dharma | hxxps://www[.]google[.]com/search?q=google&oq=google&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIGCAEQRRg5MgYIAhBFGDkyBggDEEUYOTIGCAQQRRhBMgYIBRAuGEDSAQgzMzM5ajBqMagCALACAA&sourceid=chrome&ie=UTF-8

Analysis

max time kernel
353s
max time network
353s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
21-08-2024 19:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.com/search?q=google&oq=google&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIGCAEQRRg5MgYIAhBFGDkyBggDEEUYOTIGCAQQRRhBMgYIBRAuGEDSAQgzMzM5ajBqMagCALACAA&sourceid=chrome&ie=UTF-8

Score

10^/10

dharma credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer upx

Malware Config

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (563) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Downloads MZ/PE file
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe

Executes dropped EXE 4 IoCs

pid	Process
4744	WinNuke.98.exe
856	WinNuke.98.exe
5672	Floxif.exe
4004	CoronaVirus.exe

Loads dropped DLL 1 IoCs

pid	Process
5672	Floxif.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5672-1715-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/5672-1718-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe"	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	CoronaVirus.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	CoronaVirus.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-131918955-2378418313-883382443-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-131918955-2378418313-883382443-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
61	raw.githubusercontent.com
1	raw.githubusercontent.com
46	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\CoronaVirus.exe	CoronaVirus.exe
File created	C:\Windows\System32\Info.hta	CoronaVirus.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected].[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\FlagToastQuickAction.scale-80.png	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\Training.potx.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-64.png	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\sendforsignature.svg	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\inline-error-2x.png.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected].[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-no-text.gif	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms	CoronaVirus.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\external_extensions.json.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\ui-strings.js	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\Microsoft.VisualBasic.Forms.resources.dll.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.IsolatedStorage.dll	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-fr\ui-strings.js	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-24_altform-unplated_contrast-black.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\SearchEmail.png.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\ui-strings.js.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\nn.pak.DATA.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-125.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-24_altform-unplated.png	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_en_135x40.svg.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Settings.Editor\MainPage.xaml	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-100_contrast-white.png	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TipsAppList.scale-125_contrast-white.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\SnipSketchAppList.targetsize-36.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\editpdf.svg.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\selector.js	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_opencarat_18.svg.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\de-de\ui-strings.js	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-64_contrast-white.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\CompleteCheckmark.png	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_x64__8wekyb3d8bbwe\GameBar.winmd	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClient.resources.dll.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\customizations\customizable.js	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\createpdfupsell-app-selector.js.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\dnsns.jar.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSmallTile.scale-150.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\add_reviewer.gif.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\msolui.dll.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\WeatherAppList.scale-200_contrast-white.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\ui-strings.js.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BSSYM7.TTF	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Confirmation2x.png.id-3959AFEE.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\large_trefoil_2x.png	CoronaVirus.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\WinNuke.98.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\MadMan.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Floxif.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4596	5672	WerFault.exe	148

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinNuke.98.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
26704	vssadmin.exe
22408	vssadmin.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-131918955-2378418313-883382443-1000\{A455A639-907C-4F05-9555-35FCF5CC8625}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings	msedge.exe

NTFS ADS 9 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 664793.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WinNuke.98.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 120922.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Floxif.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 180720.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Melissa.doc:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 510993.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\MadMan.exe:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
6008	WINWORD.EXE
6008	WINWORD.EXE
1800	WINWORD.EXE
1800	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
4800	msedge.exe
4800	msedge.exe
4268	msedge.exe
4268	msedge.exe
5584	identity_helper.exe
5584	identity_helper.exe
5540	msedge.exe
5540	msedge.exe
1456	msedge.exe
1456	msedge.exe
4520	msedge.exe
4520	msedge.exe
1888	msedge.exe
1888	msedge.exe
5404	msedge.exe
5404	msedge.exe
2304	identity_helper.exe
2304	identity_helper.exe
4392	msedge.exe
4392	msedge.exe
3912	msedge.exe
3912	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
4600	msedge.exe
4600	msedge.exe
912	msedge.exe
912	msedge.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe
4004	CoronaVirus.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5672	Floxif.exe
Token: SeBackupPrivilege	984	vssvc.exe
Token: SeRestorePrivilege	984	vssvc.exe
Token: SeAuditPrivilege	984	vssvc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
6008	WINWORD.EXE
6008	WINWORD.EXE
6008	WINWORD.EXE
6008	WINWORD.EXE
6008	WINWORD.EXE
6008	WINWORD.EXE
6008	WINWORD.EXE
6008	WINWORD.EXE
1800	WINWORD.EXE
1800	WINWORD.EXE
1800	WINWORD.EXE
1800	WINWORD.EXE
1800	WINWORD.EXE
1800	WINWORD.EXE
1800	WINWORD.EXE
1800	WINWORD.EXE
4520	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 2024	4800	msedge.exe	81
PID 4800 wrote to memory of 2024	4800	msedge.exe	81
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 5432	4800	msedge.exe	82
PID 4800 wrote to memory of 3244	4800	msedge.exe	83
PID 4800 wrote to memory of 3244	4800	msedge.exe	83
PID 4800 wrote to memory of 1960	4800	msedge.exe	84
PID 4800 wrote to memory of 1960	4800	msedge.exe	84
PID 4800 wrote to memory of 1960	4800	msedge.exe	84
PID 4800 wrote to memory of 1960	4800	msedge.exe	84
PID 4800 wrote to memory of 1960	4800	msedge.exe	84
PID 4800 wrote to memory of 1960	4800	msedge.exe	84
PID 4800 wrote to memory of 1960	4800	msedge.exe	84
PID 4800 wrote to memory of 1960	4800	msedge.exe	84
PID 4800 wrote to memory of 1960	4800	msedge.exe	84
PID 4800 wrote to memory of 1960	4800	msedge.exe	84
PID 4800 wrote to memory of 1960	4800	msedge.exe	84
PID 4800 wrote to memory of 1960	4800	msedge.exe	84
PID 4800 wrote to memory of 1960	4800	msedge.exe	84
PID 4800 wrote to memory of 1960	4800	msedge.exe	84
PID 4800 wrote to memory of 1960	4800	msedge.exe	84
PID 4800 wrote to memory of 1960	4800	msedge.exe	84
PID 4800 wrote to memory of 1960	4800	msedge.exe	84
PID 4800 wrote to memory of 1960	4800	msedge.exe	84
PID 4800 wrote to memory of 1960	4800	msedge.exe	84
PID 4800 wrote to memory of 1960	4800	msedge.exe	84

