dharma | 8716c75aff75941711aff8770836f47eb9a254416089ef3571c6fc9a338b3009

Resubmissions

10-08-2024 06:53

240810-hnsmsatfrf 6

10-08-2024 06:49

10-08-2024 06:46

10-08-2024 06:41

10-08-2024 06:38

10-08-2024 06:35

Analysis

max time kernel
136s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
10-08-2024 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Module.dll
Size

1.3MB
MD5

157fd035b2a344a94166d7db3756df0e
SHA1

f221d28c1deb80b4e8d9201226435aefce6b0f75
SHA256

8716c75aff75941711aff8770836f47eb9a254416089ef3571c6fc9a338b3009
SHA512

fad0174fbd22f58dd4fcdaad8378c214270b4faeaca64d9cb306f50e9316072a4c417c5723c4123b8bf94a3dba6ef4e3303ec60f4a2cf0c3a54d8ab375ea717d
SSDEEP

24576:ZqBSLRktEBl6blwTUMD4zB1VU2bFjYWR0pMQUAqLRAovh4bSAXVVRNRfMXZO:ZqBSLRkt8l6blSU//+2bFfvA1SQVVRNk

Score

10^/10

dharma defense_evasion discovery persistence ransomware

Malware Config

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Downloads MZ/PE file
Drops startup file 1 IoCs

Processes:

CoronaVirus.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe CoronaVirus.exe
Executes dropped EXE 2 IoCs

Processes:

WinNuke.98.exeCoronaVirus.exe

pid process

3104 WinNuke.98.exe
648 CoronaVirus.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe	CoronaVirus.exe

pid	process
3104	WinNuke.98.exe
648	CoronaVirus.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

CoronaVirus.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe"	CoronaVirus.exe

Drops desktop.ini file(s) 4 IoCs

Processes:

CoronaVirus.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3761892313-3378554128-2287991803-1000\desktop.ini	CoronaVirus.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3761892313-3378554128-2287991803-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	CoronaVirus.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

1 raw.githubusercontent.com
38 raw.githubusercontent.com
61 raw.githubusercontent.com
Drops file in System32 directory 1 IoCs

Processes:

CoronaVirus.exe

description ioc process

File created C:\Windows\System32\CoronaVirus.exe CoronaVirus.exe

flow	ioc
1	raw.githubusercontent.com
38	raw.githubusercontent.com
61	raw.githubusercontent.com

description	ioc	process
File created	C:\Windows\System32\CoronaVirus.exe	CoronaVirus.exe

Drops file in Program Files directory 64 IoCs

Processes:

CoronaVirus.exe

description	ioc	process
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoCanary.png.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll	CoronaVirus.exe
File created	C:\Program Files\7-Zip\7zG.exe.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll	CoronaVirus.exe
File created	C:\Program Files\GetTrace.xml.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\asm.md	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ca-ES\tipresx.dll.mui	CoronaVirus.exe
File created	C:\Program Files\Java\jdk-1.8\jre\Welcome.html.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.XLA.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.deps.json.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml	CoronaVirus.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-1-0.dll.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jni.h.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyDrop32x32.gif.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwnumbered.dotx	CoronaVirus.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt.id-946914F5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	CoronaVirus.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

Processes:

msedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\WinNuke.98.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

WinNuke.98.exeCoronaVirus.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinNuke.98.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3761892313-3378554128-2287991803-1000\{DBD12FBD-BEA4-46C0-9BB2-44866E0FD763}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3761892313-3378554128-2287991803-1000\{CF2CEF28-3BBC-40F2-80F4-1450669D0011}	msedge.exe

NTFS ADS 4 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 290784.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WinNuke.98.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 994347.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exeCoronaVirus.exe

pid	process
3448	msedge.exe
3448	msedge.exe
908	msedge.exe
908	msedge.exe
892	identity_helper.exe
892	identity_helper.exe
3156	msedge.exe
3156	msedge.exe
4420	msedge.exe
4420	msedge.exe
948	msedge.exe
948	msedge.exe
4884	msedge.exe
4884	msedge.exe
4308	msedge.exe
4308	msedge.exe
4892	msedge.exe
4892	msedge.exe
2748	msedge.exe
2748	msedge.exe
4584	identity_helper.exe
4584	identity_helper.exe
3700	msedge.exe
3700	msedge.exe
648	CoronaVirus.exe
648	CoronaVirus.exe
648	CoronaVirus.exe
648	CoronaVirus.exe
648	CoronaVirus.exe
648	CoronaVirus.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

