125712e835f92e25bb91d26f52697a910326e74b72b587b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
0549b3d0975ace33b6c5e26403efc65c

SHA1
6f8e3481207728e6c60efdc4e2ec006680e640fb

SHA256
0e7bf8e4d0630c3cb52b9b1fbd561d2bc8b78bb7a900f82397f162aabeb366f3

SHA512
9bdc939dd3971b00b393b6431a6c420b0a948199887e4f5913b52cac99c9e115b155e8099562a3a4cacd1e885291296acae199b936d2ad35366065da432c438d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
14KB

MD5
a1fbd0ff9e364a34c81d4f26b6bbc362

SHA1
2b636a04f5931b386cd55fdfc96229721dae6323

SHA256
8bb19514b7fb4e65eec90ea0c429073ef83fe2f44cd133d1eac4454f3ed53ed1

SHA512
8bba215cec5993d5647e8ca478ce95c40b90a594f1686078545f2e56f464487ce6a93be434015e5a4b89edf4ded0ed4700012e3879c739c5abc7d3f22a8941a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d311823a10cce1c7a4a446cf59c7cf9e

SHA1
ae1b1c4ee15181c83da8c384c76c77ecc1571097

SHA256
d4c68fd50c0c049be11f48ded6102e00f60cb84e168bc62e2aa3232fde41456a

SHA512
7141243bcff782f9883f580fce341bff3e927748c05092177b98fadcf569c4b85733285040fe04e220b2c18110dc570555ae56993dc3958ede8948457714f81b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
90381032c0a9e2a576122824fd80288d

SHA1
4f7f9cc4c2e0879361844f32cd4dbd88f63b3569

SHA256
952d527c946ffe4ee271b729fdb5721a0d7e390b408f44edec991a2857b766c5

SHA512
21580837edcb5460f1ddd494f6db3f735934c73972293ef903588e169cdf5318d56574fa86b166976939638a00b61b3f8159bebfe96dea422ef0feefc10573c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
51f6041326d08ad602263ce2866173d5

SHA1
ccc6329375d2873ef6f385587fa0312ffaaa5bd1

SHA256
c8385a20e9fc6c41d94925fac22374fd5a435d3230525334fd8fb3ff79dad9e3

SHA512
77eebcb11e5cddf2d2c36b76859da2fa1fac6885aa7168589b17d001373e65dc28854353b6ef44c9126f7d4fecfea74f0bdde43a4e9b512c9f482c9a6f2a3eed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
66dff6d14fe17de5fba190d521b6a294

SHA1
a701ea4b679aa8a1c1b9e6c1a3344f7237cc9b94

SHA256
c01882cedb6101a71bd92c90b382d6775ff2004423c22bd40200553e84d0f473

SHA512
259b59bc3595880f4d63873ee820fe1e0172ade9debbd177ea594b1c4ab62b6b30bc5a57fdd2ec4a66b041b62dbd81e7a31d7ecc2f17e83e6baae8ce0d62af9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
ecef33e7590b340db3efe1ad2acacf65

SHA1
30e0a5072bf82107004b49626eb75600c32441e8

SHA256
0e78c8037e64086f3e6c33459b68c27a7fbf9d3006d82e5993935047d3720791

SHA512
40edeffdc49b6d9c13cbf0a153db888153f55055be72fb504d97a0efda79c6c76f62021befaf9edd269b1e58ef5a694b667424010320a334e9cf2417624b9618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
a91abed301bbc70b64288d7ea45979d8

SHA1
d2b7d18183c35c12ca16d0f73e417495cc059aac

SHA256
461ae35ed80ceab5126555929afaf1b5d8d3e950b9b10d53a80cd6a608679052

SHA512
3653f58edcf6b1f34011a65ea2ddc8f336563f0e4ef69785ffdc3bbfafce9e76c48502bb0c16577e0991b62e6f04349ad5abb9f0b8359d5fc4eece8a32382fdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3bf6ef8d881b51290412d7e69f0a39eb

SHA1
59a8ab9e18bd4d677423fdeafe92b44fa7fc8598

SHA256
e82ad08afd67b63060add8afbf16caa7dbba3ed0652e7507cee741810230765f

SHA512
b2a3bd6dff6298d5d013e04a9fd8a9d2355c682129a2aeb5cc188083ea4fa7e18922321361788f7dfd34c20aabc19571c382159ffe3953a982a6054259a791cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d2d5b2e41f5b71f6df29e404f20c5335

SHA1
45245b5d346a47aa7a5c1c57e68ed9476e3f4356

SHA256
146ad23a663f395c8ec7ed19b7bb631d08b774d4a015ba5d021fd8c9bd8863c7

SHA512
8bbebb07e9d8742492ad54eba8026f605bdd763073844ddaaf17e3b90b96a5acfa3c3e7aa7fd34accf611fdeee4d2042846a55d51b27a990ff200d06c506447c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3b2ef6ac77dfc0e0e70bf8b929e618ac

SHA1
a4e5d12ef836de908a39f66a652d148f622429be

SHA256
b3ab29deb0d908a7691f968596ca8b627f45aee697748de82e46d4aebf32b7d7

SHA512
8b5d9496475edf14e96335fb5f3dc715185864cb78e311c3213d261857233beac1916db55092d2013b481ff27c3751f29513033ede77c05ef86854ef4861fd1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
68ac92e133ab465aba02561b77b8881e

