wannacry | 14ebe56a5008e7c251101e9e1fdbe281ab0a82bd6fa00a5cef746b9ee0dd31d1

Resubmissions

11-08-2024 15:50

240811-s931rawdkn 10

11-08-2024 15:49

240811-s9t3vawdjp 3

Analysis

max time kernel
914s
max time network
915s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2024 15:50

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

code.ps1
Size

5B
MD5

1cbfb724ceee46cd879df7c7cfbe7dca
SHA1

4f9cac8dbc4c67a388b8379dcc126c90c7c5e72a
SHA256

14ebe56a5008e7c251101e9e1fdbe281ab0a82bd6fa00a5cef746b9ee0dd31d1
SHA512

e78a5f8359e1bd6c7a33b79c46d26cecdea9a7171644fed23d4ee26730897fc94c5a2493728424ebdc87a1382e83aea7bab5dc12ab851cea930e031e7205df71

Score

10^/10

wannacry defense_evasion discovery evasion execution persistence ransomware trojan worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\WannaCrypt0r (2)\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

msiexec.exeNoEscape.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\winnt32.exe"	NoEscape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe"	msiexec.exe

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

NoEscape.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NoEscape.exe
Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NoEscape.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

NoEscape.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	NoEscape.exe

Drops startup file 2 IoCs

Processes:

[email protected]

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD56E3.tmp	[email protected]
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD56FA.tmp	[email protected]

Executes dropped EXE 2 IoCs

Processes:

fatalerror.exetaskdl.exe

pid process

4856 fatalerror.exe
3528 taskdl.exe

pid	process
4856	fatalerror.exe
3528	taskdl.exe

Loads dropped DLL 64 IoCs

Processes:

[email protected]MsiExec.exeMsiExec.exe[email protected]MsiExec.exeMsiExec.exe[email protected]MsiExec.exeMsiExec.exe[email protected]MsiExec.exeMsiExec.exe

pid	process
1776	[email protected]
1776	[email protected]
3768	MsiExec.exe
3768	MsiExec.exe
3768	MsiExec.exe
3768	MsiExec.exe
3768	MsiExec.exe
3768	MsiExec.exe
3768	MsiExec.exe
3768	MsiExec.exe
3768	MsiExec.exe
3768	MsiExec.exe
432	MsiExec.exe
3768	MsiExec.exe
1776	[email protected]
3768	MsiExec.exe
3648	[email protected]
3648	[email protected]
4352	MsiExec.exe
4352	MsiExec.exe
4352	MsiExec.exe
4352	MsiExec.exe
4352	MsiExec.exe
4352	MsiExec.exe
4352	MsiExec.exe
4352	MsiExec.exe
4352	MsiExec.exe
4352	MsiExec.exe
5812	MsiExec.exe
4352	MsiExec.exe
3648	[email protected]
4352	MsiExec.exe
5804	[email protected]
5804	[email protected]
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
4616	MsiExec.exe
3144	MsiExec.exe
5804	[email protected]
3144	MsiExec.exe
5536	[email protected]
5536	[email protected]
3836	MsiExec.exe
3836	MsiExec.exe
3836	MsiExec.exe
3836	MsiExec.exe
3836	MsiExec.exe
3836	MsiExec.exe
3836	MsiExec.exe
3836	MsiExec.exe
3836	MsiExec.exe
3836	MsiExec.exe
828	MsiExec.exe
3836	MsiExec.exe
5536	[email protected]
3836	MsiExec.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1288 icacls.exe
Blocklisted process makes network request 5 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exe

flow pid process

296 3768 MsiExec.exe
298 4352 MsiExec.exe
299 3144 MsiExec.exe
318 3836 MsiExec.exe
320 3216 MsiExec.exe

pid	process
1288	icacls.exe

flow	pid	process
296	3768	MsiExec.exe
298	4352	MsiExec.exe
299	3144	MsiExec.exe
318	3836	MsiExec.exe
320	3216	MsiExec.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

NoEscape.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	NoEscape.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	NoEscape.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

[email protected]msiexec.exemsiexec.exemsiexec.exe[email protected][email protected][email protected][email protected]msiexec.exemsiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\Z:	[email protected]
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	[email protected]
File opened (read-only)	\??\X:	[email protected]
File opened (read-only)	\??\W:	[email protected]
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	[email protected]
File opened (read-only)	\??\H:	[email protected]
File opened (read-only)	\??\E:	[email protected]
File opened (read-only)	\??\N:	[email protected]
File opened (read-only)	\??\N:	[email protected]
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\T:	[email protected]
File opened (read-only)	\??\O:	[email protected]
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	[email protected]
File opened (read-only)	\??\M:	[email protected]
File opened (read-only)	\??\M:	[email protected]
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	[email protected]
File opened (read-only)	\??\H:	[email protected]
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	[email protected]
File opened (read-only)	\??\U:	[email protected]
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	[email protected]
File opened (read-only)	\??\Y:	[email protected]
File opened (read-only)	\??\L:	[email protected]
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	[email protected]
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	[email protected]
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	[email protected]
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	[email protected]
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	[email protected]
File opened (read-only)	\??\V:	[email protected]
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	[email protected]
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	[email protected]
File opened (read-only)	\??\W:	[email protected]

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

290 raw.githubusercontent.com
291 raw.githubusercontent.com

flow	ioc
290	raw.githubusercontent.com
291	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

NoEscape.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\noescape.png"	NoEscape.exe

Drops file in Program Files directory 4 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe	msiexec.exe
File created	C:\Program Files (x86)\Windows\Error file remover\Windows Logoff Sound.wav	msiexec.exe
File opened for modification	C:\Program Files (x86)\Windows\Error file remover\Windows Logoff Sound.wav	msiexec.exe
File opened for modification	C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe	msiexec.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exeMsiExec.exeMsiExec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI497.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI597.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB355.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3E7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF250.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5eb0ce.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBDC7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5eb0d3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI711.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3D6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA48.tmp	msiexec.exe
File created	C:\Windows\Installer\e5eb0c9.msi	msiexec.exe
File created	C:\Windows\Installer\e5eb0ce.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBE97.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB315.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC8CA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA49.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBE56.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4C7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF42B.tmp	msiexec.exe
File opened for modification	C:\Windows\Tasks\sys.job	MsiExec.exe
File created	C:\Windows\Installer\e5eb0c0.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB426.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC93A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA09.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF36E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICAD9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICB67.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF1A0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB385.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3C4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF2DF.tmp	msiexec.exe
File opened for modification	C:\Windows\Tasks\sys.job	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIBED7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBF67.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5eb0c0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC9AA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF4A9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBE76.tmp	msiexec.exe
File created	C:\Windows\Installer\e5eb0d3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI576.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4F6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB297.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB4E4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5eb0c4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC99A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF160.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBF27.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF28F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC092.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C452D4E2-DE24-48B6-B5C3-ACB240A01606}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3C5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB485.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICCA0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF200.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB12D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB1CA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC90A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBE07.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBE87.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

1404 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.execscript.exemsiexec.exetaskdl.exemsiexec.exefatalerror.exe[email protected]msiexec.exe[email protected]attrib.exe[email protected][email protected]MsiExec.exeNoEscape.exeMsiExec.exeNoEscape.exeNoEscape.exeMsiExec.exeMsiExec.exeMsiExec.exeicacls.exeMsiExec.exeMsiExec.exeMsiExec.exeattrib.exemsiexec.exeMsiExec.exeMsiExec.exe[email protected]msiexec.exe[email protected]

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fatalerror.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoEscape.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoEscape.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoEscape.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

fatalerror.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\IESettingSync	fatalerror.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	fatalerror.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	fatalerror.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	fatalerror.exe

Modifies data under HKEY_USERS 26 IoCs

Processes:

LogonUI.exemsiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "182"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{EE4E3C09-DCBA-4431-9309-EF4CACD24E5A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

Processes:

powershell.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsiexec.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	process
1404	powershell.exe
1404	powershell.exe
4348	msedge.exe
4348	msedge.exe
4776	msedge.exe
4776	msedge.exe
4184	identity_helper.exe
4184	identity_helper.exe
3500	msedge.exe
3500	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
5768	msedge.exe
5768	msedge.exe
5844	msiexec.exe
5844	msiexec.exe
5844	msiexec.exe
5844	msiexec.exe
5844	msiexec.exe
5844	msiexec.exe
1732	msedge.exe
1732	msedge.exe
1484	msedge.exe
1484	msedge.exe
5736	msedge.exe
3216	msedge.exe
5736	msedge.exe
3216	msedge.exe
5304	msedge.exe
5304	msedge.exe
5844	msiexec.exe
5844	msiexec.exe
5844	msiexec.exe
5844	msiexec.exe
3824	msedge.exe
3824	msedge.exe
4812	msedge.exe
6036	msedge.exe
4812	msedge.exe
6036	msedge.exe
3656	msedge.exe
3656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 44 IoCs