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=google&oq=google&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIGCAEQRRg5MgYIAhBFGDkyBggDEEUYOTIGCAQQRRhBMgYIBRAuGEDSAQgzMzM5ajBqMagCALACAA&sourceid=chrome&ie=UTF-8
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff36b13cb8,0x7fff36b13cc8,0x7fff36b13cd8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1736 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=1664 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,3077722034338688049,3448365528458970285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1456
- C:\Users\Admin\Downloads\WinNuke.98.exe
  "C:\Users\Admin\Downloads\WinNuke.98.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2960

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3148

C:\Users\Admin\Downloads\WinNuke.98.exe
"C:\Users\Admin\Downloads\WinNuke.98.exe"
1⤵
- Executes dropped EXE
PID:856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff36b13cb8,0x7fff36b13cc8,0x7fff36b13cd8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4392
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\Melissa.doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:6008
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\Melissa.doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
  2⤵
  PID:584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4884 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4600
- C:\Users\Admin\Downloads\Floxif.exe
  "C:\Users\Admin\Downloads\Floxif.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 456
    3⤵
    - Program crash
    PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,9620610558658462547,10936647458554682667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7152 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:912
- C:\Users\Admin\Downloads\CoronaVirus.exe
  "C:\Users\Admin\Downloads\CoronaVirus.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4004
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:2468
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:22288
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:26704
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:10120
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:22376
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:22408
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:10500
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:10524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5672 -ip 5672
1⤵
PID:5940

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:984

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\d399320fb8a04174938d4ca4020a32f1 /t 11272 /p 10524
1⤵
PID:11304

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\c025da5d75b44ed8a431396c27b1fee4 /t 10484 /p 10500
1⤵
PID:11024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-3959AFEE.[[email protected]].ncov

Filesize
2.7MB

MD5
b2c74289c831eb20552a9d4e4b86ec17

SHA1
08de636ea294b425a98002157d0c4fb2926169de

SHA256
b5507370fbe1d7196c4c2667e3915bec0c5959db35ead2c44739414513cc40bf

SHA512
c9b8fa2364e59193fcf4c36fc1b1809143db9c5919535551ba2aa0400f611ec163cb00f2ea7cd908381773304e702f87211667033de0c8ac97995ad783257b21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e681bda746d695b173a54033103efa8

SHA1
ae07be487e65914bb068174b99660fb8deb11a1d

SHA256
fee5f7377e5ca213c1d8d7827b788723d0dd2538e7ce3f35581fc613fde834c2

SHA512
0f4381c769d4ae18ff3ac93fd97e8d879043b8ec825611db27f08bd44c08babc1710672c3f93435a61e40db1ccbf5b74c6363aaaf5f4a7fc95a6a7786d1aced8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f081a02d8bbd5d800828ed8c769f5d9

SHA1
978d807096b7e7a4962a001b7bba6b2e77ce419a

SHA256
a7645e1b16115e9afec86efa139d35d5fecc6c5c7c59174c9901b4213b1fae0e

SHA512
7f3045f276f5bd8d3c65a23592419c3b98f1311c214c8e54a4dfe09122a08afb08ab7967b49bd413bc748ce6363658640bc87958d5e0a78974680a8f9beadf44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a79b769136e0f49b610fdb93ff8617c5

SHA1
eaf0e9bae914904a93905eb40fcb2c8ed1800c75

SHA256
22ba405080c8957dcf55576af7399e5dc7e855cae90bf48950b536f16043e3d9

SHA512
1550feac224a13fc428120bb10e33778270224b7c1c8b6faedeeaf1b3908bb803a12c95ff77696a36f06f16a82fab9873a92744a6204f9e414d48d355e3d03ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
b30668734bb43b20d7d01c22312d36c1

SHA1
0d6f361ce08441d53fb346c0d40516470476d3a4

SHA256
c39c4afb2150f65c1781d713c6ed9989716b30ba5ac0fb736af732f5b0e9941a

SHA512
78c0b2de0c4de49778760d11eca2ea518e59089f68e8c5fec3af7e66ffc157a986996982b0b71b274e2d5eab56b3ac2139c0a495abc74e4fd8f703039bc22599

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
df06f56163d5da84552b710fd4520b44