SHA1
fbc6ddb111ebf05e028ef7b9107d833e52df57f4

SHA256
2f4f96792b42bc57b6e6f8bb287b2428f9cd2287d0d3fc9fe29e92867bb476a1

SHA512
8252dc37e001d1c76a634a496ed682968217481185b61c005b9bfb56f03c850b1592ebd82a9c0ed38c66a675d0ce26876921b68bf2365c1739da304bc5949cb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4c4edfe55a26155802f43c113ad889c2

SHA1
25ef19e91d0eaef5c6a01211192f56b83b3f2c86

SHA256
8ad82849b4f2d8b631e7e62ea1a326669e0d52e541019de76664d74ce92dbd24

SHA512
918373016e2ff2e50eae0989bae0d8ae29c5059b969da30546eee36f34a3fc92c7059a4d837481d42423c94adcafb893d77190abf2113e0b3c0c9183a762703e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5fe2b4ce9f971a76066c51d4c9b81b9e

SHA1
55645afff242f91635c7580656ffa0c4153825c3

SHA256
610c2e5ee04762cdb0bac8cf9d5ff3c352dfc5d80c98456725a277811c1f3a59

SHA512
e36c636effad2b51629c5467efbda429a1c6a301ea527c91bef9b85790de01f0b6f9f561329c13fc33fd7649178b3d1716d48e5662226e5281a58a841a08af3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cb9b379d1f1c99b8880b1cfe2812ba31

SHA1
b7788e873091b2a80d17bd4f609bf66e0da536a3

SHA256
3bd99b21b018ec1dea5a7be3f5cd8e0f0857223f7ddbd8acbf5189b37037a6f2

SHA512
6fe4058dc693df229397d9b88f02de238a797ef7c6142434e05235642f551671992fbe7bddcda60d2c78d3e579b4d9bb17cfa24c959818267227d0b6d5d51b1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
22KB

MD5
86d7828abf06b6acef67941c72e9912e

SHA1
df2e13eb6d9ff5ff47dde6ef3192da347926014a

SHA256
6fcc46ba65543bf651947f51725fb78d938ba2e2dff3571e870ecc5c9237ad03

SHA512
dfefc458995c8de8568ecb50de0d52cae7b1bf4ddfdffdb148a19ce6e483a3cf2bee3635b302b6121035c736222f9c0a4a2c508208f9d675370b79b5b8c38d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
85500b17ed0bf6f212056611094cfd02

SHA1
2a26ec377dbb289669ae971c586e8153095771ca

SHA256
3f5b404d1d6ba5b64a9a311d7d59ab2a8b32408b1ce3f06edb156e162a01bba0

SHA512
3faa9ff1d19cd6f06c34bc5835640c1c6c13aaef486d7421526ce3b0c21f5d50883bacfbb473754bd964ef0cf4082e7aebc5278c29e8788ea7c24fa38eebbb5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a6d273837bf72436aa54932b5dca7f70

SHA1
417b15508578de55eb6b02c3d7b48950f7cafe54

SHA256
0e8b7ea2b8fbc6ed1f33fa77147565ff962fe4db789e6b644b12e54387e7dbc7

SHA512
21d1fd28204712ca7f96708e105ef119404c2c23b7aa5d0cb36cc3249cfa4732988ecdc1aa4926fd3b269b75ab39e632e3a745668302197a32855aa619db9660

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
432440c72e5085bd95eb13f7a3adfce2

SHA1
cba53909423c3d459ef28188b3a796e60b3d7da1

SHA256
46c25dcdac6b882768a4c220ad858326252ccd053f2c62aae2d8ebb01b67dc21

SHA512
22417c0baa616d0aecb9c2e79fbeb63f411057e533e720a4c8d0c44879e511f064b63b441b994d6fd397feb0c52d2708508cf7db9846edd5a2d72fffbd31c3cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
4cc5ae25e2b1d7aa9c76b8617256a0ad

SHA1
13fcdc0e1f3c30b7895376e3c478e7e2b6d6e730

SHA256
391a5baa3cf35867cb33d74b6ec1378690b800273913685645806232ec774cd4

SHA512
4c951314686ae639b8edca06d386d94fd552f2c9ccc594c7f6aa23dcfe1f2aea303341eda99b8fc33f416c51e43cd0a830bfd79067870306d2353f06efb1b936

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6619ad05189cf09c74cb68a0da69b8b8

SHA1
95be61de2ddcd30c7dec94c715a8f58e06058446

SHA256
203d23eb74f0470c1f37340e26724002d2a032e92b9af56497b67fa68feebeaf

SHA512
f500a72153c53b64f2dd1bf574cdc810ffb4033306c74a6bf55bf4b0e06b2747179b8eb3c0acebf1bc392863f0e0bd79917a689ec03bb1652a3fb1059f29be89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
647403e1a471f359182cac025d4d680f

SHA1
b160854dc8b38ea2773211f2f7a4123427dee249

SHA256
0051ab1a1c27a47238f16e02da110f0e7981149f904b64019135daa7a6acac36

SHA512
074b10f7e536932a984c31a736fdcb203f76ce3d75f851d76116bc02edc7ac5af6cfda034b41bf328dbf7574557d78d4e339db1d15ce673ebf2bf33bb601b526