Processes:

msedge.exemsedge.exe

pid	process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exemsedge.exe

pid	process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of SendNotifyMessage 38 IoCs

Processes:

msedge.exemsedge.exe

pid	process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3448 wrote to memory of 2388	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2388	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 2440	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 908	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 908	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 5048	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 5048	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 5048	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 5048	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 5048	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 5048	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 5048	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 5048	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 5048	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 5048	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 5048	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 5048	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 5048	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 5048	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 5048	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 5048	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 5048	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 5048	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 5048	3448	msedge.exe	msedge.exe
PID 3448 wrote to memory of 5048	3448	msedge.exe	msedge.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Module.dll,#1
1⤵
PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe979a3cb8,0x7ffe979a3cc8,0x7ffe979a3cd8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,10833562615950933237,8246647118657764001,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1812 /prefetch:2
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1840,10833562615950933237,8246647118657764001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1840,10833562615950933237,8246647118657764001,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,10833562615950933237,8246647118657764001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,10833562615950933237,8246647118657764001,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,10833562615950933237,8246647118657764001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1800 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,10833562615950933237,8246647118657764001,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1840,10833562615950933237,8246647118657764001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,10833562615950933237,8246647118657764001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,10833562615950933237,8246647118657764001,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,10833562615950933237,8246647118657764001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,10833562615950933237,8246647118657764001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1840,10833562615950933237,8246647118657764001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,10833562615950933237,8246647118657764001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1840,10833562615950933237,8246647118657764001,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1840,10833562615950933237,8246647118657764001,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,10833562615950933237,8246647118657764001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,10833562615950933237,8246647118657764001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,10833562615950933237,8246647118657764001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,10833562615950933237,8246647118657764001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1840,10833562615950933237,8246647118657764001,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1840,10833562615950933237,8246647118657764001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2768

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4728

C:\Users\Admin\Downloads\WinNuke.98.exe
"C:\Users\Admin\Downloads\WinNuke.98.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe979a3cb8,0x7ffe979a3cc8,0x7ffe979a3cd8
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,7758710064544753382,1638706895572242607,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,7758710064544753382,1638706895572242607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,7758710064544753382,1638706895572242607,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7758710064544753382,1638706895572242607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7758710064544753382,1638706895572242607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7758710064544753382,1638706895572242607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7758710064544753382,1638706895572242607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7758710064544753382,1638706895572242607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:72
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7758710064544753382,1638706895572242607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,7758710064544753382,1638706895572242607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1924,7758710064544753382,1638706895572242607,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1924,7758710064544753382,1638706895572242607,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7758710064544753382,1638706895572242607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7758710064544753382,1638706895572242607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,7758710064544753382,1638706895572242607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7758710064544753382,1638706895572242607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7758710064544753382,1638706895572242607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7758710064544753382,1638706895572242607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1924,7758710064544753382,1638706895572242607,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7758710064544753382,1638706895572242607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7758710064544753382,1638706895572242607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,7758710064544753382,1638706895572242607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe979a3cb8,0x7ffe979a3cc8,0x7ffe979a3cd8
  2⤵
  PID:2060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2948

C:\Users\Admin\Downloads\CoronaVirus.exe
"C:\Users\Admin\Downloads\CoronaVirus.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:648
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:1540
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:34124

C:\Users\Admin\Downloads\CoronaVirus.exe
"C:\Users\Admin\Downloads\CoronaVirus.exe"
1⤵
PID:34180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-946914F5.[[email protected]].ncov

Filesize
3.2MB

MD5
3ef233b10c01f88b8caf8c742c693750

SHA1
bbba00f42bca813c324d425c203ba944e1bec73b

SHA256
5862f0904cbb3f13e6cd8309eb4df84da67cf9775566c3e14a8c82de0b8d2bc1

SHA512
f6ccab534672e2626d016110406b802f9123b8dc20c32f21fcfb447e99ec8f462e17f9247acda7d67bff423fb64a2722b2baa993865e8be4f6a99f06af5b41f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c3889d3f0d2246f800c495aec7c3f7c