Processes:

msedge.exe

pid	process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exemsiexec.exe[email protected]msiexec.exe

description	pid	process
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeSecurityPrivilege	5844	msiexec.exe
Token: SeCreateTokenPrivilege	1776	[email protected]
Token: SeAssignPrimaryTokenPrivilege	1776	[email protected]
Token: SeLockMemoryPrivilege	1776	[email protected]
Token: SeIncreaseQuotaPrivilege	1776	[email protected]
Token: SeMachineAccountPrivilege	1776	[email protected]
Token: SeTcbPrivilege	1776	[email protected]
Token: SeSecurityPrivilege	1776	[email protected]
Token: SeTakeOwnershipPrivilege	1776	[email protected]
Token: SeLoadDriverPrivilege	1776	[email protected]
Token: SeSystemProfilePrivilege	1776	[email protected]
Token: SeSystemtimePrivilege	1776	[email protected]
Token: SeProfSingleProcessPrivilege	1776	[email protected]
Token: SeIncBasePriorityPrivilege	1776	[email protected]
Token: SeCreatePagefilePrivilege	1776	[email protected]
Token: SeCreatePermanentPrivilege	1776	[email protected]
Token: SeBackupPrivilege	1776	[email protected]
Token: SeRestorePrivilege	1776	[email protected]
Token: SeShutdownPrivilege	1776	[email protected]
Token: SeDebugPrivilege	1776	[email protected]
Token: SeAuditPrivilege	1776	[email protected]
Token: SeSystemEnvironmentPrivilege	1776	[email protected]
Token: SeChangeNotifyPrivilege	1776	[email protected]
Token: SeRemoteShutdownPrivilege	1776	[email protected]
Token: SeUndockPrivilege	1776	[email protected]
Token: SeSyncAgentPrivilege	1776	[email protected]
Token: SeEnableDelegationPrivilege	1776	[email protected]
Token: SeManageVolumePrivilege	1776	[email protected]
Token: SeImpersonatePrivilege	1776	[email protected]
Token: SeCreateGlobalPrivilege	1776	[email protected]
Token: SeShutdownPrivilege	5280	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5280	msiexec.exe
Token: SeCreateTokenPrivilege	5280	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5280	msiexec.exe
Token: SeLockMemoryPrivilege	5280	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5280	msiexec.exe
Token: SeMachineAccountPrivilege	5280	msiexec.exe
Token: SeTcbPrivilege	5280	msiexec.exe
Token: SeSecurityPrivilege	5280	msiexec.exe
Token: SeTakeOwnershipPrivilege	5280	msiexec.exe
Token: SeLoadDriverPrivilege	5280	msiexec.exe
Token: SeSystemProfilePrivilege	5280	msiexec.exe
Token: SeSystemtimePrivilege	5280	msiexec.exe
Token: SeProfSingleProcessPrivilege	5280	msiexec.exe
Token: SeIncBasePriorityPrivilege	5280	msiexec.exe
Token: SeCreatePagefilePrivilege	5280	msiexec.exe
Token: SeCreatePermanentPrivilege	5280	msiexec.exe
Token: SeBackupPrivilege	5280	msiexec.exe
Token: SeRestorePrivilege	5280	msiexec.exe
Token: SeShutdownPrivilege	5280	msiexec.exe
Token: SeDebugPrivilege	5280	msiexec.exe
Token: SeAuditPrivilege	5280	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5280	msiexec.exe
Token: SeChangeNotifyPrivilege	5280	msiexec.exe
Token: SeRemoteShutdownPrivilege	5280	msiexec.exe
Token: SeUndockPrivilege	5280	msiexec.exe
Token: SeSyncAgentPrivilege	5280	msiexec.exe
Token: SeEnableDelegationPrivilege	5280	msiexec.exe
Token: SeManageVolumePrivilege	5280	msiexec.exe
Token: SeImpersonatePrivilege	5280	msiexec.exe
Token: SeCreateGlobalPrivilege	5280	msiexec.exe
Token: SeRestorePrivilege	5844	msiexec.exe
Token: SeTakeOwnershipPrivilege	5844	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

Processes:

msedge.exe

pid	process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

fatalerror.exeLogonUI.exe

pid process

4856 fatalerror.exe
4856 fatalerror.exe
4856 fatalerror.exe
4844 LogonUI.exe

pid	process
4856	fatalerror.exe
4856	fatalerror.exe
4856	fatalerror.exe
4844	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4776 wrote to memory of 908	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 908	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 3580	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 4348	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 4348	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 4528	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 4528	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 4528	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 4528	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 4528	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 4528	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 4528	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 4528	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 4528	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 4528	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 4528	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 4528	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 4528	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 4528	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 4528	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 4528	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 4528	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 4528	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 4528	4776	msedge.exe	msedge.exe
PID 4776 wrote to memory of 4528	4776	msedge.exe	msedge.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

1296 attrib.exe
6092 attrib.exe

pid	process
1296	attrib.exe
6092	attrib.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\code.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffed3fb46f8,0x7ffed3fb4708,0x7ffed3fb4718
2⤵
PID:908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
2⤵
PID:3580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
2⤵
PID:4528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
2⤵
PID:2716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
2⤵
PID:3124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
2⤵
PID:3984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
2⤵
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3792 /prefetch:8
2⤵
PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3792 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
2⤵
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
2⤵
PID:2660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
2⤵
PID:392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
2⤵
PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
2⤵
PID:4012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5728 /prefetch:8
2⤵
PID:1944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5752 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
2⤵
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
2⤵
PID:5228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
2⤵
PID:5240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
2⤵
PID:5484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
2⤵
PID:5752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2792 /prefetch:1
2⤵
PID:5872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4952 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
2⤵
PID:1220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
2⤵
PID:5772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
2⤵
PID:1556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
2⤵
PID:5488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
2⤵
PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4264 /prefetch:1
2⤵
PID:6008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
2⤵
PID:5756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
2⤵
PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1
2⤵
PID:5796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
2⤵
PID:5628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1348 /prefetch:1
2⤵
PID:5312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
2⤵
PID:5352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1076 /prefetch:1
2⤵
PID:5364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
2⤵
PID:2936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
2⤵
PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
2⤵
PID:1808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:1
2⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
2⤵
PID:6060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
2⤵
PID:6056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
2⤵
PID:2900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
2⤵
PID:5224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5336 /prefetch:8
2⤵
PID:5340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6516 /prefetch:8
2⤵
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
2⤵
PID:4864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2672 /prefetch:1
2⤵
PID:4004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7284 /prefetch:1
2⤵
PID:228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1328 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1628 /prefetch:1
2⤵
PID:1828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
2⤵
PID:3756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7332 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7516 /prefetch:1
2⤵
PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7532 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7440 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7568 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7308 /prefetch:1
2⤵
PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7512 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7320 /prefetch:1
2⤵
PID:5944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6340 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,452975230793320150,17678140564216903830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3044

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c8 0x2f4
1⤵
PID:5868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5184

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3472

C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod\[email protected]
"C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod\[email protected]"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1776

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod\[email protected] SETUPEXEDIR=C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5280

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5844

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 7EC3A0D11DF9AEA48A39F3BF1F55905A
2⤵
- Loads dropped DLL
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:3768

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 02552A1F8EFC9EC5235E48A0A62B6E96 E Global\MSI0000
2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:432

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 13C3D83176135AB69D216EA6CF229581
2⤵
- Loads dropped DLL
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:4352

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding B48B61B9F0F59DBF615A453235362FB2 E Global\MSI0000
2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5812

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 3FE0272CD39A85DCAD3894446EAF9ACC
2⤵
- Loads dropped DLL
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:3144

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 1E390536F57A4FFC0CD7EC09B89BAFB4 E Global\MSI0000
2⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4616

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 81C3E3A847746B86AC42A02E68A0CEF4
2⤵
- Loads dropped DLL
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:3836

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 8EF4622E8C8025A996FA838875DCBAC2 E Global\MSI0000
2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:828

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding E914C78D2859EFCB3D79E65967924AC9
2⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:3216

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 6800634615267C6194028B7E4CB71847 E Global\MSI0000
2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:556

C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod\[email protected]
"C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod\[email protected]"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:3648

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod\[email protected] SETUPEXEDIR=C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:2136

C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod\[email protected]
"C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod\[email protected]"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:5804

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod\[email protected] SETUPEXEDIR=C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:2576

C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe
"C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4856

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c8 0x2f4
1⤵
PID:808

C:\Users\Admin\AppData\Local\Temp\Temp1_NoEscape.zip\NoEscape.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_NoEscape.zip\NoEscape.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5180

C:\Users\Admin\AppData\Local\Temp\Temp1_NoEscape.zip\NoEscape.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_NoEscape.zip\NoEscape.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4208

C:\Users\Admin\AppData\Local\Temp\Temp1_NoEscape.zip\NoEscape.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_NoEscape.zip\NoEscape.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
PID:2852

C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod.zip\[email protected]"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:5536

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod.zip\[email protected] SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod.zip\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:1748

C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod.zip\[email protected]"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:3872

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod.zip\[email protected] SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod.zip\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:5376

C:\Users\Admin\Downloads\WannaCrypt0r (2)\[email protected]
"C:\Users\Admin\Downloads\WannaCrypt0r (2)\[email protected]"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4112