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
4ca31f089598f9e06dc0f04c7fd7a85c

SHA1
2388fe0a3d7c60524fb8332da0de1ac20debde5b

SHA256
e57c04c3840903dfadfc7bffe44f0fa33ad0eb2fd0b0143b7ca128633096512a

SHA512
940092be47a8230e4fb459c30a3f0f81836d5c8a52c34253e8c7ba564df675b6624b2decbc083efe257f4e3fd5d575598492c058bd37faaa33f10949d95fb922

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
d20e233c4833f297cfd86ce562a10528

SHA1
c954430dcdd6208b7b334f4a995927725dc25710

SHA256
be8d20a25dd992b8a35eaf3c2061035c2cb196a57432360b935c1212c0cde009

SHA512
7ac49cee8993c3df83f449a0994a77d67b2e2e23f419415679f2428f05f1d5200a21fd524d2d32b906745ddf494dcac350adf7ff7fa0146c94c5146c9d4688d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
9KB

MD5
64383211a4bf05b7e5d33ce50b9b398f

SHA1
45934184a11dd1af4f0bcfbff741d136b5333ec5

SHA256
b221789c33254f7dc8793bc255e8ef2762d298f5a1204c1ab501599a1d278001

SHA512
a9faeba5fc2aa5b8ed8ceda889cd9ade18c52c16e2483d80f05fb754d3e3f81ba73a18d0654d7480c145f98aeb836c04c17bdbbb7e6033a580e45549532a8705

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
504415245db3f94fc01e03b8c2499f5b

SHA1
105d2cff3c23a3a0fc5578b0a17861aab12940fe

SHA256
e95cee9fde7bf8c8d2c8e0dc0407f122e08a25a41b31efd964a9b41821b45426

SHA512
b318a5b6dfcb6f3bb8bd8fdd6ebafe7b3eae0875320d2d08b08fffcfad124e6a33e0963e42221c9ce2e05a221c60978387ef94bb04a756acf4d8aec17ea7bc0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
5b0545392440e001632e27fbcd975486

SHA1
2f51f9a9fe1423bbd22654aff327cc2dd42784e6

SHA256
291df5400b1da02c0350774cecbe3ca7e97e7b560f5802c3b044d3787c7a18fa

SHA512
955071ed1d7b89ed6325ab3589201e941040d10f932656b0e284e2f754ac1bd9b5e69e95900e5065613083289f3f5e122bc269eb4b64591533062f15509da8ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
9KB

MD5
8837768104f2f8dd616058fa7b59d437

SHA1
43d0d09966e39860a2be68eceb9764a60e04dd95

SHA256
b7e143f388ef472f9606a41f27db8cf91acf02ccce436bc29205b62453f1a713

SHA512
58178293995d0126ff56f95fade6e87869f0af4aac6c7131230d95e71e587ed7331cd95545931686c2a8944463a2a50266eef3502d14608d06896cde7a8131a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
4b21483ed54c06f59201d4b9d6196ee5

SHA1
702ee466fd1df7d34968ed2d32670f2cfcf90402

SHA256
846ecc25497012e27187c0039a7c8a3e38d962aa0a4e522c62a79f33bb6332ba

SHA512
1d7dfda2343a2b8331773e962dce5be19ebe7d57c72bc79c52f45b7e52a696e335103e6156b0f99aa53155e018830b148126d70222d6e1b9e571989428805570

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
df2baa5a200f74daab29db46b9dc3f3f

SHA1
63412f101ae455e0eb95184a98d84fedd5467d76

SHA256
8952868950a6ae2f9734a41d15b6d418b9b1d76740ba5b223421ce3a944229f9

SHA512
8934310f02948603fd20c8c3e87883770b687163351ae39a28906ce4f7b2efb3a22a12f1b1ba05165c42c16b766fe9151e7a6369d7cf0d8419e5201bcbb9ca4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
9KB

MD5
59197496651aef0315e00a729251e497

SHA1
5cf7462222569b0bef2573e7bb45c46db20741f3

SHA256
d2c3c6cef25df4ae49f5d19e01a585d13b0fcfbf422053dbecc1df6dea47b987

SHA512
26785c9e1abf64b6b555ee2bbe578ae0c9849e9f8fe618088f7fa60469d01e6bc86ccd99a2ccbb92ab9977b43826612e1cf238699b5c48b8b657ab8d214a7814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
c6d567b655cf89fc11baf92dec75e35c

SHA1
2ac6ccaeb28cac02b7d0b76c16df9307e6cc910e

SHA256
fc9032003928c828c153cc7b7a1f3da6005eed0e49836ff4c6cee7d4d7e50db7

SHA512
07934306202d642bdc435eeac7b67925cfa45603b4c695e57f487aea8769957a4661e7eb97c4a3e14c9438712d53c82d6844f62d8c0eaff2d230981b67b80d6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
8ebbdbe5bfa8cef391775343faae89c2

SHA1
96882ff4b73ae1b1ff04888dd7b2a42c266bff14

SHA256
cb6e022905f90f3aa0fc92668e04efa087c8f92096bf196cb8a8c411f4643fa1

SHA512
e6763dcddc3597aad234b1258a7b36a17e3b39063ab95a6a8563161fa3f418764518abdfa21a82bb24e96f1e85c1aa4be443728496aa0a3a85bd43fb7b4134a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
9KB