SHA1
dd38e6bf74617bfcf9d6cceff2f746a094114220

SHA256
0a4781bca132edf11500537cbf95ff840c2b6fd33cd94809ca9929f00044bea4

SHA512
2d6cb23e2977c0890f69751a96daeb71e0f12089625f32b34b032615435408f21047b90c19de09f83ef99957681440fdc0c985e079bb196371881b5fdca68a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c4a10f6df4922438ca68ada540730100

SHA1
4c7bfbe3e2358a28bf5b024c4be485fa6773629e

SHA256
f286c908fea67163f02532503b5555a939f894c6f2e683d80679b7e5726a7c02

SHA512
b4d407341989e0bbbe0cdd64f7757bea17f0141a89104301dd7ffe45e7511d3ea27c53306381a29c24df68bdb9677eb8c07d4d88874d86aba41bb6f0ce7a942c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6f48cb897e2d5cf1ec97d4b2f8ee2431

SHA1
61e83fb960f410e49ae58b517da35eb4bb593037

SHA256
700d8496273147f65d773f83ff9978f7cd9ced93211f91cbfe345b40d36cc41b

SHA512
0fc3cf6c32cb60586128479d97a9b1922f1f8362e5cdd774fa04f817b81cd26eba8057473e619e57bc74aa470c8e832361157eb7e44f73d48f0d760c028a3d92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
44e6ab70de55a3e7f4e3420f11d96689

SHA1
cbea70a4ae6e81bcd2bcb97b82731bf28c6fdb15

SHA256
66969bdd8017c7dd878a606037421af008262392ba0a3aa7e20d937ed168f45c

SHA512
4ac9889788de3dcdc148df679cafca34d248683835ba46ff728abc549a0618fde1f11e2a06f6f7e617bf599f4fd9fd7fe5f1fc4d1f13b8a53f5f2b9efd9fbe17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
4441ece94f436dc028ea6b7a45e1cf55

SHA1
8e6be79c17406a9f20544f781d0e688bc8954a4c

SHA256
25f4d810ae94f27a86bce556be75b1b338d6602c932339feb2faadc8d61e4884

SHA512
354bf6e90becc3c732466631dc05d6942ab97c0ddc59e7c51f02fef20e72918a464a5862f71d7f6cc13287725c4fc9220ccc40e42da7b6e675e62aa9b6ef1913

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
e7239839aff3273979a05c29521ee063

SHA1
bbe0019af82bdc6b7083208685410831e6613887

SHA256
f1bcd0aaf477efcfb101f0185e0b97130684c2ce98c0ad00579978e5323d8524

SHA512
582a581dc1cacd8beec7602bd372ea86e0a8a9aff807be1d3b7f445b75e5dadc0a791db30ad0e245bf6973636f1790e22caec7d649a9dbe0b4e440a28b19d686

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
82c016a1b18be2e7cbf84348f288514f

SHA1
734e718b204d85ce2f594eaeabef3e97503c2f8f

SHA256
fcc20e19197d074e69507362719938a18140d0eca55b29b94d60618dc1a4d238

SHA512
c6cc5a465a2f62b7694802f4a8b0fb7242a58b05e4a76fcd86e2e8a574f91d75fb042cbea9ced32a2626241701824d060105b628650f906aebe3ce933266b0c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
f26175787d0bbf90020cef6e99966dd1

SHA1
b668c5fa6f2c301f8ed41fa185d80f0193e46354

SHA256
9a6e354ea299ff9e3b846796eb9a95248754d09a33dc2626ea0d85f44131fa3d

SHA512
dc403bd1541e49c9e0d087cf0469de9d4f3676d8005d6ce65d36a044a58483514ad404abd15a850d62508248dc2bf90ffea9140617f19b97f97ec0ce882d88f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
66faac6b298a7ea1bd6804f8f1b6c953

SHA1
d062996e00ab70dbcf2d922da8da4d459cbc3236

SHA256
37997e1905a83251bbccc13ba1d3f4d1f5f5073a11936fe35b13ff1c12ae9a11

SHA512
927995274c9957a3b80957332a4330980e83115aa525b1a6541402a2c58335aed7ff9a17c1072ed61c4789799319a5d052edc42dd3c1a0852f6e0c6009db0f7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
28KB