SHA1
33d62fef1f6de4931ad202fad1b20a5eccc54c37

SHA256
c7727e24aa6ea6b4c35af4cdc0696dff46a938afbe839e5b843e8500b8b7dc1f

SHA512
65263728c84164dad0f5439df78bb0fb0279b75f4291480c4b91237e2d66b0217c42872c9bf0d853179f1a620d8b69b63759289a2cad155bd1f45b223ceea087

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
e9aba106faf4ce40ca4dba17e1a3602c

SHA1
c2e55e7287fd12fb3d1fd24a687fa5d2b2cb3135

SHA256
84542e50775a65af8396e1e083e2f1784622995696c4ab092130dce28273f4d3

SHA512
dbe52f6ddc920fb31923cb8839290e22288f03b2b17752813af531f6285425071f5cc32e70945b303cf3fbbc8a97931e1ba3c851889689edd226c98542d62971

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
decbec30bd22255387013a99fdae3fc7

SHA1
4050dbc20df48d0987ae5331092beb6e85f90b36

SHA256
ef755c74db2d3a87f03ffcd7a746a619a36d9633da9990fa710fc8060567003a

SHA512
d093d9a3f333bcbf87ba0ef50ab24a4d5ec0599eeed4311ff17f7a1045c00c0e6ebbeab63ac28e14dc4bf12b8c0e1526cb5d69f231cf0a48325269ec13a36947

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
2664db68c8a9195f6796a596dd20c182

SHA1
ac9ff995c8e71366cb79ee577a1c0218c2bd4d00

SHA256
24b8f16e6291c95acd4f8ed1f3e932e61900f516ee8d83aef267850cded94819

SHA512
75fd83b5a26d921850e2a7c05d3488f17fbcacd7da51d0405adad46bc30cd103f9ede9174af18d773c6588d26f04b0cf3ff6ee7d6bb62a40dd695966202a6bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
c8327c2f7cb4c8249fcdaaa640f0a8ff

SHA1
fb3d0aaed867175005e8bf84d966c4673e675a64

SHA256
c2586c90440014ffcafaf7a0c58821c31f673222f4bbf8d5b3707cbda3758e92

SHA512
b3d9cbb780685137859ad233c17ee2dd8cdddbd0a84fbfbdb467135a85c83173fee9f4f80a7e7491a70960804b14a84f44f000ee238da4a4d9d7566150058b98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ace19d4222dedf26b0a641d39703fd69

SHA1
6d768217d089c762f4762019d1bcf78ebdbe20c8

SHA256
36e473eca1167fa3e1db0d9d06fa2e971a35707d20a88b2f05592d25b238db29

SHA512
64ec592b42891a33c1139e1721dc150b710adf478c070fc6ace8cd449ffb09cbeff3bafe76913a789d8b63999d332b184e9bd81c7214dc06d03d158474a2afe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
28KB

MD5
52e7b8b93a09aebbac0837b6da975b0c

SHA1
2e5ad432162431460f82d007170e35111feacef8

SHA256
d50f012cf1b7c50e009938e212d666f821feeef747f78022f9257cd0fbd53411

SHA512
7e82e40b9cc6e254cf712cf5aad3d4ded4fb47f9b69f74cb8b542c92af7e938c04267c75d52b8ac6e4f41ddda9d53c8d08406b4288f2e96b3503442773bfd58c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
28KB

MD5
88d1474b59f768cc3d9c7688fa5f4281

SHA1
7d19608b5b6c425a23abac45be1b700d63db8c40

SHA256
17df40d34a22cce2daca0a35a7acbcb7ebeb00ab3d1d5220ad24ceb287524504

SHA512
66898c5cf1d29aadec9b0902e93ac28c871f71a302dbd3a0e17e74b04698d1389c08c2608fa420fd1b39fa9f2e979db8fd3a15ab46ab02532f260650630a8f3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
14223a7bf7686c357a69e39888b00d4b

SHA1
39b35813588850ab869763cbb10ed32bef07515e

SHA256
42123c3e9448d4fb4ac44e4987b307656e969d358c49b643982913bdf382c294

SHA512
476a6000bd9e45e78e55fb725783df10e11010cb5ee236a35cb02a93f1e256f2d5b47ebcf02900b730cb1963ce139cd31fe1f11e00a4966aa55e6c83ba7b317f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
c222e5ae1e14e88ba0d1e54632c675a5

SHA1
7d04adb3147d7a18c7c6af1448e9756fa180cccd

SHA256
28879bcd189f66b8cae0984f7e6656577c87cc5ae3e87376c18a12941bea6e4e

SHA512
3160691b8e0e5c8d731bc6be05417f6376e2b7bd31d60fa3a96b05f1d48e949adde4e5dd0aedbef74aa5691257fa6ec45f20003d9f62053e8b3a205d630d7f6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
3KB

MD5
83d58843d8a6f3e908c0e40587108093

SHA1
e52f1c63658ec4ee1b169201b3cb3ec33ad98ec5

SHA256
90c040637ea7e9c5cecf18540b6e3cacbba9ef2fd2049a32147a2b0945161e68

SHA512
0207c05257d19f4ed8b702cf4d6473ad9d076cfe652a6109ed581e640b3753da5dde7370bbf4e2a9a806f2547d8a948ae85273e51acb8700078fb4ad8268397a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
15KB

MD5
3b512615dae3ba29ed14dcb8befeda91

SHA1
e45d3b26319be3521734fd649eab288f4748ff3c

SHA256
40a48b84a06e27fee8dde52443255a996db547fc5d2d91f4decd794d582ed537

SHA512
affb4d4380b0e9746025fbc33f9a08e6a55b8eb33112b133a9845b2bae358c224a6843db97a531a7f0c499e8997198b0b0191f2e0e23a0b25f758908074bf95a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
10fc51d67c1c8c0cf0ec187903048bef