C:\Windows\SysWOW64\attrib.exe
attrib +h .
2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:6092

C:\Windows\SysWOW64\icacls.exe
icacls . /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:1288

C:\Users\Admin\Downloads\WannaCrypt0r (2)\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3528

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 48421723392329.bat
2⤵
- System Location Discovery: System Language Discovery
PID:960

C:\Windows\SysWOW64\cscript.exe
cscript.exe //nologo m.vbs
3⤵
- System Location Discovery: System Language Discovery
PID:1548

C:\Windows\SysWOW64\attrib.exe
attrib +h +s F:\$RECYCLE
2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1296

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa388f055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5eb0c3.rbs

Filesize
100KB

MD5
74f5c5bb4a4d42eed640dad2ebca78a4

SHA1
803ad010321a7780cc46e8a1daa7343ebee1d2fe

SHA256
b36e84dedae59d2048e4a2c90da11f94813d76dee69914e7440322e6c83474b2

SHA512
55d48c08cb17d2ec103b98462be598a32f54d81df259352394750d8f715b6ad8c6269cda9e6b64c689f4a8f987ca011a9a37485545defa757966c073bab7a3ec

Download Submit
C:\Config.Msi\e5eb0c7.rbs

Filesize
101KB

MD5
1c3537ae010b967e10716a72c6fc5dc5

SHA1
08cbe2eaefb5ac397eb7f17587c314e1d7339537

SHA256
703b7aee66c80c7e34906dfa6b6fcde7220cbe2a933495013c53a1782761e299

SHA512
1b77dce5f27fd13807b1a3a898d9883589684ee4edec0e45b65a9388274fcab41ff2e0bf072eb106f81109c6386ef44faf0572c0c9deb22a33b3eb77fe2c5120

Download Submit
C:\Config.Msi\e5eb0cc.rbs

Filesize
101KB

MD5
6ef58177d7d8e17b53b049934ab86f05

SHA1
dd20d12143bc26f6db0bf98bc245a568bcd4230f

SHA256
95f5bc51e52c42a60be11daaffbb35bc32d6d002b990ebd5635c82c73057825f

SHA512
cd964aae886a32206fc381343afee16ea93cbd24ee7549f58206c43deb5831e25118e55175d89d7abe1167a687f142ea8048b0eceab20e91660ffec6515c541c

Download Submit
C:\Config.Msi\e5eb0d1.rbs

Filesize
101KB

MD5
b52c77260a2a0fa1fa1e764e8f9e3720

SHA1
69fc2a946808b3222f4743784ccc99ddf190004d

SHA256
63ea158e22781bd5b0c46ca8f2c49fd64b1f484dd498bef028448bfc6e7c5138

SHA512
e8b2e42c9e026a828b8c1cd50650682519cd326d7911c4adfb583ee3000593285fc7958d9a939ee8bc83a07d851253b8aad9cd437978eb64c758573fa8477703

Download Submit
C:\Config.Msi\e5eb0d6.rbs

Filesize
101KB

MD5
da8a35685079bdf7994c0ee08c5204db

SHA1
f07bcaac4fdc76c2b862e1819a71d324a5eb93f2

SHA256
cdb169811029bfafb0f2e9bec3def065dec96b9c1568af8a0fdb93c88dc7c5b2

SHA512
8eff364d4725b659802541b9d143edfb0a2e831513e2dca7c52b18d32be9edc8571fa50ecbcb1dc5675e9b1d08060ea76e4bc4b2763c527b851869d3daeef6ab

Download Submit
C:\Program Files (x86)\Windows\Error file remover\Windows Logoff Sound.wav

Filesize
724KB

MD5
bab1293f4cf987216af8051acddaf97f

SHA1
00abe5cfb050b4276c3dd2426e883cd9e1cde683

SHA256
bc26b1b97eeb45995bbd5f854db19f994cce1bb9ac9fb625eb207302dccdf344

SHA512
3b44371756f069be4f70113a09761a855d80e96c23c8cd76d0c19a43e93d1a159af079ba5189b88b5ee2c093099a02b00ea4dc20a498c9c0c2df7dc95e5ddd49

Download Submit
C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe

Filesize
24KB

MD5
e579c5b3c386262e3dd4150eb2b13898

SHA1
5ab7b37956511ea618bf8552abc88f8e652827d3

SHA256
e9573a3041e5a45ed8133576d199eb8d12f8922bbe47d194fef9ac166a96b9e2

SHA512
9cf947bad87a701f0e0ad970681767e64b7588089cd9064c72bf24ba6ca0a922988f95b141b29a68ae0e0097f03a66d9b25b9d52197ff71f6e369cde0438e0bb

Download Submit
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\@[email protected]

Filesize
708B

MD5
dfb4357a8fc9559c8d2332c2ada62784

SHA1
db961f706055df2c95b61d61092a3e9d3e051c03

SHA256
9f56152c8dc91075dcd168a9bc297cf57d2a517b0f72a5927229c5c464765a20

SHA512
dbb8111c4dab24b21097645ba8d903e1eecfbf250816b7e17114983d059a8eeacf8d181104a95f3d211bb4357f6d8eac118bb3f3dea5d23f827aa640676bd085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\839dc3b9-c327-4617-8cbf-5cf021735ad4.tmp

Filesize
2KB

MD5
f96b39e121853ad23ecc62e9a57ddfa8

SHA1
c74e400a4fe2ef87639eee204020cd1e58e2ce57

SHA256
0c9050a535551b4005087fbae166122af5bbe0e51f130b2b6c11931773a7a8a7

SHA512
a52f4712cef0bb51474387fd09d273abeaeecfbfaeecbdb0ceccbb800436c2d55eca445387d7ac71ea71666a6b95acead93375427d466b02801c5c761873e46d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
150KB

MD5
39b677306b758e912a3798d21ce5b61e

SHA1
10ddf8adb9d5b61baae771816f03a26e73999c13

SHA256
cd28ecf9754413a90de83871cc28290f02b39802e3ab2fe624afff4ec9aac5df

SHA512
e7a45085d005a113d5b40085ee09738774f8eae98d24232e5a99bfe2494e1f84840ed5f170c44a65bb762a64f51745d6837182b54510462e1ef5e147e27647d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
67KB

MD5
a074f116c725add93a8a828fbdbbd56c

SHA1
88ca00a085140baeae0fd3072635afe3f841d88f

SHA256
4cdcda7d8363be5bc824064259780779e7c046d56399c8a191106f55ce2ed8a6

SHA512
43ed55cda35bde93fc93c408908ab126e512c45611a994d7f4e5c85d4f2d90d573066082cb7b8dffce6a24a1f96cd534586646719b214ac7874132163faa5f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
41KB

MD5
a7ee007fb008c17e73216d0d69e254e8

SHA1
160d970e6a8271b0907c50268146a28b5918c05e

SHA256
414024b478738b35312a098bc7f911300b14396d34718f78886b5942d9afe346

SHA512
669bec67d3fc1932a921dd683e6acfdf462b9063e1726770bae8740d83503a799c2e30030f2aca7ec96df0bfd6d8b7f999f8296ee156533302161eb7c9747602

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
1.2MB

MD5
9f8f80ca4d9435d66dd761fbb0753642

SHA1
5f187d02303fd9044b9e7c74e0c02fe8e6a646b7

SHA256
ab481b8b19b3336deda1b9ad4680cce4958152c9f9daa60c7bd8eb6786887359

SHA512
9c0de8e5bf16f096bf781189d813eeb52c3c8ec73fc791de10a8781e9942de06ed30ff5021ab7385c98686330049e3e610adc3e484e12ef807eec58607cfae63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
43KB

MD5
209af4da7e0c3b2a6471a968ba1fc992

SHA1
2240c2da3eba4f30b0c3ef2205ce7848ecff9e3f

SHA256
ecc145203f1c562cae7b733a807e9333c51d75726905a3af898154f3cefc9403

SHA512
09201e377e80a3d03616ff394d836c85712f39b65a3138924d62a1f3ede3eac192f1345761c012b0045393c501d48b5a774aeda7ab5d687e1d7971440dc1fc35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
74KB

MD5
b07f576446fc2d6b9923828d656cadff

SHA1
35b2a39b66c3de60e7ec273bdf5e71a7c1f4b103

SHA256
d261915939a3b9c6e9b877d3a71a3783ed5504d3492ef3f64e0cb508fee59496

SHA512
7358cbb9ddd472a97240bd43e9cc4f659ff0f24bf7c2b39c608f8d4832da001a95e21764160c8c66efd107c55ff1666a48ecc1ad4a0d72f995c0301325e1b1df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
27KB

MD5
c3bd38af3c74a1efb0a240bf69a7c700

SHA1
7e4b80264179518c362bef5aa3d3a0eab00edccd

SHA256
1151160e75f88cbc8fe3ada9125cc2822abc1386c0eab7a1d5465cfd004522c8

SHA512
41a2852c8a38700cf4b38697f3a6cde3216c50b7ed23d80e16dea7f5700e074f08a52a10ba48d17111bb164c0a613732548fe65648658b52db882cacb87b9e8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
95KB