MD5
6f63d1c09c6125088f40b3045da462c8

SHA1
e31fd8f0a669114b4b60ec331f1bfb7ee1489a3b

SHA256
ffc0bba44ec337262e74591e56e1ab12e921a723b151c5ef7476dd2a07d5dcb3

SHA512
4538a9b9054cb7b7d26209c4660af7eb5525a9777a3bae42085f5119962b2e6e59b8d47379b30cfa984324535392436cdbddd018eb28006aae492514960950bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
28KB

MD5
115ca0070c7e305c2d57c21c5c3dda75

SHA1
63a0a761f707ea8686477ec1592c5f491139661d

SHA256
40984e014deffe63be1656ca39e7bd7d4de1e689415bdd8fdc91a6a5995d59d5

SHA512
9bd76c473cd737966eccf651b3677caf222b219b41a4b65020054e27249eb0b450d9fcbe3f224f8f56af6c7980f455012d85c5a79b77c01825f5ada3f448d9d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
8935993063e2bb3ec713c8d2c4e0e426

SHA1
0ab001fe5b5ff7b61f4d55bd8a7a61eb4d4eb7b3

SHA256
adce23639fa265a39e973f425ce515b2cffe8cc2e5e4c4a96efb9212eb8766fe

SHA512
39eaa491b226557faac7f66db775e73e67180244078b30f0456c8bbf6191873048d5d6bf2c4b27404617187c82c7a139173a3c5c7723a7a10df6440b70a83b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
28022044f520d79a5b9416b68f73bef2

SHA1
6d8e0ff86b341b185133ea66fe82884ab169deb0

SHA256
a1267e7e33f175f301a770a4dbda7c4aade79ea2b3c5d46b44717ff44339e351

SHA512
f9a0369f80de0ea05dbf007edf62209677bb354591cbd40881b9b8772eef5450e9c4a0b7815ae8f57516fd13d91ec304303befc38aec91f70c30941e21aaa273

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
3KB

MD5
3f1e06cb3f88b18c5135812737f08487

SHA1
ac73d4b74de088eae0ccd36831d37087adeae4dd

SHA256
c848bccd58c66e5fb096575096f44b57e5d36f3853011208b4b6bc8367174d1e

SHA512
ff66e53bc3666254e07f10295551cb0aa823f38e93c3e6ac2cf61eeb62cf644421552e50686d289aa8f1856f718cc49613fef7abb9d04a21f72fc66e4112390f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
16KB

MD5
58752b1df876563a72b9a26281b88662

SHA1
4cde74c98469f526ccb1ad759e4f5cce2e22fea2

SHA256
4da7b412a43a7b2f6d6344e6a9b7425ff7038aafa6ef7c4c8035be2821de8691

SHA512
16fd890360c8a1942b85b969e6146b9d1a87722252b8ea2f96decd4691c0b6cf24ae8b93925bc109dc7aaebecf4d21848fcc41076710ff76f53aa93891ddaac2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
456efafbb9e03fff3bd0ef154ff73458

SHA1
d2df19c4088a97badf24c09c85f10292f0a0e855

SHA256
0403b48bc1fc874df474e21a248b0e9de7a00403f407057d6daa79ecf63ce996

SHA512
bc53f2fc6e505f4a1c013be93376979d2417255e5c279da00b479e704a52d9104bd136cadd7c9e9dd9f4700740083bf5ff0bac96f8435fb2057e2d70fa0ae7b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
796B

MD5
d99c7171b7a21c2c5a57d0c4a86aea96

SHA1
e36fe1e8e1f5167fa135314e396d8d7400b1c0b3

SHA256
a61f090d428f122daf087e17ce0e0ee925fb54fceb07024d8b9c237eb7b0a32c

SHA512
eb220bb1c195bceafd289e8332e0a4a715f203f5d9a4f3058638159c8e1fd60a978bd54a826b90744ea36d2d41e0245221937a0d8d6b4ab7d7ce8081d88122bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb93e2145cb381c432cf43e5c9668343

SHA1
ca93c7ecde892ea0d6a9fc9cc85e98acc8e3089f

SHA256
908e89a0c4300cbb5634194ad97eb955b0962b83180bc0622a721fff8fe5dce8

SHA512
5ae5b20953bc6578071bf81431feb9e2d9a041fc8e1eb13315ca680f576bdf347fb3c2510712ae301aeaf9ac1b5b953588650e04631bb2201eb8a8b67371dcfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bfc483e96482bd6b45b34f16399aa83e