SHA1
60b1d9638dcdefbb0f94e3698e17a841cabaf515

SHA256
a731152b25ffcac6fd273f51ce96b0f8f8faae7a149bf0bda2c0a380f2db2542

SHA512
c512795dc9ae3b6956841d4a55ff2fccb739b284dc3ce836b3a2090804f1bc011b2eb7f636a1a550f3850ce21f0ef3631cb9e4ebc94d63767f51f0468cc9b37f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6559d62b9672a60bcfa5a90010d5b68a

SHA1
16f26513fec0407ed0e7b5c870e9015188a7a8fa

SHA256
28eeed8377c920d1f5fa9342e05c69a6b22ed28a4ae61b54cf707c389f7f34f2

SHA512
bcab297269814e93ff28266aa68145f3b35907eefbb2429922cc556797b22b3865f7e06b283c0252893c571916319aa37e858bb2b67a7d9c3ed6a714d4618583

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8dd5ed468f7a198d01b289459cedd138

SHA1
7d8e946f6258837fc993902b5f539d6e94a2e877

SHA256
584c9a030627a053c124412e503ae0ff688c002133b9a465a3137282d1f3ce62

SHA512
52eb57aedc2fc80e9e961e373e9258bb5f4fa4c7e92ec504d8a0143c7aab75b3439891479ca5c462b3166f452669ed20ec1e802fb2b97d734b9a15bc05381b63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4187c4a5774b9ac32e778e39a4c5cb93

SHA1
5bb6461bad1a307f65395b7de6c17329d7666c88

SHA256
cdc7e1e670f12813e0e6a2ae8a34621bedc96060116553fcd2c046bd2d9ac191

SHA512
2ae447a725907d2875fa400a95e782db5a101ab79f072c1bfad2808c8a75074f469fe7af22003627eece46f4ae512580b0744e0fa41f83562b364993d6c58ebc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4ab77e704fc73d3715a31ebeeda03476

SHA1
bb49b3f953405f3a6fb7cd1faa8c13f6c93e8a16

SHA256
7d65ad6bb0cae0331f86e2348fb24dd347a542b52a461abd89645f0572f5082f

SHA512
2756dfdf13d09a74265e04157673e7fc4cbcff58a70b2fec94649090c061fcc2af942e44bbe37563f84d77732f26662b5d351fd9eead0a057c3d47181bf6b978

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
69fa4311437e24b544b2d2ef2178c1b7

SHA1
7f659723db46feebe06230ece5ff5e94301498b1

SHA256
9fed050239dbf742dc24ed42817727852468ab9ee1e654b58f759e0352adee64

SHA512
ca5458dde69dd5f07effe89ac519f1b599a556bb81b710fd47b4678470e2bf628dc118cd72b9962a14b40b0dc0132529682a10fb0f7af355920963010085a3f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d09002b04d3856cfeb2c5c64374f8377

SHA1
22de2d6228b1710ab8b5b033d2bf20cdcd18f8fd

SHA256
de40507761c825ed3b30b8034d5a3c299af88529be274d9f3ea8f93fdc86f006

SHA512
a954cd8a6e43f7c7e01f0dea2d543936c48bd8666ae3e7e9ccecf3e71d5e8d87168e1ad44983b348e30fdf35c6c0635ada3287ef1d17c6785af850fb87e92470

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ea3926b16940fbfaa5269b0e81066a1e

SHA1
a87657804d0134e0622cafb33e82eea6995f0f51

SHA256
a77056cf232a36623fb0541ce749430c9d9b26a05a9ce663c60b226a1fbf3b23

SHA512
8d77b62947af75e62f30b3c41df45f0b254d76bcd4686045a8b7a14791af2c081d3707f652dce5304a50b36dad4b7c120b4966fe94454a3d93fa4e1b5306cf2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
013af89787ef0ea8fa1e38f1e9b9769e

SHA1
28342c5e23433c117bca1d905ff7439ed1ac89f0

SHA256
a0b3781b23d8806eb7f30b7548b5469a31b4f31f7088468de03a5890dcf1479e

SHA512
081cea67da5355041aadf7452d4fdd97fce8a4b1a11b21a7c33a89ea72db65c9a4d0efe703a10f9b6cc113cd6d4c79405248df4e62ad13f7ebdb8808eaa3e695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0a190eb16b8f07576b2be112fb36e0ca

SHA1
11b6534670fa893f13320d9a8d88925d923a605a

SHA256
6b01b4b526d3571969d03e6ec20c450cc3efad46a72c38b60a0e7f3d818bd178

SHA512
6e94e9b3cfcb11796e7ce0f9f06cfc86e0b974eb465d1a2f1538e5460c7a5acb3f96e26a0bc9c1887799e5d5d3e2a246638280186d5459e8decf21452d8c8cd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8e35c3ceb3dea3f319076d39e3e8cb10

SHA1
5f7a0a4cad33557dbc368b6c06cd7bdfc28dc51b

SHA256
2830236ae38d3c9681846a15b0a9a2c7b9e97007d4c9a854370555749c013a30

SHA512
052954855577d28d27f702d855a300f15dd14910536ee7e87f91b495d2ad30ff11e1171dd3cc8c6e66943973f62fbc14c7684a3bbb91177d49a4bf4050003c09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e87878e1825f5a180a1f303e00543503