MD5
9a82dccecb55a06d1b8659ff5e468771

SHA1
7def841171123538b665a8e689128a36c854963b

SHA256
61d051901a5e0ae910e4da2ba95a29772d75da55fe95b53354058340d8163778

SHA512
e894645ddc6853a8b1c1645afbb4d024c4b0c1ef8b68496c68725f823740aa8ae103d30b1eae0899c592271903f522520323a5d6a8c2f0b54b1abaa1391bd73c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
210KB

MD5
48d2860dd3168b6f06a4f27c6791bcaa

SHA1
f5f803efed91cd45a36c3d6acdffaaf0e863bf8c

SHA256
04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77

SHA512
172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
17KB

MD5
2ae94234d746035f77061341ab2fe9dc

SHA1
5b0fff50308d52bb29c0d5667a68aa549f74ad8d

SHA256
8aa3563678d5dc4db090cb1e4a72575835a22a7d5203a04785f5e86056ebfc72

SHA512
89735c0b0f1d3f62693caa151b29e0bf90d101c84d180365bee97efdc426528bfb590faf533b1d18ef2179b62d69867e904e88a0b358c7d5e55f632419deb81f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039

Filesize
18KB

MD5
14b3067513e9e2f774bd7fb924d8cbcf

SHA1
c58b33c75104fbca518c5f3988134b4bbcefff26

SHA256
aaf6160472406701ee4dc5e232d0f1e7b1f54ecc8f37a6067a4685169daa2ab9

SHA512
7bb8b9c09a0fea34597fa89612de78ce46e5059a0d6195ecc90d57c2171df52b19b6135a4542b6d6692f9dc289678ee6218ce638cca0662147548c7b9fbd8c64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000070

Filesize
132KB

MD5
6a47990541c573d44444f9ad5aa61774

SHA1
f230fff199a57a07a972e2ee7169bc074d9e0cd5

SHA256
b161c762c5894d820cc10d9027f2404a6fec3bc9f8fd84d23ff1daef98493115

SHA512
fe8a4fd268106817efc0222c94cb26ad4ae0a39f99aacaa86880b8a2caa83767ffe8a3dd5b0cdcc38b61f1b4d0196064856bd0191b9c2d7a8d8297c864a7716d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\54621936eea23565_0

Filesize
7KB

MD5
bc361183149492d70b2c822e5209b78f

SHA1
8ca18e6458b5a66256702483b3173fd6030016a2

SHA256
85cb68a216637daa8a28e4a1bb1a267118c889063d38c9a08722fa52e568f1b8

SHA512
df291d7a26cdacb414dee9a00e627ce6b00313ac76fa66eaaafbd55456f15bf7694fe3c7b9fe5b6210ef384ed3f6b6d358d079dc04cadd6600e8e6e07edafc5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5b2f11f3f15a5775_0

Filesize
3KB

MD5
1cddeede98f20c2e0c88044e97bf62f2

SHA1
f63168d5a0ce1d032c656a4980a60dedac12a4d8

SHA256
ea22d40cf7bee14fd0e0e8ed1d8423ce2ce7cc0f804f2ceb790fd6cfe65930c2

SHA512
6151d2972ce1f975cef79ae0e81715ecbe987662e560fd8baeb78619ec58e486cd859ce7fc7797119100d58496c4c1b85f3e6ce84d0a60df9b487cfc56f64568

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cef73a77715e237d3e94354abe228e51

SHA1
9ba974520891d9e7ecd6cb3944ca491781b6d6ac

SHA256
58c701f3e78fdf6855eb608444c75ecc23f19a35dd04021c246021103de9f176

SHA512
9d3e4e8a46fcb79443b20b9632476dfa39d6f9c58e15a76daedba4feb8045fd8584368ef0222e435d2460563948d6a6d2d17f3b095bae7db894b9dc94b0a41f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d0e11095410767aff023fa1a7aab0e0a

SHA1
a991f48ed1f33741eab31a0f932e78c6adc85afe

SHA256
90c4551930d51e0b8d026cc2343c57797806c1a0bf1ce6efd858b48484bee41f

SHA512
7cfe9e3379fa156741bc3750e09922cd7b731cc2c1bd6dc8c3cb4171dd734382ebbc981623b8e91190306a29e9e65a9de8344416083fc007c0fc77592426ff48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
e56a3321d2a81eaf557e74109e663e73

SHA1
1af1d69f30217dc772f4736b00a2836f43a187a0

SHA256
3d399a96be8749033c2ebc0d029c39c9a8c1ac99b0c192fed789fbeb08c10a9e

SHA512
c1d43ab0d33fece2bdd5df53bcdc75c4016a015dcc8c85291203fdab0b57287279dfef69dc2ce4cda425e03300d33c1145a79a0e2ec6f18143025cf77795d80d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
b4caa1f23d9511403e07793774bb475b

SHA1
e307203642ca52e8a37d07b3d7244b3e395e16d7

SHA256
7d04969dd6edeca33060b5167ace45222879b7a1f809b1bb96218ff7ed7dcb64

SHA512
5e1c60ce7d7f7e5e0bd29a933c05914ed8c145ca20c0370b424a659f4d7eeb5e8a914ced40b911d7bfd5963d638fa97e9a8d8b8e6196bf2d3f38a5c800a43e5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a1dcc15b566cf1b826ab42d3296716fb

SHA1
4640f5070738c6a22e59873aad7796311722c17a

SHA256
f2199e054b0b2fb871bdaf64ea42b89a815f02c8c5a2e8eddb1bd30ec417a1d8

SHA512
0c55ad39368b9c4b2ee4d58f11092b676db6122ade97310324ef7a4fc5cb138ede191a3a5fd4dd59c77776f2884ccb6ff2160e28c6e03e471bbc56093fa9acc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
12d9db326b0ab0bb15be315e07991f83

SHA1
3ba11b38bca0c0d590dc11607f05fdfcc2dc8119

SHA256
cad8b8dc3c873377065c4108e768d05befe308905127b28651ccef40724dc72d

SHA512
82dc7d699d806b0c7c0b9fb1d24335ba90e166da8f8b71bfb9d57e264863b81ac757f298149b50f5e76b23f7d9049a875402c0522f203d4d6bb2c180264e4518

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ed9fe3cfc4d0cf7481cd0d5e3a217632

SHA1
e643c8facd9f64727cd024a6f8bb8e0b28323e61

SHA256
8d084fab611fcde67c8b01c0b1d6c9b85e6e0f92720db21fb6e5d4277b3f12ba

SHA512
822ab155aa1e258a5c844666aac2da87145811b12a8fc6855443a600d126a076a586d0237a01e56310cd3133a9dcb8bd659449c2fe3dd19351211434722a09bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
7324938b595b58ca473e41b91b494f90

SHA1
d010653e2d920dfbf401cee4b67da5b1e0caa532

SHA256
ee73fb5b234ae5d9af144bf32c636e689b6c9fbced999e125a59d6c26366201f

SHA512
fd666cadfc8829ed13ef6304738dca179a783456407634cf0deffc5bfa563797793192869b7ae69a406fa85b338ae63ef22af597dd03bc260f16ed03bfa43d60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
c9dcf6ed1f0bc9dbfa438884135009ca

SHA1
413c26f3fb770f1853a52747b6f809d0db796326

SHA256
e483781731250556f57c8bb363d145de7daabae1c1b2d149329b431f63f9ac51

SHA512
311e58d4c9f279eafaf3148321032a4e4e9f5db416d6dbf3d6a286e6aca504cd8d72bee8d52e1c56ce8f3e20fdb1390422125914435c2d329abf27ac6d6aed42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dbee3d5ea9aee2ce6c59bb72583a1547

SHA1
88a50b890fd49067d26c61ec9a3506cf5fe93297

SHA256
70bfcdac4c90e28904b3f5f42a8614ed5d36ab9b14b923bdae4aee61be001a90

SHA512
47e4f64f3e3477890d87eec5d5d3f1142dda567afb23305618cb5f5e8e52b55e5b384532796ffc0831ee4cc269d14143ed9965b40a7ce81c1ca973e5f914d36b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6eff69b526930583150262749677fb9e

SHA1
0664d7c960a2a8a326baacbe7bfbffc8abeb06a0

SHA256
329bf2cf0f16e8c965ad63581a0cd32ba12592376147c0ff6ba13ca34d0fddea

SHA512
9fee0eee34a981c474dabc3489fd28a62de510fed87bd5d1d0856109bc4b72c5c4ee956a71a87aed8485644adad5af36ebbfc5765ba5195d78bcfca90958842f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c855a1ffaf60d8e6b557649589b5cd5a

SHA1
bdce5c7e482fc04c2931beca5f7e1a398344b07a

SHA256
9d4b395864545443ff72c54c32c4432c2e2af1ef911b9773ae582da995fae3e9

SHA512
ba85a1ea2769cb4a1ecc406b405a3bd793a0fe2a2f0745d97b8144e5dd3055703dbab089cd6995acaa1d8244f552303e450974a060a133b254fbd8b998410203