SHA1
e22102520f269b8b7f6bdb10bacc0edd7b5a37d0

SHA256
93013449ba9ba80f381e6cc187952e553c8e9b688ce137ad2150c9849f3b8a95

SHA512
a7d4c26bf27a138771e28c7c8e992cb7a25fa04770449c2081f8b8db8654f59cba7bd115e22a079551e13ffe5b121c709de19dcc0788434c39ef1e069603d37d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eb899bdccf9c3c93dda825e994f90d6b

SHA1
4fde3f4697f4d170c4bb1d90713e1f95b8be7e36

SHA256
401201dcebaa1af21415816367e2728e4cc8414bb549f85b1db1be29b48d725a

SHA512
de0924c109e96a66f54b86566a90fb5727fe7f5c076af40484c44147a64949070d4fd7038f79c0f6b5940efb3d14f9b3fe7ef3de6cf95b11c8a754dfeabbee7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
18044354d8f2995980dd7ad26c65ebf0

SHA1
61824a9c026523d7dca96575cc1025a56aa141a1

SHA256
b90ee374efa936140bff731b22bb162987e5a397e6c243c8fb99080345eb1c01

SHA512
c772cf2e4c00b2da2abaa7bec7bc61d8064f3c267d54f5a6cb33a84717a03da830c8a1c6c97baa9b55e38d2f6b75f5a16c2b267b3e53d6a4aae77ca16cd98f98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0b6d206ea509c20313555e7717f16f7c

SHA1
c3dd14da62d13368bbdeb04cef46f18d2acb219a

SHA256
14bcc996ee3b7d4268e2a0519973a1898d0c3bbe591c5dd5013b2b9ba08712dc

SHA512
f34755c5a4d31f06a4af27abaaab62234ec5b6b3c441bd810753ac874d9ae1ce47cbb58de1a1eed667367a5b3d599c4b2121d36d8ef4ccce872da8bf2666cb0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
24b880482ac788b7741981be41b77ca6

SHA1
1b8c4531bf7ad7e5c5f87696107330d07b24bbad

SHA256
77065e8cbb375c14bfc7152e08d261e8bce76f22718d6d1bc6f097df602c8ebc

SHA512
83f4b8b60a053e8d1e62a928d0c4464b00b901b2c1c8b498dff7cfc6a816ebc0a9f20f299e1af240ca3fe4a7af969f847347a2da0c1dbb49752e28caa53fd1f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
be4d826fc4112841b3718de56dece8c0

SHA1
7a74ae315a01f3e96ea13b538cf6eb84a06690e0

SHA256
9506b69a89f0090331d3162ceb55aac4d121a214aa26108b06566abfd5863f4d

SHA512
5e4f8cafc848759b996a8bc64be50fcd81a6f301a87818a4724a12ed730756e73f7468b36e7ad4a6197c600bc362624b4c865587b8d4d762a713d08b55b14573

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f3e4e92a38842ec8781ddf62505f311c

SHA1
d07553261a88eaaa75b6cd4275c2948391cd0d25

SHA256
8bba83df262b0a868c578710663353b717fce20d6311ea16ddc3da69c4cf5ba4

SHA512
675c68673cc66f77c7cf0557e0d84de70e2989533469b170918b9998fa28f00a70bdccc35ec58350189cf775d637daa24a69139017d4e8dc4bb780def3f0ce15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6c360e8307984c893145ee0d1fe895a7

SHA1
be825a55f07b890d394e90e3273f87d92da261c2

SHA256
90381bb7d238d9405622d2b96eccd03b2bc5c8b3c776584e59526a2a77480257

SHA512
8ff04ad6a78903e6f2ef4b565faf469d4eb5c9d8914d3f5683a2460230ec10cc82e574160d3f69dd94f721f380da77f3ef2f1d84b729bdc019c99654a7cdd17b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000004.log