SHA1
97d88e686f88b732b24594dd0f874e1ab35e9c5b

SHA256
c848d82a362c09fb0c32a1990dc3892334a2d0cbf3e375d247e8544586579f6c

SHA512
06808b7b4e6ca84666a33e8a1502337bff77ea39dfe26822eaf49cf52e4b77ae6a501db107570d38d3c925979326f5f03df712121d2a929c45a3654f8fbe12c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
1KB

MD5
02e3972c25cbaa125daf522949575f17

SHA1
cff87c78581f9f6e4107c80c7512552e6b1e91e0

SHA256
ec6d8b5f61d153ac25d99af24509a62491d4eff4632b1e16e74482f5b7d8a145

SHA512
872394e788eba43d6724fa17486d7839cba85b7dc152824e44a1c39a16441210987c6232405846fb37cd81646008072bb80efdd240661c9dde49f2beb9f06faa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
2eb27e1d56c2b1679cde3555546c7213

SHA1
338f79bcee8523e3095c20c7a153599bd37444a3

SHA256
dfee2bca065443090e91f614bd55cf0a824f1706e232f56f2e500db28cc99af0

SHA512
6e2ad937acb972321cf10bb43ea1a38160f0f72bc4f4280e94b26cda53b8c9caa59a9388ef2e1e559257c5ff1f2ea3fb6b8e6f0e809a64563910d196427a68a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13368743983253588

Filesize
16KB

MD5
9699467e3586259e230545ea18a0a97d

SHA1
df685b3c720a801e5aa2cbc921fb58f4e4367ef2

SHA256
0d23b346c2da367a092d9a0634eb7ee0efdb9b10ce290d13c0193d448829ff88

SHA512
06ffec75787211fb3ad04854de76118d1f503c8aa25346dbc60d2007110a8c16c6a3226bbe1d4afcd79221b64526c06988c917117bdbb0cf4c8b670e1156c1f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
184B

MD5
0b0aaaaed57a08c3d0f5871320ddc6b2

SHA1
3eb9964d2f0466efb5b24d53ea84e1023a0a69a7

SHA256
6db9981df6ff2caaa1dcf5547cb6aae7de1021b0e24b561cf565f4a8c0702463

SHA512
465dd4b04df503c222ed160ace069dd32d70a15f89892097ee400cdf6f6079a2cce370c328c048bf166d1d18f973757e5401f118cb5df718f8cb62c4036f3bd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
a7362c78105259de7c33203267e5f64c

SHA1
e95a608cc0cf231e2cddc90fc7b5aa43bdb0df69

SHA256
e7fd9174edaf4c3b3d736b55093bc326849a2de9eda8ecc38edf563991c05e55

SHA512
e887464d1430242164ac67633ee3c2e84962be85a3026c1a35d94922fb571ef04397bf742eca570f80dbf513c514b87e449638e18e14957eace504f0b9cefb59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
cfeae0b4099bef915365c11c9cbe7dcf

SHA1
a117e81180d80f897fe4a3d4a7784fe1c0050f88

SHA256
b90d4f4ab74ef6d402fc65008e9ba122578ed971579d70556be4083f0a6e0d13

SHA512
c34f1f691d7a7291e1e404186dea826c2a72158c0fc7224c178dd24656bb797625d16a57ef29747ab42adedbfbd9a2f332a560434f638dc9df0806f04ce02c05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
be2941498b1a0c2f24e7159c585b1382

SHA1
f0f76bc58195acb1e526bf02b79272d2bfcd5760

SHA256
74fd27ae9d74760ae045173f76efeabe080fd9671df21a650a5a8cfca0117ecc

SHA512
a4f7fe9e64ba9e41ed6df6d9fcf44e36dd0899e3fddcc15b0c21520c3b0f0a25ffef64870140fc01db21930f27793fc59631bc68191b045e98711d253002989e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6dd5dd9d2aa0eafbb6ad38af2919c76b

SHA1
8fb7af96749e5b6e9c3fd843e0b7068c0e6611cc

SHA256
320a3f539ec127e8a0e9d06dc9d7bb8f33d474639854dbd258feebc830aa4c1b

SHA512
fefca2c77823c217bafa78427e2126f0d7f5140e2cdc0bacf07f13103bee799b2df6fcf44fbf48aee70340a03945ff486daf6d11549662f878d51bdca65eedd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ced30f746f0e7307c20a15d4a5c207c6

SHA1
ae53dd1175f185cfe8b30c3780b4ce4d21359f19

SHA256
1c06708228a7ed01fc4a725b7ee99e0c8a1fcf1fc12ed4c8112858bb92672c3e

SHA512
47a5934b2d7991c699d59c29b5ccbde58960c9277f07a36ba54f9696863fa4613d226da7091542ba75d0456f9719c8a9c1d11a0d8153dbe213cb11c46d5d207c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e57a34f8ffaf79bee5fe9c6c42bd7eaf

SHA1
17bb991d4b1296117b749c7f62fff8000de13d4e

SHA256
f69fdebbb870864ced7a83805def6d063363594e7b22d0f8b6ca92f49219dc39

SHA512
3b028bf387ecbcd1bb08739a77182aeddff0f071678a42d751a6cccadcd7100230a338eecd9eaca79852d1c3fccfb81e03179261e4abddbea8d59f16c9d7c656

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b6cc2652a2a7816f9f73ad2f6f1ff765