MD5
86ccb4f32c4d4247d1d412cf8042839c

SHA1
c9d8caecc2bd1e3169dc73f09c44133e831080c7

SHA256
aea162ea952bbf957ddd69da8ab217d238134866722909e23c4727ee820e5b46

SHA512
589e5a49554f1473a7576224dc522a1557912268ca98ecbac51515cbccbf4ae105f7754e8526ecb9e89a931f609ab506e034f75b61ce0b3b8dfeb12ba5d4b4cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
9KB

MD5
2f4f47ed08255dd28db7e7d5339f5656

SHA1
db121c5a16cef62b00a0687b50abc250e5d1141d

SHA256
90bb54faebd70ef24b1a31e2fad4c9f69559608114c4290592fb752d74fa04ae

SHA512
f9825d6ba87b3ca086637d6957294d58505998334fd65fdb4061c7dda76be894e731c8a4fc3e5ae0c59aa35b6a83a92bde163ccd271253c16bde3034c8ee415d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ab4608c9214e40d8d82b1869960e7cfc

SHA1
1109ccc08e8f50fd7290dd47e6fb715410e8bd67

SHA256
89dc8377bcf7863d5d8ec93d61f48b57693867894c5a97d6675d7ebf06d4b762

SHA512
8b0d25e23be2c1c4560c593ab0a51d616552ef279f87adcfa7d45f09953bfadbf3cd2fa307f4550c021e3f3047ee06474d4596e8c400874c9c1810fc21fb4b3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
9KB

MD5
4f1bc2e3c442706205800f4ae6ce1a6d

SHA1
c06c15b34695679d13a189433d822a3d87db9e7b

SHA256
c6c2b6b72d37d49826b626baa8cd1b05fb6c22140e34a6f1a6dcf52dae83da6f

SHA512
daacef22c36d10e1fa1cd76f8e94743fcbf902d322467fb7538e88c9d731be2818c6c6c711446d9524e52afd28b2abf21d73e4ff06aaf94982ce68b1e5fb2a3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
85c31e31b7b4d02eebc0e96aa6a6c000

SHA1
f1a521bb99c65573a77069dcc86a18f6213c3ba7

SHA256
b42bcf8c7e416f09cd0b514076deb160de6985f3d27400c2dfef4efc3108b0c9

SHA512
59f134c0f62a3ff7075d50929eb7637a46f3ee25bec827e9e9af314b5a4673b72763375efc1576c8883f94a0d3fa1592cf8f81f6dfeeb4a8153c31ffb2bbe5b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
6683b841f9355dacd4f0272ddaa23e5f

SHA1
83f8f2f748bc7c28d4e1506130789766d115c0bb

SHA256
af6da29bb2a7c89c087ee2777a34a521667a3548c41820146bc5021d38bf8cc2

SHA512
b27f90484b64ffd0d9a68a98ed1589271e5817dd20103aec472ce802c9774796ef156418fc1f311a5048bb82719966d552e22892bf321696ca59aaa5ca2ef5d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581141.TMP

Filesize
1KB

MD5
fd9cda63eaeacde81da198e8b5b8ab7e

SHA1
26fbc4c5a93e8cafa6b80b9617e5481962e39542

SHA256
3cf2e9e3f1da5e5632c127a2789ac3a229c812847def44564bc7ee845a1eeb00

SHA512
2758ccf942b8f2f904ef89b1460cfc5a5117d93a8b4817f2a577df0a8b2eb8c4ba1a92ad2b2eeac99076ccb6d0a65258db792a95291201123f2cede15006193b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a06fb50a-c513-4533-8c22-255a6511d09a.tmp

Filesize
11KB

MD5
930130f265784a431d245cdef69165e3

SHA1
d2336f95d07c6e0192457d879d8035e02f99c2d0

SHA256
325d544f402c2c59ec8aae1ef84ca7f458f915c783a9a89810b3234c4fd0b2d8

SHA512
ba1cb054b7ea3d1ec312864cdac517d61505dae924b5dbebf8d691a9912f760f2b0fbfba9769b9a9f781232c17eef55aec2cb5426ab6168db7eb16e43e8086f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
920d7d9ba91fc31e5037efb839e84cc9

SHA1
0fd1e960d54bc716f869e56c307e6831f01772ac

SHA256
156e5d29bea87684051133e379b921f005fed6441b35558900f28558cf640ba3

SHA512
203c8438935f775fbfed96dd23a91a7c6d1a52ab6a438236554a97c8365ce543a7c336d77d6dd89ecbd1cf1247b462e0f2d14a6cf1f4fda683cc64c46b162ae2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
95639c1efc79b9e0a8ae2d29990c2f48

SHA1
445d4da7712c8f9d241beb5d10567f82474e122d

SHA256
238d03828f7db10d0cd7f8864914db0e00f51e364a1d29abc0b3d8875e3205f8

SHA512
723a6d1586c7cbc2207a1b95e1ac7eecc0f07a9c3f717ed56a77180152cb87d36359671c9301f8e48dd017ccb567910de1cfd8b7dc69baa591a52918adb1e05b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ba4a6942ef9db245f0440468e392548b