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
675be4fa03cb2b8df95e327f44e71eac

SHA1
a22997cbf93331c7f8e517d0eba4e5c400429c13

SHA256
50b26db6d1e15dc73090f85f00ed8cb1fa0b080b7abc5f829d3da41fb0b4365d

SHA512
b0919bffac5be5988457662dd8e55552b2312be11524cfff92dd0b804097c76f152a9dbedaaefc4943ca1cfb5f8791189f2281dc0fe210ae57be9aaf07d7de26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6c25cc18445d3afe05c77909d2aa09ad

SHA1
45df13fc45bf3c5686e2be62fe00ad39ec341d7e

SHA256
e94111cb59b327b617e406a9e0a293c20a8cd47510fd2335c9924e2fc8e0e8bb

SHA512
04adac1bee5eec3269ead7501c158ec66ebae2fc2a59e1d61611c572af8ea16675a84a179c3e7f93426e2ccb24fe79f8ecf103476fd38d9d53b9d74a0f5a324f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e10d05819cbf382f13f6cd7cbde5c456

SHA1
95b6b2a619c5e3b80b8d6218d02b78013e1f1a73

SHA256
7d4a5bb7733632a1c2146bee9f0f09db8221a0d9c4e3944c8d531f742eb0967c

SHA512
02776cbc24f60d13d59b4206d8bb9c9e98548694fa04fc57590233737571965406cbc23e75fa9b7babc03ab19d58db8d61816711312165264e3c969e674f1737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
87b180cf26bd4ba29485c7d3899af5d2

SHA1
b5039d5348fb49a09443d7e0580e4061f4bf4ce1

SHA256
62dc2ca6228188842f78c10f23ddc4c580da63bd8a071e6b253c339f4a709e0a

SHA512
5b09c9c55edf01df0ef6c4f04e0a7e71e3417f08ce0a1aaa3758e91795dfe2633c62540e48546f84299418d73bd1868579977bd9786c893d8b30bbe88da25834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
65f3edd1d9dbc3278398260427fe5599

SHA1
bbc5cfd87fd00af0733db3724cb250eaba7d1b7f

SHA256
cb1b8d3a5bf172083c6b85b901234c9b8f0fbb64e7788c0b39eee0afeb9625db

SHA512
524c591a480a2b99ad419a091a66f12fd03592257778b52c9d66cec36407f83bb6b5bf62058a6582d8851be3d2f9d67ac57a2f78a749594ce63182b3e8861bf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
87c5aa267a8ab6cd56e88ef7de85d69b

SHA1
dcaaa2ae340b109d02ecae012a9961a19059d882

SHA256
4e15e0ab9779045ee23e1c94eaa0cf1e26b9bbe5dc6a224f3a7cbc96e7366016

SHA512
831f90c73b80ce15eaeec565cb819c2517e5e7f49c2d6917374c5b07f35d84b4e60fcf50cd7e5ec69483e0c0795de4272860d78c36c7e68c6c49342884989b36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c781c125b14f4ff9931f84f028b7c8eb

SHA1
7e8ee43ff684d0b8244fb42f7900e53c8d1f430f

SHA256
e4a8300795e2af506f855923de1a538030fe8c747c5ca98a32139e406f7e409b

SHA512
44b8986465cf28610000d64407367b1ad8bde8b88f31b95e79fd6c30589148974072633cbd7346eadd868fc35064d0281a2ad886a5ce4a12cf60544f1fcaa24f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
178c9225c6f9142160a3aec81db4b333

SHA1
404e9124f6348077926dc2c5e24d0b28e7df9901

SHA256
e3bf040692d7632eb198fcb5ae59cc78f142f2055f6788823e6b5851b4b02f11

SHA512
7e2f5faec4797b5d2b0c981ee1398472399d63d114060a0fcc06b0e2ecb7db888ab86ce6738a36bcce0d39c7a636e07600e8e1621abc12178f32d43af581a392

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6912f54e31412f3a25d00e0444c11efe

SHA1
55ed14cd9b8d3a346c8303b490c89a88cc72d7e3

SHA256
d6ba05e4e575f5302a9c858072aa0b9e58a68bf67d6b2d909851e39f97f556af

SHA512
eb41f00e61c104fb62c6c273cfc4d444fc2d17496d17f9bc8a7a85e4ca3118d38a46f791a320d3c0785a392615d988b27808d03b63e4d5f782678284226cc30b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
dcc9c1f95165764ed1571d38b3ec3e68

SHA1
2c9518273d3e987e4a8aff2712c308e85e15cf51

SHA256
3241e06520e16cb6e012037f025c7ec67dd80144d2ec297da8ff16553c1ee5a1

SHA512
6a021ac3f6c5bbae166cb81f3d99d09e3410a72d0812d788f84fcf70eca2f0aebb33f18ab1665af5942c215b072e75e7651221b119d425dd5ddb4ca64683c373

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
727163ed6d18c182175e086f270a1487

SHA1
2cbccfeb87df0e6383e108e0d9770c940aea7804

SHA256
dfa0b8f8c5e9a74c5ebb7391725d969b4ef08c93758d52c00357a3537c160793

SHA512
3acb69fc223556df17ab2b0cebfc9c45144dbfec54292471fb99f59bb040dd725daecb8c585dfdb12f8a2921435a3bcf02c19421836fb02ee8a9ab8050b77a47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
05037d91e8423627f8f4c26e2a3aecc2

SHA1
c874bd1923b9259b23268de1b961d9ed6acd9e38

SHA256
237e9a16318a121ecced9ca3ce3da900bc31bf2a3ed6dae823499ef307bb2941

SHA512
c99971bd2550f76883951aea8d33dee19f411599556dcf3e19c9330ca74b8690037779baee04e055c19046df456811c7c218896f3d8812e4511ef053e0a9e7c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
870B

MD5
701923dbd97441f4d20743ed0b8d15b9

SHA1
7e70404cb7a6e2a87b655b4222714c099c038c2b

SHA256
455b364d72ce84ae65a0b70448c51a2e027329bfc224efb0b8a18aa76a4f7672

SHA512
0f1154f6e79d94b1818805611c7608028af5e9e80b13a8f50dfc8a1ca124fbe9a12ea5ad66eaaf7b24081be394ec1ae2fd3d3a7af0a1a16355f62f2030305a1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8d2876f8fdc07ac8919e3c4e2cb5cccb

SHA1
9f649b454098f0a8445b88986a317b0da19988ac

SHA256
f5dc7705b2de132329755f5d3cfddb39f996394d5f9fb6da0092d6e1b50bb974

SHA512
0001c81b6b0b8b9c1b367d52be2531db552329c3caeecff4b69b612c62b880518c615d9e9a0024feadac2bd29a9eb1818d49375ec675d053e1295f69a00bec08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
64ba63a3809a6e6d849f23b1fe669d21

SHA1
d53d9934b5bc70f1e13d1e22709b24a0b7d909a8

SHA256
444d9e9c2a02c3035043dbceeadaefe00d5801a5b48e81fa20da14a7e15ac4d1

SHA512
00403dba72074923b8ecbd0559e9ef40960fc1b7c572249dd8253fdd08b02f38cf57b4d30c3cbeda477f131bb76166647f34a72d69d1523e84503f827d3f604f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2d1f1a4ba48f1d972586595702e8f8b9

SHA1
ef3bb2c3e43a3f503ead0245b58ca024fe3ab820

SHA256
8ed714e7dd0fbfe43ebeca6de95ce025a0d1f3d899548fad80d08b6074912cab

SHA512
6f9a2c8e0a86337507653c77edce1190ad209d27017a1a61ea0a4b396ba2d1437fbb88bb0224aad55ba7729348d61a476256b682d6b69f6e1fda3ebec496b560

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2629d825a207cd811c4685b6c7f73ee9

SHA1
d158e07777f9d6cc93e344089d3326b354c36f82

SHA256
5495036ba0e5adf9e6bd6c7e74a17b7972fd37b32bf54b838f4fd574eef9ee35

SHA512
96617bc08462b7c4ae20a923dfcaa9bbb12a8f5e741df646cb209bc97046b99e5c94e6aad758d65d3512f9f9023c0c2602833e79be53981c20d9145ce0f3cf95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
866B

MD5
5d662ae85f7515e2edaff44dbb7799bf

SHA1
9ad2af1725a4ee803b484745a77299b7d1c25441

SHA256
184b9f858c389868344b75e748eb6c3b5813fb4bc9c7500220be91b79c497e0d

SHA512
fec679cd353050437563c0f9b64a6132e266b158a952be998c165e67fd49636856a11919e88bb84375ffd54367a0987bc62bdb09392c339bca7c11d4af3458c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3edcbeb6dbcd28f291d1d292b3b12af3

SHA1
6aebe729acb37370e575c6664ce480228fc6150e

SHA256
4e589ec90c2518e83ed2e02e18aac9aa332c55a76c3949a5a47165e25359d582

SHA512
9229125f5a4f7ba731f01aff3d4744f03771862cf631b86efbda9bb32473be57bcee267e1def1f30d6eeba89e4b3386936cb3771aa76ae81f17806f94a261b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9e9bb7dadd65037cc837b77dbb13fd34