SHA1
7c76eca38aeff3878e53f18637067e7dc3f0d8e9

SHA256
41a8b0b8b47aec58f51cd533e7a509fdd9c23f333164d52e825c7734448403aa

SHA512
4e3cb06a9f0ffd14c0deb929b6a0ea478761bdfe2c00f8e0cce808f6723d76a12088c77dc752dab9116ecc271c970ff29b4f1f73eb204e45afa6f230da357e51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
24dfe219e6b8d23523b4ae09f12d4a50

SHA1
42aa72dcc6f85eabe40e464080bc550b69c2c037

SHA256
7ad34ff2147aa2e2b32c9ba952df97cec02449696ca4388b14788fb3c9aaabb0

SHA512
113114a2a9ff1f37f0f1e31f6b7226bb14380e9c106d0aefd9c4a52902bd358f36540bf860b35392448ac04f9aa8e3b3cdd3b343f35a60c1990817b47c2aea34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
446988f727cfa1a98f880086728ee6bb

SHA1
457bc29e1ae74731ad32ddccbfdbc5ff4d74cb7f

SHA256
46c5265f5a18a3c3b7fad6e1e449202357600f6d1fd6abe1a1992a1986086437

SHA512
7a7b97b8343387bfc7835dc960f986f23c2b1c825f7931992bb10004cb714ac2789dd61472928b291ee006e0a8d03c813f43f9860bd3d7ef2302ea872a9ddb6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e230b5c08c90b9c2c1cd1bf309e8912d

SHA1
0b35a53c9646d934686a86c5e2c3692bf65af157

SHA256
9e55a7163fb08ad8d3a5a990d2584c21516697b2447652538b8f5040ccd5b5fe

SHA512
3fab0bd3bc1d62828388fd11ae7d5ec12e9ac1f46ecf505546f25be6b9f9203d4f9820bfdad882e1da6f29c6ef745c1af7f77b03db7a0093a0133e26fb6ba85f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3087815756c70fd38375629073f4e284

SHA1
a0fe3610aa9246509e003bcf84bbce9c3ac2ee8f

SHA256
9b7752c112441b985d5d974db34db3d4260155bddc37f26be87963bc1ac20fc0

SHA512
15bb71f927ad44d948255fd249ed6aa680d9fb52610ba9f164bfedd5f09b27fd4c426dadb7d1bda86ce8342950d2616a2a441bfc3a8cbfb3d9e2758009f767cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c121f5ef3b5f4d752694419db0eb667d

SHA1
e1f16ab26c116fd4b973e5ff5f6550f83ee04cf2

SHA256
1ac88d039433f4490a1481356452690674656558253bd69ad5917a33d08a6dfd

SHA512
88229d8fb150d33f44a13b085e2ee92e35d6587dfcadfb289c3c0983ccde8e68f76ccf91205ee22bbec7ee74c9f344e055cdfa0e9f1c8ed674c559a98f224923

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582d83.TMP

Filesize
204B

MD5
475d1d6bf901355c9a148b00e6e56c80

SHA1
b30fe9fd2966344cc4fb19fb040da651ac977e29

SHA256
43555a486e99f4f7e2aabd05971a5dbddd14fed573c404d113c2aed43c8590e1

SHA512
d267f6516c94553ca933d8c13481f29340a6455946e6c042103f3c810e8b7ede93fe2946293ba94a61b87a5e9bc46bc6be02851f19aa8b2becfd51922e439d44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
e19e55165b98d838d5ea241c9e735327

SHA1
e3b057ebbe6e3b59cca05026db93bc5c9079df0c

SHA256
1d51d60b9b9a7fa798eb7c769b6d6041ca160a2cff135125ec495d9d1d8e2e9d

SHA512
1ab6757cc860c03b68322097f237cef5e2da77460fff8de749e72ebb15a9f5d4abf82cfafaedbc0da78614e3268b95eefe5ccc51d99732c5d07bc9bb6ca83f8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
112KB

MD5
c1f3dedda0a8e8c18849c3a1abde78b9

SHA1
6e6da0ffdf62a5be810eb30c25910948fc15d264

SHA256
8a1e9127cb42c0566b17c9c41ed42f34e80c501eda7e565e4a02db8468705a9a

SHA512
0a7876f006ff30f8f656d08f242f8943b30b811b3709619dbb8f7914231154ef7b51b6301fe0c60a861a6b1604d4f89a8d5c3d218c6dd29e09e24e5638de42fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eaf1fa7d-acd9-4e6b-9f7d-ac4fccbdace8.tmp

Filesize
7KB

MD5
6b7848d33e8f1d8666eaba32c12f9c10

SHA1
b5dfa724ef367ba7798d13ea1af8e9694782ef2e

SHA256
1cae9fd891cfce2c916284518e9bc793c9a1de3b65f775986da2be7bbf90c673

SHA512
fd14bc3efc0645f0cc272355d2ad40428db2060292dd756730b36a66562780913835d18b1ef1bcdd0744255b04ec5b322f10a8ba9b1843e7a8a796ca9616b217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
72KB

MD5
47a6f63e4e454d2a56429be21399a939

SHA1
1c86bf8ab77411c2d32a6326539be0f596b125ec

SHA256
01ef83fcd801866c4a9357db48153d1f7a491e0caac9d396154094106b20b93a

SHA512
cdb28103c35941280c569e1c2063b4eb846a70f910ae9a4cc7e33275f20272659c776da101c18b232962bf15e5a4e7b9cd2e7023e7d4b402c9565fd94a0ba043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
4KB