Filesize
861B

MD5
b958bb466235f6f8968c54a84c62db27

SHA1
fc9eb878e0b0382e65b6fc9c4c276edebdae41b6

SHA256
3dccc214193fefcc9411518ae7cbb0a2043f544f9260e9abe7c7a219e1fa41b0

SHA512
d2d1dd9673c9776327701cbab44f1e3030f6670edcde928e4d5102a34fb2f6b56b77602feb4cf6885b955b18c4743c40a5bc3b186291ad22477fa5e84cbbb6e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000005.ldb

Filesize
480KB

MD5
4307728e6d1deadd199c8027c1050da6

SHA1
117baa8f2ee41f4f30d05a095f98ebb2f638fdb8

SHA256
ddbca276b9dbd3bace0b5953b43cd397803cf0f909de345c0960c9d934b196eb

SHA512
7bf98101b3ca7785f7d1046ce83d53544b030e06ffec9d3e20513086f51c1d4698563f11ee14b204cc9c35bd2cb486bc745f8db4578911feb9a976c10df87695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
480B

MD5
a592564a704a0fe9531e35a581ce8b6f

SHA1
611684359365bedd7d218ec846c9b0c44a608433

SHA256
2fb340da2b6d07786d6fd39ff520ee813d6393f4cb5c5a16d7969a8e319b2d64

SHA512
ac23fb9920fe9c6b28c1c119e4c1603fcc419d570ff3a19622d41f58de408c2baae5b6da47babf65320dc31fa338efa665358eae8ddd02e4904e20baa3d9b093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
98B

MD5
879ff0de2794519aaef3ad9997653457

SHA1
27a744b2aed9aa390d768c2f334db1e407b8e662

SHA256
6e9be74cbba7b599c80f793d84d07e2b376df67f5ab22a2ac5659c6eb1721941

SHA512
3a2f5703f2c875d7ae89b298b251804b61d2e3f5ec437f6dab4f0872746c76a02549179db4a25d357ff051783ddcde9d39432dfe8dbcd0b4ea93413bb0cd1226

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13367746029760729

Filesize
14KB

MD5
134ceb3120935357b094998fc3c07a68

SHA1
d0a05a8aaa5993c22a8757e3876d2974d7634a5f

SHA256
fe7d07f3cd7d9709446d099af0c7b53026c05e440603df4ee2698b257c3e0512

SHA512
4369ab333a3682ed6e0189cb17509d5761576bca1a85d173bd054a30eee45538c3b2e87a32b99d2d9f728453359fcc1ca4f14b871cfa08b8f7871e46cc0a2819

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
184B

MD5
883f5da8053ad571bb8b65e2391cb51b

SHA1
306bf5965396beaac530b8f1e222138fd84e8eaa

SHA256
d3741d847a0d1595899685c56cb22593a3db16ddbaf767af46252bdce139aa9c

SHA512
2cec0178bb6ed71e4478f911d2cb2bc8625fa65927e12141fa72053ad6fe26cebc1f3c2710af6f5a1af7a26ddfb99143b78d709b03b72a71e0f237a0e8eaa5ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
df4da8389f389db1c9de014e56839415

SHA1
82e48283ac90c5fdc8f6272596b17f41e8d56183

SHA256
709aabf9c88afcd275331c2ca9ca4e68d501577f97a52495dbc6c374bb67eb88

SHA512
c265b062c46dfc50f6c0586cf05295d63bf473f4fa3e404bee77618815d35670111f5246c5d730d96ea67751eb37f1e3a9731534889701d77b5ed8b41f1a43fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
dfe826dcaf1f0737269bfda0fbfb2cac

SHA1
9ed672a061886b8de827e6a15c45500ed5adf170

SHA256
381a2579fc199b0fa2a59f731ae717c11839b5502b37c9ab380eb1828f9124fd

SHA512
808869c84c75785f3a49e29a5a056d76f7d35c1350618e84d311b7eb3eb12c1418a2db32e1bbec0a960b732b32981922591b88536d7338db21d46f6c3ce13b78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
04f56083318dbba271fe477b529f4479

SHA1
5eb8d28c860cc221b09bd487928c6e454f27c242

SHA256
ba46abe2572b8a02eb3707d091bd2b958a684d7b1da5027391c4ab629497b600

SHA512
41f6d11438fe3f7e428f945300b5ce0dcdab68304b820e3536d982b2f7470fe92bc1b55886d40a216d3a438c5f1f99192d89a4739039300e551c25f0cdefff67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a2f028df97e2758a1fbc29403441a566