SHA1
56fffddcf87953c90a78d3db44aaff902dfd032e

SHA256
90c9a111ba25b64357cafdbd42b7bcce9832542346441e94a62386d27a04c895

SHA512
21e772bbbd863f7d0cb7100813afe1082f4406641fb0aa26dd096a4dc345310f2fe765b343b11177336962326e41bf058834932e88586b3f8a5917601f71548e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
af1e0a89b807c68c7d062f55802f7d95

SHA1
aea5187e0b94d16f0e291405642e017944605db0

SHA256
708254118b23f604f71fdd82c937bb9d11df541a67519556c0d30e5c2947c9ed

SHA512
580e552f3e2ac7ef0350a1004f9b8fa7e4b4ebee73976de07ef29b67dcd2069c1bb1df7e36dce0d1ecdca86073f05a61e2680838e517a94bb505c323f4d47ddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9028bb29a9c0b3b20f747ec08ae0129c

SHA1
9db7f4f6c75caa3ffb46bce5c9489f6ac6689b26

SHA256
e4a4ef791c49802cba4132015b9a7127f9234a70283f4ebce81057e79db034f2

SHA512
a865fba1e1896cfbc07bbe8b1e834474d2f80e5d0769a0235c96fc848897ac4431cd4526e9eda2d0dfa82b74910c72c4b60d86816ce396617b57a50f2c0fc834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b5d8a4b6fb12166e71800756a7509089

SHA1
5c7ce19f7c816295a4a280f7b3470ea9c64904c8

SHA256
2a963d17535e05c1af0af1f08ffb12c4d2cde7e9403d89261d0d7c5c3c2a7ba6

SHA512
7f8258206e08940115680340fa0fe1e45cec82a657d6aa4e60595b5eb7488c8dc0e738eb254875e90165f61307e931aad4e57633ed7dfa5d2df334fd31931260

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
004eb75c46e60f527b4714bff27c7eec

SHA1
df4f4d3176ac1a52aee39187a14e44ea4aff95c6

SHA256
49a2560c5cf48cedb6af48cf2137d2cc4df5c695a34d373186ca1308174d0198

SHA512
3ed44ede9572340f2e4dd59fa436f52d3678bfe2663e5c3c779fb7e3b4a26464a1240c04f1a3410059bb2b7827b491e790877c1f9020a2bbc0e58805ef353108

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c6961a48bcc14f49dd79328c6de519e2

SHA1
674e1f043b121b57feaaddbe0c00eee81bc53c46

SHA256
364b39b1f483cf7d21e9a21b38695c6d8d591861dfbb7d0b19f1b14804d4f73e

SHA512
2f190656738a9770fcf87710a0a1f7ab3b929a8d3b3546c482f393b042a66bcf191cfb1d75cab7f305593241cf39e9ea8f72c5d08926537f761209e4def1f61c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3609209902612b748c9db8d428bb7d6f

SHA1
cc502e73d3fbe821fc48470c907cca2d348e4d23

SHA256
b8c401fc7154cc6e54f1c9c791fa56d82dd3befce36c6b35ad9ec3e3d606f40c

SHA512
7697e25655df49cad1c4f682f214b790955580e13809f51bcde0c8bb1fd01cb8bef8ce4a19105524a3e4d05f77880e6572b1d73d6c37a425c1dc4f7794877087

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5aabe1.TMP

Filesize
866B

MD5
3b4428d823f30d8684a001441bf833cc

SHA1
583fcfc56d65663a1165c28825608732dda0682e

SHA256
f92dbe7aabee5a402bd940b71b7f537c3b07c8367d46e423a5c7110fae53c51e

SHA512
e307611eaa51d280d13fafd06decf1e1938bfd1fc94c6a873a5b4c363095c17bc074b262089f23127b6217f82c498d09fc09bebd0a0107f40a3aac9de53fe191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
8f1556a7e9b8ca71fe6c4c9a4fd29bf3

SHA1
7a36179ecdbd671e1377a8bcf8fff6d3e810a4fb

SHA256
5f94e467b52969f4a9a548aee3ee588812ce6f45763ef4a4cc1b959eb8379af5

SHA512
c667c53fbe6e0f82c8c41bdfd46b7972dcd58f8d78ad002abf4b560cb48de8eee4bed41738833e193fdfe52436052f14522ee4f6997abcdfedbf7b15248ad2aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
032d9a3432e31dc2194d1f91ea6cf046

SHA1
7f90aa23e658eb3e4de2d1124192d58df8420dec

SHA256
6524dda0a1360d244e555b66f9983018cb6005e536920f977353393496f3d9aa

SHA512
ac37c089bb838863eab318a4d198a758625fb8ace1b071290fcabf9c7d637de14ebb2be2d82acae3a676885fa7f071c59c9d7962fdc1c2fc65a548e2bffb4bdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
02e44eab83aef68a105cced23fbc3cfd

SHA1
9072ca607f1bd444764ee0be5f1a911821e70074

SHA256
798178a53c79cde6c92709d402658e22684f17a1a41f818ee7846ebcf4582385

SHA512
f922df111f8a634a8ad7d98f804230f41bacb3fa359b3459733e717ad33bce4681c42d7c906a160745069d272dbfdc92de1ad745bbf3b30514132c91fbe66459

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
72b0752f3b2a82aff325598ea6862922

SHA1
d91c25bfe4ab984307dd00c8f83feb901ae8e36d

SHA256
17c7aa472b529938d0f1f568e9db4c0f07bb1f7fc7dacb99b5cec3ad46cee3f6

SHA512
e08d553ca65f663d0a59cdc924c41c6c21dac6c9913627074fba2dff89f5ac98e6cfcb503d0666cafa2bddc7d696dfa76f504e467f1ca561990864a5f2902ac0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
dbd8498208a20ccb094586234def9c65

SHA1
02e2fbf0e9b2b55f12e855e6e68d9513994adec7

SHA256
cddb6c864f7f66fe4bddb410db20fd371b79c0a1c572f0bec9233476496ff0cc

SHA512
146c4b51c85d63918ca0508b93c51a8a9d8c11ff218a7fefabd52b23d54238135b6f0fbba534df47222081add78d4fa8f7d30d495f2593c2bba9df7e4916d242

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e9e610036c590217227894efd1bbd094

SHA1
f4fdac6bfa69f002562bc0ebfa35d6ebc1cad0d2

SHA256
0865e82c6a73ab60ad6af5debd335f5865ef7d23f2e0dee39a2ab88782ca48b2

SHA512
ad42c3ec12aa84649502ae36dc73b1526c015086ebc545085d54e368cfb275eaaf16e22ac702b0400760fa319049784f2630ff385b9eae056101659330d82b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
62fbafed47145b2838a2fdd37ef0b5b4

SHA1
436541f49c1d622a69a6096c6e673c97ff4c74e6

SHA256
9bceac9b2e68ae6bf84715ebd2c4a7c0afa2391c15263d334e6efcf12ae7bae7

SHA512
46191f4b809c9adb16752f554d5cf6c4405f8e0ac43c2f847df96b2fe270de92bc5a6a9cb90e7a050cf2bc5367f20303eeb631bbdac787e85e29114013826b7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
3aa436df159004a7e9bfc004a2670203

SHA1
0068ae50e437b53048b566573d446db6940de5f5

SHA256
dba7a1ff6fbe37af085fa93bb24f4602113fde2723b9750f88583c6df73696bb

SHA512
8dba1e275a48043a113987aa1da70cbd4458bb210883d507565a3215c8c2cdb0c619af7245850043531e316460786c6861b6133b2d53b7c4ebc6e6440426a748

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
edc2cad85ef847e69bec2cf5088d3692

SHA1
d4e2437ee7d104554403c55866e96f17b269c88c

SHA256
6a639b98096057aad70f1fb7ed86e166ebfbfe42f5c98c261d9a455518103304

SHA512
c13f3cd0354dac5ae5badfa799285c6ec221237cd9cd24a9bfa5925a1369cdffdc0901062e08301331d255f566e69f0a4925247a5869d77b6c53a319c6b511b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
a9f422b50fff81e6c78bd0bbedf7fa0f

SHA1
22c3b6d1a4e8349234f61090715c2b7ab934b971

SHA256
866603b2815023366b6688b10ab53445f2e64d7352c8baad2f3a708bcccce8a5

SHA512
597e91654e96ca731d1bf7f44fbbc8a19e525407e7c1445a9ffa80f777a3be2eb2431badab203ad4f642aba1f0863611fbdfb328b387876129d21e923383b349

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
eb2e251a1a0813d7cc4fa9102840bd7d

SHA1
be2b92d613af48872c853ef5f7fe705665f2f708

SHA256
a91f63df30b8b603c1e85db8565f223aa5f2b1ea4d879111250c66225e6e5ee7

SHA512
b8febdf8638d67af6a0d38c2af0e3fc71fec49bcf94163d9a6aa7f4c3b227559b78d85f710286da1eba61a4a60be9be3ecf6634b0f30bd2f94f107de75ce8fe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
e93383a84c8a1837f5248669be3efc4a