MD5
ed01f8f66e6466293e680d62e0b88077

SHA1
a26cb052f2798abfb215c466cc506dfc32af4ff7

SHA256
99e801c8e8855311e018f1226ec50ad3b120a22d907162a810a4eabb3bef71fc

SHA512
267679c34aa915c75de4054d37728f48b3f5ca7ddfab3babf9c28dd33436ec208b607582532347ba571f11895d3758d07b77c003c9c0e5576d3bc5bcc58ad642

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
322B

MD5
7e35cb431b5b905285e9628b59a19551

SHA1
d9e695a84671fc493cdd8a99fca0daa4b774dc11

SHA256
010a0c3c614d358f3bbea02c1d05e1df901c2ae05787709aaa014d7e1161e844

SHA512
e8bc4a979b4140cc012631189e0de144c81c651d9e10f60ba93d628ee059452b8f0ed12935d37d6b87f4b05ae9ed454e75aa830a1c0785826d9bb0db238e129b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
318B

MD5
e1cae876a518bd4b45eaa245cd61790a

SHA1
3b94948138d6f95cc1cdd161395c40aa90b242e5

SHA256
37a199a65ba840b590baf9914aeede2ab0b7df58b9148fa875633f390ebf943d

SHA512
15a62144711c143e45095575d6dad11419b88df7001b5ac2efd7d16bf89f4ce5bf7bd76d35361c3453dc837790ef54b5bd0387ae7446617eee3d0681392e047e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
c2f02b0f3f61a555ada8f1b8e81e0b7a

SHA1
5f2c04a0cddef63346faac200157907be2a01382

SHA256
9db8cb196ea7125a59786f93171699317c6fb209702b78c7906ed40ed6fe760e

SHA512
7d04387e87de7b9a2361ec713ec5b6ee24c498ac51c0654e4aa40aa281fb0d18d49625e6d7dad9f854ff7772ad00aa0b11222dbaecc28f01076096f424dbc803

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
741328d7045eeb430060f01a1166674e

SHA1
88f6269e178e53d988e3b5c841c1d6c09ec578d3

SHA256
def9f1b64f5dfd6a1b3dbdc7f5911257cc2fbe892cd3cbfa65037a3692341aaf

SHA512
f884c54b7236780f686e4ad50afbd4e31556160ca533a4b5ad5728dc7d507d2a0154882b2c5680ef15803b825f8eb574a1738153b3f5ccfe48359ea602533bdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3a78484f246cff52788ceb5677c9c08f

SHA1
912b8336b9fdd3d65629e73d7075594850468087

SHA256
6c4f4d0fddc85c0b59867026ac553ca0ae2c4552cc2c0dab2dec87bfff3c7b0e

SHA512
7f5e3f43819df7b7530de1904f1846db39d55c4bf80d0953553b545021a40cf4a2c50e3501c4e20c250369e6c64da4476d727c23c0f61ada649bee3b8fc387b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f0d893d7f588b32e3e1caa7ef8b05727

SHA1
391446d2f7fe8635f45eaaf226434aa6d83b8cac

SHA256
f330cd31075b0a93ad7089c3b198c0f670a0a53aef4f85726c1c24d76dcf81b4

SHA512
775ffd763c6073f1cf81642f184507f1e4e285644e9ce59e86027f33e4384eb0770df38166633ef949dd7bbdb8ba38a0f4fbece1bb8cf53cea0bb07cc8a28bb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
03bd17f8b4c4cbd4b8b715271e52950b

SHA1
1cc51918ca3d462b115466d3f46baf65c8d58f96

SHA256
2c781bce2c4b032d3019c8e47cfddd471f9d91494833f440cef8128ea31f6d6d

SHA512
174bae69b0f34d8d676b8782f1af4cc2430deba994b615a59e380122df0e76c8d5bb10ef0d5bec6bf68dd5bfdc077dffec77c280201446c0bf1937081e5c7c9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
329362ea86a6cc90b5de52c2f7a613ab

SHA1
037581b1282626b3efc26cc699c38ad599cd5d24

SHA256
1316615abb702284eec27a834000589773a17a5b9cb1ac65c7ac2a17af7c78a5

SHA512
3d3cd3218087b677ea72ee06159e7bb3a16776f9216e41feb6b9685b9f72fef11f8a11fce1cee97e9a12953e671aa7dbf10f9ae758bbc3015340810b7430aa0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0bdcf1d0ef163130b8d908eea885ab6c

SHA1
f57661ae1160f9fcd61210425f45299451516746

SHA256
5e6cfde773f9acf8bfe019b316f7bc7fbff5d90bbfa5f5576dcdecf53f8f145d

SHA512
8015024db8aeaec5117c6393feced6b31bddcdcda394ae9c756d161fe2087f49c193cdf4cb089794c120cb84442de10b82cee7ab90c372d6ecd635d22a9ab7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
cac60d72be96c73ded50b3bc3acad991

SHA1
aa97aad934ee19655de5a37a4d9251637a635d99

SHA256
dc654622b6aa9707f4b00bf59d1e6aeea96a3ab75a250cf4c33076831e41c411

SHA512
b282edc83fff9d9cb087c5e52cfc3ad4030d191ec58ccb770e950790b8148a7c9a27a92a54cc578e55d7af7067985ca52b7cbf19c6a25c7fa9ae605145c9f2f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCDC3D8.tmp\gb.xsl

Filesize
262KB

MD5
51d32ee5bc7ab811041f799652d26e04

SHA1
412193006aa3ef19e0a57e16acf86b830993024a

SHA256
6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

SHA512
5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
337B

MD5
1c25b00f65c145c13c0bb130b2db6231

SHA1
13f0015cb2cc4b41f0c1b48e0bd29b746177d315

SHA256
bf94ac45b1e252b275016a9d56579d1049d49b351697c2d214fac39d5daf91db

SHA512
1b2ebea5953a60d287fb19e2cf8f88dfcdc54ba091275bf690f96d01a220574e9a577ff1491040b677bd66231012a202bf44339a2d54f93eacfc3ca64e3c46e8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

Filesize
31KB

MD5
63034ce0a45b675efd88275fa85b1c94

SHA1
083e30abaebd2e405988ec472123633d7ab89e5a

SHA256
8bac075380b601d344c3eb3852f43408aceb6b3fe432a233d2d3a11c472c94c7

SHA512
48d55624850f09e91eb029ae2db845f8e2103dabb98a9bea840dce5c42fda87f7a780b1abc375c33922e2e8e7eb42f463d8735f54fcdfbbe4dec3788fbced8f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
2KB

MD5
294e18135a562e8247e5ded2e06e5bcc

SHA1
c5a8f56429ed92efb20c06c92b72f91a583348cf

SHA256
1463691d4127cb400c4b79a46f53e2791810e86180bf0b1351f41c920bdbb788

SHA512
698ec002ba1f9b7089a5862cc098892e42850d05f0db088acb3e8e1ca9c76022af5cbf54ad0c8025f2c71cf8791bfe0354b72f4c04e6f8abe0b89e153532c0af

Download Submit
C:\Users\Admin\Downloads\MadMan.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Melissa.doc

Filesize
40KB

MD5
4b68fdec8e89b3983ceb5190a2924003

SHA1
45588547dc335d87ea5768512b9f3fc72ffd84a3

SHA256
554701bc874da646285689df79e5002b3b1a1f76daf705bea9586640026697ca

SHA512
b2205ad850301f179a078219c6ce29da82f8259f4ec05d980c210718551de916df52c314cb3963f3dd99dcfb9de188bd1c7c9ee310662ece426706493500036f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 120922.crdownload

Filesize
532KB

MD5
00add4a97311b2b8b6264674335caab6

SHA1
3688de985909cc9f9fa6e0a4f2e43d986fe6d0ec

SHA256
812af0ec9e1dfd8f48b47fd148bafe6eecb42d0a304bc0e4539750dd23820a7f

SHA512
aaf5dae929e6b5809b77b6a79ab833e548b66fb628afeb20b554d678947494a6804cb3d59bf6bbcb2b14cede1a0609aa41f8e7fe8a7999d578e8b7af7144cb70

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 180720.crdownload

Filesize
1.0MB

MD5
055d1462f66a350d9886542d4d79bc2b

SHA1
f1086d2f667d807dbb1aa362a7a809ea119f2565

SHA256
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

SHA512
2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 510993.crdownload

Filesize
2KB

MD5
a56d479405b23976f162f3a4a74e48aa

SHA1
f4f433b3f56315e1d469148bdfd835469526262f

SHA256
17d81134a5957fb758b9d69a90b033477a991c8b0f107d9864dc790ca37e6a23

SHA512
f5594cde50ca5235f7759c9350d4054d7a61b5e61a197dffc04eb8cdef368572e99d212dd406ad296484b5f0f880bdc5ec9e155781101d15083c1564738a900a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 664793.crdownload

Filesize
32KB

MD5
eb9324121994e5e41f1738b5af8944b1

SHA1
aa63c521b64602fa9c3a73dadd412fdaf181b690

SHA256
2f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a

SHA512
7f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2

Download Submit
C:\Users\Admin\Downloads\WinNuke.98.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/4004-6330-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/4004-1801-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/4004-1814-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5672-1718-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5672-1717-0x0000000000110000-0x0000000000185000-memory.dmp

Filesize
468KB

Download
memory/5672-1715-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/6008-969-0x00007FFF05B30000-0x00007FFF05B40000-memory.dmp

Filesize
64KB

Download
memory/6008-833-0x00007FFF05B30000-0x00007FFF05B40000-memory.dmp

Filesize
64KB

Download
memory/6008-834-0x00007FFF05B30000-0x00007FFF05B40000-memory.dmp

Filesize
64KB

Download
memory/6008-835-0x00007FFF05B30000-0x00007FFF05B40000-memory.dmp

Filesize
64KB

Download
memory/6008-968-0x00007FFF05B30000-0x00007FFF05B40000-memory.dmp

Filesize
64KB

Download
memory/6008-971-0x00007FFF05B30000-0x00007FFF05B40000-memory.dmp

Filesize
64KB

Download
memory/6008-838-0x00007FFF030B0000-0x00007FFF030C0000-memory.dmp

Filesize
64KB

Download
memory/6008-970-0x00007FFF05B30000-0x00007FFF05B40000-memory.dmp

Filesize
64KB

Download
memory/6008-837-0x00007FFF05B30000-0x00007FFF05B40000-memory.dmp

Filesize
64KB

Download
memory/6008-836-0x00007FFF05B30000-0x00007FFF05B40000-memory.dmp

Filesize
64KB

Download
memory/6008-839-0x00007FFF030B0000-0x00007FFF030C0000-memory.dmp

Filesize
64KB

Download