SHA1
6d37d884bcfb610c6c93c0b9bfcf52ff0e6e0d40

SHA256
a08d0273abeca51c4067f82b7c209618c1359cb2d477f5b9ce9650c4440350a6

SHA512
79b081ddae45a7a38664d9f9bfa2898c1dc9291511bb11f255efeb9925381be2f782beb86049083d4e6ebed9d657369a5d73a25f3df649550d45b3230ab1aac5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e36e207349440827a2e342def8fe83ed

SHA1
9af6c2eca5cff0f7b50f092fac40634b5c360e38

SHA256
9cf4a52f65fc0aebe92b3c4d8b98b270e6e09032180353534dbfb14699e8fb38

SHA512
04cebebc67e651600ffdd842148bd041aa7166b7039aa5d06df3c610ad14d60e42d02bfd230db75c8484d1819a51b60f0db74bf07272be74377c19b372049c2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c2a8dba7406ed4ec78cb920123612c8f

SHA1
4270bbcbd0ca3b41016305d73c3440d0679c3434

SHA256
c3f403b66f448b3e30c9c0e71bd98cf91dc2665f58a65d454fafa666767cec6f

SHA512
383a1fa65772512a25307b4f8e7d495a3ebc683759bb7ad2dbdc702ebb7d0ac6436065b7d7720998f40d694c1ffceb9a5cf9e15d9cc84b5adb2ae9a98c18f185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5452933a69768bb7cd3e7cc7e2348399

SHA1
1c9b30297722db5a7ae01a1853a318a35de4919b

SHA256
5a71640bcb0b0c0d70fe56667f4b253876422c8cab929e53a0c804e70c9d4652

SHA512
42ea1631ed59c17411d3411eb3f13cc0ebe2e2a4a88e2bd9877ff08c604274c78b7706ff52aa61d72f4b6104ffc06f2556352e3e0fabcfd76940a4c0803a6da7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5849d5.TMP

Filesize
1KB

MD5
f158ad453630cea00064aa4825572c81

SHA1
7a2b576d526f4537556109191264708c54eaec4f

SHA256
09d0ef2692c863333825034d88e97c7c822ca242671ff33d16ec7b9871629a12

SHA512
9b5f2f205adc1df6a0972f5c58743ac5a3ed2aafc06eb801dbd5a6774ef1c8d9e941e6bed59f59d27390dd2f3b97bb1b0ecb60abe24e3a5276350cd79724f2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
c4e86577ac00cffb59011b7e14389e98

SHA1
fc26ddc57f313c83de2ac861a590a8267d847fa1

SHA256
fcb3da9d79031c97298504a16aa2192194bdf40fd5e56e76ceab7edb3c1b3f4a

SHA512
874f2633dad904a3bc096dd1db05c7ab83904326031283adb103b3fc5817e8891b3384c6e3896b91bbc82baccb50a892b28cbc70dffa44dfaf385fde2d2988b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
112KB

MD5
10954cc4bdbede433c8483437750b627

SHA1
31609553da3623925eb6b2feb852871a3109fc84

SHA256
3e7d4b8f5faf314c1c0fa450c9eaa197aac5c23343768d3f1d485f5059dacaef

SHA512
d89d6413e3a1eff7dd4f7cea476ba149a6f7270a15106458b5e515b4881513919916e8da2d86f490245965595e2735bbe3935c28e7762912348abe5af3e7a294

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
72KB

MD5
b0b877bc749d69c46ebdfa9ef8395339

SHA1
d6256feaf4324f6c891c142cd3583365494e828d

SHA256
5293a35ceba003a97228053b5bdd79c1ca6bf4d3ff3443a0b9ad4276fe8b146a

SHA512
8ef7770b7564e1265690d01638307667f544e1ac381806813a594843ec8d0ae60775eb83b383f587c794f2718302e01734985300dea3f677c5460956d256f008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
4KB

MD5
60e4b8b68163a5d44993476c2bbdde8a

SHA1
f65918d8bd537873318f7d9f22d64c1be1efeab2

SHA256
c521873415261aca83852cd39c512601c20f9a7f83077f13737e301dab2aa8ba

SHA512
5a4b32108c683f3cd9d30c8af14acb05e3585895612dd2f502f2c9b110152bf819df7ccfe74291a8cdf89a8e3c02a2096cefc091d5180724d96c8f5700bbe695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
de2034386ff290ac7a0cd5d8840a6ddb