SHA1
2a754e3a77bbf825a3841de5c651fedf1530bc2e

SHA256
0860b981cdae079733a88b36f166b7352cdb14933f3b0497b911406a4df62c2a

SHA512
5b541d66820c821fc51e26a20bd9803a3b2e89edca1920be2fb88fa70bee1bb85b2df17d020e47755a7ab964e8bf48e8346c47df2f2743136298143b1e33d593

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
76afa796a9ef80ef6c0dcd49e6c86b65

SHA1
fe364b24372e0aa4ec4b031f5243f509ee8f72c3

SHA256
4370ec5acbf9d4885e103f2b71c5f7b2090d55051bf21b44b6ee4733abcc6297

SHA512
1b1685294ee4418eb84838ed4ca830a2e59059abe1427b5f218d8b0128b21cb59008fc0e2518f1ddf72308887a1323a332bed8fbbd56bda0b000e44c075c0774

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
ab0fd756c3362018c61c18c0f0eed7d2

SHA1
1f7bd5de248f200d17668caad686d7591a2dfbca

SHA256
41bc5ec8918271f0e3cd1a0b64f1c6dc97aa3f23991a4ba7f9d58afa516900f8

SHA512
d4137920df0a013eb4059532947f8f8fcdd050fbace45917fe08126e5a214b1222c89a724865de12561317adcf9a898e16fc2559a2f5ed55116c41b5369194d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
a42928ca30c2f3c7a11051ab791b1e77

SHA1
2960cff7d54beb2ed6853eb466bccc3ee383a48e

SHA256
126623d0abdc900e04f415a03eaa5da218de0f7b024f4d9f483e4a7a32da64f7

SHA512
8d2e3b0ceb2956920c63c9a9fe4c900980b8a6f4f42885fd25a396c60bb5185c05f30a62b5219b7d75b24f25cd59d4eb6105872cfe70085621c6f059b00997a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
26B

MD5
6bc190dd42a169dfa14515484427fc8e

SHA1
b53bd614a834416e4a20292aa291a6d2fc221a5e

SHA256
b3395b660eb1edb00ff91ece4596e3abe99fa558b149200f50aabf2cb77f5087

SHA512
5b7011ed628b673217695809a38a800e9c8a42ceb0c54ab6f8bc39dba0745297a4fbd66d6b09188fcc952c08217152844dfc3ada7cf468c3aafcec379c0b16b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
acdb1b7d8bc8c981c1a64464f3d4a4ab

SHA1
fe78b72dd8a5adf4c5d438269503ab9adf5ca492

SHA256
7cc2941d3bfd25843b72daf438833ea50b77db01817fced584bd1ac55d36c622

SHA512
4107ef93962d228313774b4bbc29201060b5b061e97975fa39a366cf321f44046c0d2ce0000e0806b81ca48e4ee946fb7b5f83a7fb0e4f00c4aa3c00fed5b8a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
367f59bf9ad18e9898284d474da1b18a

SHA1
263ffbd11da84c98e0e3c5e493f0265d0d88548a

SHA256
852327ded61a7cceedf835ba3eb82d22c63ef9903522663e90b49f75b6b32a1a

SHA512
eb0b06de2168d2ef24163a128f93d19411e02c62b33b918d82ff719a856699b016637d5e2f8047f35afe464044876ef5a8aca73d98b88dd257f198c59a2384d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{3A5150DE-A16E-4AD5-BF64-CA2FE23298A8}.session

Filesize
2KB

MD5
ea34d0fca90b1243c71725ecede18930

SHA1
2cd405daac7bd40d771298468ae62c6d59a7f050

SHA256
58e5b9e4915ee5b1cfe39cf9e58506a746caae8b86b213c096878a0f242ccc19

SHA512
90119279428eb8e13ec8064b94f3a293255cef20429576db37cf84f4b188db46d6aaee9db728cc507c1948c9e2d477defd2957fd31d6196fbf5d10744e386687

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{3A5150DE-A16E-4AD5-BF64-CA2FE23298A8}.session

Filesize
4KB

MD5
117cb1d4c82be1f56452717866c5f007

SHA1
c85efdc0e839f3e79e2e2e260bc8fa27fcd39494

SHA256
240bb849a5ce1a51c11b078039465796d602cbf13e041bebdfe08df5d545c964

SHA512
eefb6fdf5d39b1d5d0a9161665d4c63b46a84afcd5964f031575121e982c0b2289da12db2705a33bd7513bb21e18697c824b9b25172cccaa1d4842413f0b36c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{73B8ED3B-D3B5-4750-BDC5-BDC8B509653F}.session

Filesize
3KB

MD5
60d681b05f4665e05da845546715d719

SHA1
fde988472f844b3b7e32a8bc49f78d548f511025

SHA256
5637c4b45ce5f630c60122f3c4a7e7872b06124f34eb348f8153e300754e48c9

SHA512
da857125a6694c10dea2b7a9951b564651284eccbe3e77510e885037505dc70038dd5768e28de52bcfdf5577f34570752bd09da94efee00a4750b0372c5f14a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{73B8ED3B-D3B5-4750-BDC5-BDC8B509653F}.session

Filesize
3KB

MD5
070386365a302bafcb9aa9a1681067f6

SHA1
c1705efd7e954fce636ace46534d048f4da0305f

SHA256
f6005cfec49c716c0f8c0932fb0d5b0c080ec00769607eb45bcf9659dd5369e0

SHA512
53bc2a3e4d9846cba3be910cad1aed753e322a2282164f7dc887dc9bbf338b0483f922be317c30c94c15b858719137bc7d534885d60434b61566f68e834a16ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{73B8ED3B-D3B5-4750-BDC5-BDC8B509653F}.session

Filesize
4KB

MD5
121c17876dd0884e112b289e0da43b04

SHA1
f16d1dbca2b01d49028aeac70c1c10470b3fa8b7

SHA256
d6d85a14a9f5db2410282f674f4797c8d1c42466a224683e4f519a4bccf275c9

SHA512
4c6bc05dfa03752965fc9ae8d26437f518a06680eaf167400ec9946759ab819c23b3012da8d27286e7d1e789ec0055deb77472296247554ed703bf9fd6fbd782

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{ADAA5FD1-9F84-4DE4-B41E-7602039816A6}.session

Filesize
4KB

MD5
4caf17a0f3ac279dcef5ea9d7f61ecce

SHA1
b3e47363a144e983251f9e7c24256f880f48e5c3

SHA256
2078b02c04e9ce0ba38f4e5fc947e01d7908ccb8f3624676c9acb2d0718c9085

SHA512
dfba72c8751de3dcd951760dd3a11129a076c96371c4d6646fd5477081eca3a7672a832a4f27c7f14111fbbc94c82de4165da9f3d270ac6aa9c40a2c6507a4e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{D48DAB0E-EE2C-4AE0-8D88-146BAE6B02E7}.session

Filesize
3KB

MD5
6ae0032839fa02c356a9e32a28061e8b

SHA1
6f51b12431e8c5a143284f8fddf6c94e3c8165a8

SHA256
575e149c28553f401fac9f2761dcfb9b8010c8cfdf150698df5c92d41ae7f8df

SHA512
762ecde4e4b5a49ef7590d43b61bf6482b0d26ec93cab63598b77f820745c62438c81b8fc174935606e1f94d497f5a9272d4d92f468f6f5ca1a2d2e67d2b0269

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{D48DAB0E-EE2C-4AE0-8D88-146BAE6B02E7}.session

Filesize
4KB

MD5
67d3b96ed202f6d3637d2f9c276d446c

SHA1
e8f7e43194d2cdf384675e005b75e9cdf866c2a9

SHA256
de5c7e2c1950ba09dc7fc45be36487731ee623b59cf2a1084c7d78cb0bc36c13

SHA512
40dd237317c064fa6ecb951fc83d84415ae311eae1585208e827b227605f7a76215aa5de7cb91c6edcfd23a7fa689e542c7c4dda7493c29456f48b732a7573a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{F276C231-3A10-4707-8C38-E6D82CFAB209}.session

Filesize
3KB

MD5
35780a4383e19c2c0300217631248ed0

SHA1
b66357c512c39ba2d7a4997883197a3c50fe3ef2

SHA256
770f03ccc4e6072f795305f28b48f14be9ae0edca91a518b4204b79b28309638

SHA512
66e1261c264d26b518133277cdffcfb7d670c91b0aaffab0e8f37f5e7eac50707f63a54af76bfe2f44cb47fbaca141103ac1619d8f1ad53f5105eecfbfa229e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{F276C231-3A10-4707-8C38-E6D82CFAB209}.session

Filesize
4KB

MD5
e18399a5e15ee90deea13487a830d384

SHA1
c5c1176b741bd352b4db7f2bc32f8bc6e8b37d92

SHA256
41bf9dc8d184ea198228f296a03c2f8133bb7bf211f16ea892996c0069f985bc

SHA512
72e3a11c8c831f62c27da6102488d9221b18fcbd76166cceb27f052e4c20ae90fcda1b7c0ee6c3188da1efaef9df80fe6ee67c881a72ce4c2726bef5b6285e84