SHA1
a100c612c03356ad2067f35e88c4a81f416dc08c

SHA256
9fa8d4dd7e8f1245ff88d866ce63ff2dace2ac5234fdd7a8530e84264c8fcd80

SHA512
2c9fb5eab33577511db28ef63f83fe44bccbd5295ed0c323ec67fd1052a7951a46c76408c596da2d688b0b23443718a337092afd79cf954d8adcf2b87e647f75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3307fdb9701689fc1b7c3ead9ea95a61

SHA1
d8b3a5b885a46b4d0484fcfb0e034a5ed46fda5a

SHA256
136f22fde52b3ee5ac723eb816c591e5e2c8cb7ed933bb51fcc91638c2be4a96

SHA512
4338935be938313d53d3d197052dac170b876e2e8cc9614933c0fbd368fd60c206b5586051bb511dc2b7c197a728723f3313bcf3d1b1aabecd74c1e88d3ea7d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
41a45fdfffa316e6c0ec5663ad2bd183

SHA1
4daa385b971407eba34ebd12bf3311f9f4e36809

SHA256
5417637dae0a9415f0274fdef3e6712d0bd9fde851967b8e06c774ea849f0422

SHA512
59a6262415c0cf3d2565a887185d4cf59d24865c64036e1ce87f8db7bbf5ac093cd408b53a138b82035c3598ec85352f15fff0f7260ec095dbfab03ef63da600

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0ca3680e0316003745ed1d1a7be6ca29

SHA1
762dc6fd655f39e776fc30d142841d4d930412b9

SHA256
a8a1ebefdafd28e976cfa381a99a28e004762e4a0cc77f107850430712bf826f

SHA512
eaddf41224e69110523ab21e20efe3c67587cf2b4c2d11cc6cc9ba08193f98bd2c3d70d8373d8ff177efe4ac05b396b9ff51d87562dbbc81956840f36f2ecfe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
afac7686abfde631185321296ff9d8b9

SHA1
d36ea9282eefe9fe1025f26b7ac87b7eaad28acb

SHA256
416b4adb19589f0b45c6a3891e020c9f8124f489057f40b69104f097b2486f1e

SHA512
45d81eae92e1821a40f304270c4798108e73e8d5595a0e807b1c95955688700abc823f729e4a3e1f1f6db05acdb028fb32c77e2f114e3ecae53f43cc267fc6e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1f57efaf5e238e3f50754e7a31053c0b

SHA1
f80bc3b53bc2848800410f9a8431818514c42430

SHA256
efe58b4026e99be2fe889a13bd5b5de907191d4a07c056ca9d2bab25638839db

SHA512
0301bfa1380e6166f1c1dde053513263e2e47f1914ba83682c518eb4b59841ef521315c8113c31e84d810440898088f1aa0d66b7ed4ae05f211e625ac258d5f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
74f8a3ad6aeb1ad74fe925394c481e5f

SHA1
4a0a737caeccb955d8f87cd38d98bd4ec7c8a86d

SHA256
3aebf38e483e97905cd5e8543eead2fd6466e4687e34dca8eab6172485e64062

SHA512
582f581c114ea8f41cf3b46d787412b891e5886497d9e6e406f50e99e4cd704de34e6296ffdb2a9c4385bb27e4412a0f14fb7d694ad22bad0375dab74681bf4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\de3fc938-78b1-4ef5-a4d9-aea6308055af.tmp

Filesize
11KB

MD5
ccbe51fcba0e32c1647eb6de4e82fc19

SHA1
22b31fe6fb7dc9eaf4b817579aaf682d1666448b

SHA256
1753e107dca464aeaaf5bdb2d48a02d254e7ee30894af1a6b0748ccbe9368ccf

SHA512
78f7490fa7bf9a7633e154e8ab72a4450f1b18b08a2447886b5dc09be48c2cd0fac79755b7604a03fd86523e82363f9954ebf99acca38a503eaaf98c54a85a16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
e436bc8080330cfeda9790b804f30123

SHA1
52fe7abaef12665d85e329aa40862374f4cc518a

SHA256
9a9a5f721149c37c85b0079ac2e906fad228c542112e142125e02d1f76d614c2

SHA512
bd78603698be5d4f34d64d74d603fb6870cef0dc72383af4ba64cc9a51e937bf508320320a548ba864f41d46a11d06447037d6d4adbf3399555e217d11320bcf

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
0f137da24a7f95c1f5efc595b7dea47c

SHA1
a92df2e2f6e5a988251ecba9753f8261991c543a

SHA256
d7780e4b261a6039a80cceb18531df7678e321593e5bd5ac0486edc9fae5d5cb

SHA512
e50f48c6cd15d381370356ba1e7425da8d5a57cad875aa9fca73a2c13242f9c64249c2ec1959b46129aee4da2802f357f60526f924b99d433eeceed3c701cd9c

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
9KB

MD5
6a5685aca3fe0d46d59a19e03fd6cbc3

SHA1
3af400efe6ce534eee390713999583bb034b70a0

SHA256
3d5a18c6fd34c17ed712cd20174bf2f955754886ec9d83327b0a69748a6323a9

SHA512
d9d7f2389fce064df35c80fbd5ed49839ca3bcec2d9313e860073977560cb54c71dad74983ef0d67e6c36798b3959aace03344cb65e58e841309ad5dab1cad34

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO89F99509\Chaos Ransomware Builderv4.exe

Filesize
548KB

MD5
9a44537dfcf8ceac515c4aa92f30f4af

SHA1
9a26c3ff3251f69950ce09e3692ce14b5dd536b1

SHA256
3246be7f25f8f4cd9ade8f0a8faf12847df126eecf65d7e8012f35ab45e73a40

SHA512
94da6f1aaae6c25e47e31ac246a8703ec8f7b2893a44ae10f7600cc79ba673bca60d7fb41b2ebac8a4b5497ab98a0a195a32d93f4fc140ba7c9cd25811943500

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO89FFAF8F\decrypter.exe

Filesize
218KB

MD5
97f3854d27d9f5d8f9b15818237894d5

SHA1
e608608d59708ef58102a3938d9117fa864942d9

SHA256
fac94a8e02f92d63cfdf1299db27e40410da46c9e86d8bb2cd4b1a0d68d5f7a2

SHA512
25d840a7a6f0e88092e0f852690ed9377cf3f38e0f2c95e74f8b2ffea574d83c6154cccdbf94f1756e2bbdcdb33b5106aab946644dedc4ffaefb6bf57a866696

Download Submit
C:\Users\Admin\AppData\Local\Temp\mrt7B2B.tmp\kcini.mfx

Filesize
28KB

MD5
e8d589ec9987e568726f882c8792c06b

SHA1
3ddaab03befb496629f4208ebd0e01c63e69a857

SHA256
499d3e1b9720ea6cc10f8b56378bdfce2622008f45243a0fc273446662ca0cfa

SHA512
89d658f1380938b78fbb9475ac0a942414360704df6e739a96a26c2ea15268fcb0ad11b28b614bab2fe3aaa3d4c14dc8a79ea2dbe11e9e0a327199c76178d4fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\mrt7B2B.tmp\mmf2d3d9.dll

Filesize
1.1MB

MD5
ba4baf4220ede3a3bd32123e9c0fd952

SHA1
e1186c6746d67e42fc57f72a6ed07e600755305e

SHA256
a38d94169881d68a20c5031895492fa2bae58e70332b2f08fca79e62f4359edd

SHA512
55827a02e2617bc94b9990ff348d893eda39fdc6251abe506e0ac1f656ac2cd9bdae8197de437b277c434482e8a1c6782f7ab5b8993d1aa0b779d21b6349dece

Download Submit
C:\Users\Admin\AppData\Local\Temp\mrt7B2B.tmp\mmfs2.dll

Filesize
460KB

MD5
4758d460ecbb307ed90d59643046f00b

SHA1
2bd87c39f97b73b9db6d205bb10ae37eb82f2372

SHA256
3293a93c6d8a2ce529538fbdd2a81dc623fc40464efdb5348c8e039788ad1b22

SHA512
970a44102539ed3116c125bfcf9075e3acb8f710a338ff8ba881bbebf5111d236b3c27bf325a77d83d295aba8e836439fb6fd54a899e3ef075e1e45b6e2a1fdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\mrt7B2B.tmp\mp3flt.sft

Filesize
24KB

MD5
f0ebc8596156d8ebf6201a10f9864305

SHA1
0efd689d027d2d592369c3585cdd9a0b879e6562

SHA256
fcca0e08e8a64081d71f3ad7455cb5bea48e73f158f0773e856fa100914fe192

SHA512
7752fb5d3d114791c7940088b98c03252d6fb151ad11774a8fd8b4fdf2d289c66b5d54a56feddda2e2e4de125f7f6b75c1197eae276add1774e3290becd8bcf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\mrt7B2B.tmp\oggflt.sft

Filesize
130KB

MD5
3c63ea4611008fbcf86435559e9dffab

SHA1
fdc9c6302fcc427530b2dbff63aad1b6d204125a

SHA256
9efb0b4cff5bb033cf1e04bdeabc581db7d787399c5238f4fb40a1e820aac6b8

SHA512
938c6ebbd0a7248f32bc83d2548791b35764417a74728b8b861d2bd539c182ced6f5168a604679e20c150dc6741fd6868768e7d1ffce224667546d3ea80787d3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
15KB

MD5
7279ad46e7248bcbc90b028cefecefd5

SHA1
1065dda9396761bd2314f2f80f0e0a6414b88845

SHA256
e8d14ddb103ca3cf407806c263b508efcba362b035ab4ad48a0ed5c221e80def

SHA512
7a6cbce6a99083a17fee54735b89e114741fa3b48e62b0c38111aa413194ab6c01cb8398d880e6485442b36b46307e5c840b64e2db3d08909ffcf4bad200065a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
17KB

MD5
5786bb91ea3bae781494bfad3ef480e4

SHA1
e95dcbdfa6b8bd3a0d4dc0a606591b623bd7c9e2

SHA256
596689e35f10bcd7e117470437f0c8916452700c00a5dc494018a28ec7c82c05

SHA512
b342e6869f1f516d66c44258d67038dc6a8098f94de0e9bb18f25503002b0c35d1c1d84db7ad25a30c4a9bea573c2ec2b00fcb3d18357d91153db9725e2aafd3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
15KB

MD5
27af6d41b8a873a991fae0ed933de660

SHA1
024d3cc121052965c1b2d949a179cd6b4f317d8d

SHA256
2e8c2062dc031ec36625ea5bab67ffcfdc4b6d031c62a88253ea9420e2d0fd13

SHA512
970792282fc35462b2a62e0c69aaa3957533669656d5d8c9e233ab27245ebea8c2def4309d477b1d19ed16263e72bc112fc3b46f0d703084b77eb793a87edd24

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
15KB

MD5
c85270f81a5c78a22ff1d4042282a474

SHA1
71cec7e70d6ad58520afc62f03973abc8c9eb51a

SHA256
4bdb5130568bed3e08bcabbd32273510ac769a0f2bf0121247e0ba42e49a1331

SHA512
f7c4701b3e59b84b6b7fdeb31c2e31eafdd05e0cff6bda7b5715dafdd7f2477d1055b7c69289c9661e72d1681c4fe5d7b81a40c06b5ead98cbfb76fb912e893d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
15KB

MD5
93c7e8093b04eac7bc68acafce67be15

SHA1
7807e0fbb5e3eb11101be691b2fca59d9d139837

SHA256
d9f74fff286ffc4d0d3a032b95480405adf9d44d191e5d4686ffe564e9d3f30d

SHA512
9ba8c776c858750b14696a14e4a5c5c3190bb9dee37d351899c9d8b80d748d2afd6855dd3570e79d994f7ec0215308373d8720980b7fe5961f6f33dad345a770

Download Submit
C:\Users\Admin\AppData\Roaming\freddo.exe

Filesize
54KB

MD5
84436c53b00f828b2c416d23ec9d0e9f

SHA1
36e6a3448f9b7f2ba09aa6ade18cad0a81c4fd76

SHA256
304b7e2be5a3a97a28e70685a050f54b8f6ca8916a5d5cf9c8dc06e2da42b34f

SHA512
83527350b4a37e1b512061c145b3e1410a900c6363c1093054e165bfd23e20587a7e843bab559a43e7479012afcbd38d087c898ed16f56e04f09ffef1a2c2257

Download Submit
C:\Users\Admin\Documents\darkestpedo.txt

Filesize
187B

MD5
edd38ba9449d08e35eef86c52ce2d7a6

SHA1
9e1293779d74f1f5f8731623f651b7700e18724a

SHA256
6f8a78dda8ab7a8d6e956922103ef897e47a801120b337f5802a19940dc10576

SHA512
a9b8f343203c37a25456de31227dec07e92982759a6dd7b32565ecb43d7c57274641d09cdae1bd59b4f38130f7926aa97cf279d92c29a922e843a07b73ae085a

Download Submit
C:\Users\Admin\Downloads\Chaos_Ransomware_Builder_v4_Cleaned.rar

Filesize
226KB

MD5
6a160e5713b7c4a269ef35eac73e1412

SHA1
36b833c40d83652d450888ff2b602321b9de877c

SHA256
0909910f70a8bad23ba9232fc2d5110fc5841fd2c6600c5a38b1c72aada42b51

SHA512
97eb791552ef0262d903b1f40ebf61731603cb00f57829214c71d4df8c01a1d2f1352f877f9ad0dec08c21afcb7cd3740b9cbc3eb1f1474ca70c3ab6bb30fcf2

Download Submit
C:\Users\Admin\Downloads\Chaos_Ransomware_Builder_v4_Cleaned.rar:Zone.Identifier

Filesize
272B

MD5
dfccc004ad38e1768a73a59f83f55d75

SHA1
00ca36fd17f641ef21702a8a145a5bdbe1f917c0

SHA256
b39afbce91f1e53871be6237b913a60ed521b64cd74aaf94bac6f78d89a68ad3

SHA512
eb56f0749f17bc9b467c7f742cd7f5413e1158e799d3419a4864ed3d6726f2894ee62c14f88eefd185b64f58eaa3b2698b442f2e5f42a51cdead8eb57a0cc4f7

Download Submit
C:\Users\Admin\Downloads\frdre.jpg:Zone.Identifier

Filesize
145B

MD5
6f49ed040876bd255213d2d62d1e8eb7

SHA1
d20f4c7be80a0df216fb9325be10b98784e19c88

SHA256
6e68f4016ee7d91d78189e30a8b87d77b9c56726f6fac0874a413064d7c874c7

SHA512
36cc53831dce1d1ad35f185c1a10ea07c21c60b797fa29397eadf6cee963e0247ebcd4acc151ea04835fe8a86e4ee2a69d7c1771ff129c590e3569d992eabc7b

Download Submit
memory/1952-3225-0x00007FFB49570000-0x00007FFB4A032000-memory.dmp

Filesize
10.8MB

Download
memory/1952-3212-0x00007FFB49570000-0x00007FFB4A032000-memory.dmp

Filesize
10.8MB

Download
memory/1952-3202-0x0000000000B90000-0x0000000000BA4000-memory.dmp

Filesize
80KB

Download
memory/2668-504-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

Filesize
64KB

Download
memory/2668-2435-0x000000001FC80000-0x000000001FE3F000-memory.dmp

Filesize
1.7MB

Download
memory/2668-1297-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

Filesize
64KB

Download
memory/2668-1152-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

Filesize
64KB

Download
memory/2668-530-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

Filesize
64KB

Download
memory/2668-529-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

Filesize
64KB

Download
memory/2668-528-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

Filesize
64KB

Download
memory/2668-525-0x00007FFB49570000-0x00007FFB4A032000-memory.dmp

Filesize
10.8MB

Download
memory/2668-515-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

Filesize
64KB

Download
memory/2668-514-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

Filesize
64KB

Download
memory/2668-503-0x00000000009C0000-0x0000000000A4E000-memory.dmp

Filesize
568KB

Download
memory/2668-2231-0x000000001FC80000-0x000000001FE3F000-memory.dmp

Filesize
1.7MB

Download
memory/2668-502-0x00007FFB49570000-0x00007FFB4A032000-memory.dmp

Filesize
10.8MB

Download
memory/2668-2255-0x000000001FC80000-0x000000001FE3F000-memory.dmp

Filesize
1.7MB

Download
memory/2668-2424-0x000000001FC80000-0x000000001FE3F000-memory.dmp

Filesize
1.7MB

Download
memory/2668-2453-0x00007FFB49570000-0x00007FFB4A032000-memory.dmp

Filesize
10.8MB

Download
memory/2668-2433-0x000000001FC80000-0x000000001FE3F000-memory.dmp

Filesize
1.7MB

Download
memory/2668-2434-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

Filesize
64KB

Download
memory/2668-2452-0x000000001FC80000-0x000000001FE3F000-memory.dmp

Filesize
1.7MB

Download
memory/2668-2449-0x000000001FC80000-0x000000001FE3F000-memory.dmp

Filesize
1.7MB

Download
memory/2668-2443-0x000000001FC80000-0x000000001FE3F000-memory.dmp

Filesize
1.7MB

Download
memory/2668-2442-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

Filesize
64KB

Download
memory/2668-2441-0x000000001FC80000-0x000000001FE3F000-memory.dmp

Filesize
1.7MB

Download
memory/2684-2603-0x000000001F950000-0x000000001FB0F000-memory.dmp

Filesize
1.7MB

Download
memory/2684-2470-0x000000001B1E0000-0x000000001B1F0000-memory.dmp

Filesize
64KB

Download
memory/2684-2635-0x000000001F950000-0x000000001FB0F000-memory.dmp

Filesize
1.7MB

Download
memory/2684-2454-0x00007FFB49570000-0x00007FFB4A032000-memory.dmp

Filesize
10.8MB

Download
memory/2684-2460-0x000000001B1E0000-0x000000001B1F0000-memory.dmp

Filesize
64KB

Download
memory/2684-2461-0x000000001B1E0000-0x000000001B1F0000-memory.dmp

Filesize
64KB

Download
memory/2684-2462-0x000000001F950000-0x000000001FB0F000-memory.dmp

Filesize
1.7MB

Download
memory/2684-2459-0x000000001B1E0000-0x000000001B1F0000-memory.dmp

Filesize
64KB

Download
memory/2684-2455-0x000000001B1E0000-0x000000001B1F0000-memory.dmp

Filesize
64KB

Download
memory/2684-2456-0x000000001B1E0000-0x000000001B1F0000-memory.dmp

Filesize
64KB

Download
memory/2684-2457-0x00007FFB49570000-0x00007FFB4A032000-memory.dmp

Filesize
10.8MB

Download
memory/2684-2458-0x000000001B1E0000-0x000000001B1F0000-memory.dmp

Filesize
64KB

Download
memory/2684-2464-0x000000001F950000-0x000000001FB0F000-memory.dmp

Filesize
1.7MB

Download
memory/2684-2690-0x000000001F950000-0x000000001FB0F000-memory.dmp

Filesize
1.7MB

Download
memory/2684-3329-0x00007FFB49570000-0x00007FFB4A032000-memory.dmp

Filesize
10.8MB

Download
memory/2684-3326-0x000000001F950000-0x000000001FB0F000-memory.dmp

Filesize
1.7MB

Download
memory/2740-20-0x0000000001400000-0x0000000001424000-memory.dmp

Filesize
144KB

Download
memory/3532-2475-0x00007FFB49570000-0x00007FFB4A032000-memory.dmp

Filesize
10.8MB

Download
memory/3532-2474-0x00007FFB49570000-0x00007FFB4A032000-memory.dmp

Filesize
10.8MB

Download
memory/3532-2406-0x0000000000310000-0x000000000034C000-memory.dmp

Filesize
240KB

Download
memory/3532-2407-0x00007FFB49570000-0x00007FFB4A032000-memory.dmp

Filesize
10.8MB

Download
memory/3532-2409-0x00007FFB49570000-0x00007FFB4A032000-memory.dmp

Filesize
10.8MB

Download
memory/6860-3238-0x000000001BB30000-0x000000001BB40000-memory.dmp

Filesize
64KB

Download
memory/6860-3227-0x00007FFB49570000-0x00007FFB4A032000-memory.dmp

Filesize
10.8MB

Download
memory/6860-3741-0x00007FFB49570000-0x00007FFB4A032000-memory.dmp

Filesize
10.8MB

Download
memory/6860-3751-0x000000001BB30000-0x000000001BB40000-memory.dmp

Filesize
64KB

Download