SHA1
d3b4454d06f77947483da3a7f6f1af6b03a86830

SHA256
dd3793ac546a2c50644c88ed6716929f1847a036dc37017d859ece8fbf25cfbf

SHA512
a62520ca431cdd2ad0074242fc7c95f5356a4af1fe690d965392cc6d3c72f68514e316fc0ac84f64ef96623ac88b858f2327415b1567f226e35305f8d429fb77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
318B

MD5
d5340f27fd619d269b4b3923908a9f31

SHA1
7c3a36bc152889464469e0e7745386dd011af34e

SHA256
fd2bb5374a8436e36ab338a2864b6436b2a640bbbf1ef00f18fbe4513273f080

SHA512
6d863256d415c000a180a15d558f135ab687772c5a8ed62e41cae52c3dd7e4534f4560f836d62983b3ece69e8d327012eeb4a23f684c32c3a7a18f784d20297c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
e6e8a42d24fe56f95779baa1735ca519

SHA1
916d20306b8a584fc01ebb904b0b47eb7426896c

SHA256
4432588182ad8e4ff15adce63b6f79ea0001137617906666e1c44dc23a75cd93

SHA512
e1943c552e4018cf359553c7c894bab5f403dd9ab9c7e7ac0ca86e8a4776b7b537eefcc814e496cc2e8ec3b31484bdd915738fdf7e72de44997bd0f8986ca41d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b92acdebcdc90cb6475b6a6adea1f6ae

SHA1
20387e7b1b711768fc70a7e7249b818f5a9336a8

SHA256
933239db956d5cdf8317d58fcbfe584fe7fc74bb682003ce0b10fd8c394abe6b

SHA512
e46378fe144ee5f708c94827a8db0bde724e447191c7fc01adf18e0d779bcfe87849b39284a2e1d2f501f3947bd83494739c88bad6ee38396977a0df69700b29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
591351943c7a226f6f4841c714147026

SHA1
a6dce91aaf80f0edb966a87df03967cc01c2669d

SHA256
e96b8804583d6e553af14ba348933511099e86611c54980c558cce1a5886c36d

SHA512
b95bc41c6191e1ecfd81819925033a7f3e16a02e71fba9177ec3edbb4e755cda92661d6a4ceb4a39261280aad74443a2453167238dceb4d4a083fa5c2f99a18a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4b0cb3ea4a1bdbe6cb9e705ac3e2d9a7

SHA1
b705086320c2835f92e5a8dea1999a8b933dcda3

SHA256
e4efc03bcbff657fbee3820d99f2b55f55cf562a7f10fa2b4cbe07b221f2e946

SHA512
8a0f5db83562babf83350cd2067720c3bdc86128c108b063752297b09d3a1d00b83903679bc8f1ef5deb59d691a7405398bf3a4ba5307220643e2e0a0859844b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
0f80fb93e93736758ad49447f6543c03

SHA1
0716c499f755badc738cd334f670aaf012d34270

SHA256
9eee2c6d22fd065ea61de943134551314e98b16d38ebcd868c8090cd07e966e2

SHA512
621f7b6e677ee4daabe076b57a76c9e721c04b25c934b0ce5cc45bbb6de93390938bdd69b521f9a65198f73be075bc9b00158defdee9a4084c81304f5e67a4fd

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 290784.crdownload

Filesize
32KB

MD5
eb9324121994e5e41f1738b5af8944b1

SHA1
aa63c521b64602fa9c3a73dadd412fdaf181b690

SHA256
2f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a

SHA512
7f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 994347.crdownload

Filesize
1.0MB

MD5
055d1462f66a350d9886542d4d79bc2b

SHA1
f1086d2f667d807dbb1aa362a7a809ea119f2565

SHA256
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

SHA512
2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

Download Submit
C:\Users\Admin\Downloads\WinNuke.98.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
\??\pipe\LOCAL\crashpad_3448_UTITBMYTWGPEXLSB

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/648-6737-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/648-936-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/648-917-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/34180-12372-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/34180-20015-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/34180-21289-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download