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lugiymua.j40.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\shiC6C8.tmp

Filesize
3.1MB

MD5
aff55ff1a0d686ad405855bd22a932d6

SHA1
00b5db2b0322b2aad7aebd80d1d13372eeb85832

SHA256
926a128e1ef90c09470460fab0682fa500640b96ad3ad6fd8efaff9ed46e97db

SHA512
19bccc43eff166e1c701713edd6279d6c55b1c1277c2391eec73e6aebd201db762a52fc5a764900ac04441e73c573703ee29944c6c0a8e59d90b46b3279cd11e

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi

Filesize
1010KB

MD5
27bc9540828c59e1ca1997cf04f6c467

SHA1
bfa6d1ce9d4df8beba2bedf59f86a698de0215f3

SHA256
05c18698c3dc3b2709afd3355ad5b91a60b2121a52e5fcc474e4e47fb8e95e2a

SHA512
a3ae822116cddb52d859de7ffc958541bb47c355a835c5129aade9cc0e5fba3ff25387061deb5b55b5694a535f09fe8669485282eb6e7c818cc7092eb3392848

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\decoder.dll

Filesize
126KB

MD5
3531cf7755b16d38d5e9e3c43280e7d2

SHA1
19981b17ae35b6e9a0007551e69d3e50aa1afffe

SHA256
76133e832c15aa5cbc49fb3ba09e0b8dd467c307688be2c9e85e79d3bf62c089

SHA512
7b053ba2cf92ef2431b98b2a06bd56340dad94de36d11e326a80cd61b9acb378ac644ac407cf970f4ef8333b8d3fb4ff40b18bb41ec5aee49d79a6a2adcf28fd

Download Submit
C:\Users\Admin\Downloads\34c71e22-80d4-409f-ab97-e0d8e57784ae.tmp

Filesize
3.3MB

MD5
e58fdd8b0ce47bcb8ffd89f4499d186d

SHA1
b7e2334ac6e1ad75e3744661bb590a2d1da98b03

SHA256
283f40e9d550833bec101a24fd6fd6fbd9937ed32a51392e818ffff662a1d30a

SHA512
95b6567b373efa6aec6a9bfd7af70ded86f8c72d3e8ba75f756024817815b830f54d18143b0be6de335dd0ca0afe722f88a4684663be5a84946bd30343d43a8c

Download Submit
C:\Users\Admin\Downloads\NoEscape.zip

Filesize
616KB

MD5
ef4fdf65fc90bfda8d1d2ae6d20aff60

SHA1
9431227836440c78f12bfb2cb3247d59f4d4640b

SHA256
47f6d3a11ffd015413ffb96432ec1f980fba5dd084990dd61a00342c5f6da7f8

SHA512
6f560fa6dc34bfe508f03dabbc395d46a7b5ba9d398e03d27dbacce7451a3494fbf48ccb1234d40746ac7fe960a265776cb6474cf513adb8ccef36206a20cbe9

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r (2)\@[email protected]

Filesize
933B

MD5
7a2726bb6e6a79fb1d092b7f2b688af0

SHA1
b3effadce8b76aee8cd6ce2eccbb8701797468a2

SHA256
840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5

SHA512
4e107f661e6be183659fdd265e131a64cce2112d842226305f6b111d00109a970fda0b5abfb1daa9f64428e445e3b472332392435707c9aebbfe94c480c72e54

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r (2)\@[email protected]

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r (2)\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Downloads\Winlocker.VB6.Blacksod.zip

Filesize
1.6MB

MD5
713f3673049a096ea23787a9bcb63329

SHA1
b6dad889f46dc19ae8a444b93b0a14248404c11d

SHA256
a62c54fefde2762426208c6e6c7f01ef2066fc837f94f5f36d11a36b3ecddd5f

SHA512
810bdf865a25bde85096e95c697ba7c1b79130b5e589c84ab93b21055b7341b5446d4e15905f7aa4cc242127d9ed1cf6f078b43fe452ad2e40695e5ab2bf8a18

Download Submit
C:\Users\Public\Desktop\゚ᩫᇊ✰ᔤṆ⧏⠾ኆڜ⩽⒆ఄ૸⶘◑⁪ⲑ⁖⤜

Filesize
666B

MD5
e49f0a8effa6380b4518a8064f6d240b

SHA1
ba62ffe370e186b7f980922067ac68613521bd51

SHA256
8dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13

SHA512
de6281a43a97702dd749a1b24f4c65bed49a2e2963cabeeb2a309031ab601f5ec488f48059c03ec3001363d085e8d2f0f046501edf19fafe7508d27e596117d4

Download Submit
C:\Windows\Installer\MSIB12D.tmp

Filesize
88KB

MD5
4083cb0f45a747d8e8ab0d3e060616f2

SHA1
dcec8efa7a15fa432af2ea0445c4b346fef2a4d6

SHA256
252b7423b01ff81aea6fe7b40de91abf49f515e9c0c7b95aa982756889f8ac1a

SHA512
26f8949cad02334f9942fda8509579303b81b11bc052a962c5c31a7c6c54a1c96957f30ee241c2206d496d2c519d750d7f6a12b52afdb282fa706f9fee385133

Download Submit
C:\Windows\Installer\MSIB1CA.tmp

Filesize
180KB

MD5
d552dd4108b5665d306b4a8bd6083dde

SHA1
dae55ccba7adb6690b27fa9623eeeed7a57f8da1

SHA256
a0367875b68b1699d2647a748278ebce64d5be633598580977aa126a81cf57c5

SHA512
e5545a97014b5952e15bb321135f65c0e24414f8dd606fe454fd2d048d3f769b9318df7cfb2a6bf932eb2bf6d79811b93cb2008115deb0f0fa9db07f32a70969

Download Submit
C:\Windows\Installer\MSICA49.tmp

Filesize
96KB

MD5
3cab78d0dc84883be2335788d387601e

SHA1
14745df9595f190008c7e5c190660361f998d824

SHA256
604e79fe970c5ed044517a9a35e4690ea6f7d959d21173ebef45cdd3d3a22bdd

SHA512
df6b49f2b5cddebd7e23e81b0f89e4883fc12d95735a9b3f84d2f402f4996c54b5fdea8adb9eaa98e8c973b089656d18d6b322bd71cb42d7807f7fa8a7348820

Download Submit
C:\Windows\Installer\MSICA7A.tmp

Filesize
312KB

MD5
aa82345a8f360804ea1d8d935f0377aa

SHA1
c09cf3b1666d9192fa524c801bb2e3542c0840e2

SHA256
9c155d4214cebda186647c035ada552963dcac8f88a6b38a23ea34f9ecd1d437

SHA512
c051a381d87ba933ea7929c899fb01af2207cb2462dcb2b55c28cff65596b27bdb05a48207624eeea40fddb85003133ad7af09ca93cfb2426c155daea5a9a6db

Download Submit
C:\Windows\Installer\MSIF2DF.tmp

Filesize
128KB

MD5
7e6b88f7bb59ec4573711255f60656b5

SHA1
5e7a159825a2d2cb263a161e247e9db93454d4f6

SHA256
59ff5bc12b155cc2e666bd8bc34195c3750eb742542374fc5e53fb22d11e862f

SHA512
294a379c99403f928d476e04668717cdabc7dc3e33bcf6bcad5c3d93d4268971811ff7303aa5b4b2ed2b59d59c8eba350a9a30888d4b5b3064708521ac21439c

Download Submit
C:\Windows\Tasks\sys.job

Filesize
312B

MD5
ac9d8550e0e6d7cb71b3008989e1207e

SHA1
9420004be1798628573b75a7e9bca9ee7ae5e023

SHA256
c31cb076ca741c7c68292d5f6b1228602c71cb4322281980c7c45f0ca5fc4d0d

SHA512
205293946f9526038b3129ed2e6e5a7a528bc8b66c335efedc30acf07967170a9a86c73d79d27c1370b7d1ad995a87e1c07649075a452b6f72a8b30215fad18e

Download Submit
\??\pipe\LOCAL\crashpad_4776_BBQCXWWXHJMAYCSS

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1404-0-0x00007FFED4123000-0x00007FFED4125000-memory.dmp

Filesize
8KB

Download
memory/1404-10-0x000001E068D80000-0x000001E068DA2000-memory.dmp

Filesize
136KB

Download
memory/1404-15-0x00007FFED4120000-0x00007FFED4BE1000-memory.dmp

Filesize
10.8MB

Download
memory/1404-12-0x00007FFED4120000-0x00007FFED4BE1000-memory.dmp

Filesize
10.8MB

Download
memory/1404-11-0x00007FFED4120000-0x00007FFED4BE1000-memory.dmp

Filesize
10.8MB

Download
memory/2852-5239-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download
memory/2852-2847-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download
memory/2852-3128-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download
memory/4112-3621-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/4208-2752-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download
memory/4208-2754-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download
memory/5180-2749-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download
memory/5180-2751-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads