cryptolocker | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Analysis

max time kernel
454s
max time network
455s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
24-08-2024 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

cryptolocker dharma warzonerat aspackv2 credential_access defense_evasion discovery execution impact infostealer persistence ransomware rat rezer0 spyware stealer upx

Malware Config

Extracted

Family

warzonerat

168.61.222.215:5400

Signatures

CryptoLocker
Ransomware family with multiple variants.
ransomware cryptolocker
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

resource	yara_rule
behavioral1/memory/26080-22850-0x00000000057C0000-0x00000000057E8000-memory.dmp	rezer0

Renames multiple (438) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Warzone RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/26352-22855-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/26352-22857-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat

Downloads MZ/PE file

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000800000001adb4-23885.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\International\Geo\Nation	butterflyondesktop.tmp

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus (1).exe	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus (1).exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	CoronaVirus (1).exe

Executes dropped EXE 56 IoCs

pid	Process
1816	CryptoLocker.exe
528	{34184A33-0407-212E-3320-09040709E2C2}.exe
3836	{34184A33-0407-212E-3320-09040709E2C2}.exe
4244	CoronaVirus (1).exe
2804	CoronaVirus (1).exe
23528	CoronaVirus (1).exe
23840	chrome.exe
23940	chrome.exe
23948	chrome.exe
24080	chrome.exe
3160	chrome.exe
24144	chrome.exe
24304	BlueScreen.exe
24604	chrome.exe
24612	chrome.exe
24696	chrome.exe
1840	chrome.exe
24756	chrome.exe
24880	chrome.exe
25104	chrome.exe
25092	chrome.exe
25268	chrome.exe
25440	chrome.exe
25412	chrome.exe
26080	WarzoneRAT.exe
26460	WarzoneRAT.exe
15076	chrome.exe
27196	chrome.exe
26244	chrome.exe
26004	chrome.exe
27216	chrome.exe
24784	YouAreAnIdiot.exe
25720	YouAreAnIdiot.exe
27272	chrome.exe
27316	chrome.exe
27388	chrome.exe
11456	chrome.exe
27456	chrome.exe
27520	WinNuke.98.exe
27624	chrome.exe
3728	chrome.exe
5960	chrome.exe
6976	chrome.exe
6940	chrome.exe
8572	chrome.exe
8980	chrome.exe
8524	chrome.exe
12048	butterflyondesktop.exe
11836	butterflyondesktop.tmp
2344	ButterflyOnDesktop.exe
22364	chrome.exe
22632	chrome.exe
6688	chrome.exe
10792	chrome.exe
8092	chrome.exe
8824	Melting.exe

Loads dropped DLL 41 IoCs

pid	Process
23840	chrome.exe
23840	chrome.exe
23948	chrome.exe
23940	chrome.exe
24080	chrome.exe
3160	chrome.exe
24144	chrome.exe
24604	chrome.exe
24612	chrome.exe
24696	chrome.exe
24756	chrome.exe
1840	chrome.exe
24880	chrome.exe
25104	chrome.exe
25092	chrome.exe
25268	chrome.exe
25440	chrome.exe
25412	chrome.exe
15076	chrome.exe
27196	chrome.exe
26244	chrome.exe
26004	chrome.exe
27216	chrome.exe
27316	chrome.exe
27272	chrome.exe
27388	chrome.exe
11456	chrome.exe
27456	chrome.exe
27624	chrome.exe
3728	chrome.exe
5960	chrome.exe
6976	chrome.exe
6940	chrome.exe
8572	chrome.exe
8524	chrome.exe
8980	chrome.exe
22364	chrome.exe
22632	chrome.exe
6688	chrome.exe
10792	chrome.exe
8092	chrome.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000800000001abf6-22672.dat	upx
behavioral1/memory/24304-22706-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/24304-22708-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Windows\CurrentVersion\Run\ButterflyOnDesktop	butterflyondesktop.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Windows\CurrentVersion\Run\ButterflyOnDesktop = "C:\\Program Files (x86)\\Butterfly on Desktop\\ButterflyOnDesktop.exe"	ButterflyOnDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\{34184A33-0407-212E-3320-09040709E2C2}.exe"	{34184A33-0407-212E-3320-09040709E2C2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus (1).exe = "C:\\Windows\\System32\\CoronaVirus (1).exe"	CoronaVirus (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	CoronaVirus (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	CoronaVirus (1).exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Program Files\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Public\Music\desktop.ini	CoronaVirus (1).exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3699363923-1875576828-3287151903-1000\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3699363923-1875576828-3287151903-1000\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Public\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus (1).exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
36	raw.githubusercontent.com
37	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\CoronaVirus (1).exe	CoronaVirus (1).exe
File created	C:\Windows\System32\Info.hta	CoronaVirus (1).exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 26080 set thread context of 26352	26080	WarzoneRAT.exe	141
PID 26460 set thread context of 26700	26460	WarzoneRAT.exe	148

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-60.png	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_ja.dll	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\ag_60x42.png	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_pt_135x40.svg.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\main-selector.css.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaultagent_localized.ini.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HalfPrice3.png	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailAppList.scale-150.png	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ppd.xrm-ms	CoronaVirus (1).exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-60_altform-unplated.png	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeBadge.scale-200.png	CoronaVirus (1).exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\svgCheckboxSelected.svg.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll	CoronaVirus (1).exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\dailymotion.luac	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui	CoronaVirus (1).exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-32_contrast-white.png	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\lb_16x11.png	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-24_altform-unplated.png	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5666_20x20x32.png	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsLargeTile.scale-100.png	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgaussianblur_plugin.dll	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\asm.md	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\pyramid\Theres_a_Timed-Mode_Unearned_small.png	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_2019.16112.11621.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluNoSearchResults_180x160.svg.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo	CoronaVirus (1).exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-100.png.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-pl.xrm-ms.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\177.png	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\remove.svg	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\ui-strings.js	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-80_contrast-white.png	CoronaVirus (1).exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libvc1_plugin.dll.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Glasses.png	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\lc_16x11.png	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-96_altform-unplated_contrast-black.png	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\bg_pattern_RHP.png	CoronaVirus (1).exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_close2x.png.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\WPFT632.CNV.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Content\desktop\en-GB\toc.xml	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Forms.dll.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\dd_arrow_small.png	CoronaVirus (1).exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dirac_plugin.dll	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\en-US\WMPMediaSharing.dll.mui	CoronaVirus (1).exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msjet.xsl.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\JumboDeck4.jpg	CoronaVirus (1).exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_download_18.svg.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sk-sk\ui-strings.js.id-415CEBBD.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner-2x.png	CoronaVirus (1).exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
25436	24784	WerFault.exe	154
25820	25720	WerFault.exe	157

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	butterflyondesktop.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ButterflyOnDesktop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinNuke.98.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueScreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	butterflyondesktop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
20784	vssadmin.exe
22676	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133689794566372719"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\freedesktopsoft.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 2a903ec829f6da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Pack = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{DED7C0CE-8A7C-46D0-8A0C-9455EF81C0D4} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\freedesktopsoft.com\NumberOf = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\freedesktopsoft.com\NumberOf = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\freedesktopsoft.com\Total = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpCleanupState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "262144"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d8dd6dc829f6da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\freedesktopsoft.com	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "0"	MicrosoftEdgeCP.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
26224	schtasks.exe
26548	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1396	chrome.exe
1396	chrome.exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe
4244	CoronaVirus (1).exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1396	chrome.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
8336	MicrosoftEdgeCP.exe
8336	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
2344	ButterflyOnDesktop.exe
2344	ButterflyOnDesktop.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1396	chrome.exe
7012	MicrosoftEdge.exe
8336	MicrosoftEdgeCP.exe
8336	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 3324	1396	chrome.exe	74
PID 1396 wrote to memory of 3324	1396	chrome.exe	74
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 4348	1396	chrome.exe	76
PID 1396 wrote to memory of 784	1396	chrome.exe	77
PID 1396 wrote to memory of 784	1396	chrome.exe	77
PID 1396 wrote to memory of 508	1396	chrome.exe	78
PID 1396 wrote to memory of 508	1396	chrome.exe	78
PID 1396 wrote to memory of 508	1396	chrome.exe	78
PID 1396 wrote to memory of 508	1396	chrome.exe	78
PID 1396 wrote to memory of 508	1396	chrome.exe	78
PID 1396 wrote to memory of 508	1396	chrome.exe	78
PID 1396 wrote to memory of 508	1396	chrome.exe	78
PID 1396 wrote to memory of 508	1396	chrome.exe	78
PID 1396 wrote to memory of 508	1396	chrome.exe	78
PID 1396 wrote to memory of 508	1396	chrome.exe	78
PID 1396 wrote to memory of 508	1396	chrome.exe	78
PID 1396 wrote to memory of 508	1396	chrome.exe	78
PID 1396 wrote to memory of 508	1396	chrome.exe	78
PID 1396 wrote to memory of 508	1396	chrome.exe	78
PID 1396 wrote to memory of 508	1396	chrome.exe	78
PID 1396 wrote to memory of 508	1396	chrome.exe	78
PID 1396 wrote to memory of 508	1396	chrome.exe	78
PID 1396 wrote to memory of 508	1396	chrome.exe	78
PID 1396 wrote to memory of 508	1396	chrome.exe	78
PID 1396 wrote to memory of 508	1396	chrome.exe	78
PID 1396 wrote to memory of 508	1396	chrome.exe	78
PID 1396 wrote to memory of 508	1396	chrome.exe	78

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff8a60e9758,0x7ff8a60e9768,0x7ff8a60e9778
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:2
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  PID:508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2876 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:1
  2⤵
  PID:656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2884 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5152 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5164 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5520 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  PID:360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5480 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  PID:1844
- C:\Users\Admin\Downloads\CryptoLocker.exe
  "C:\Users\Admin\Downloads\CryptoLocker.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1816
- - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
    "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\CryptoLocker.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:528
  - - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
      "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w0000021C
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1500 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2264 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5176 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5980 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5940 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5972 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5756 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  PID:4868
- C:\Users\Admin\Downloads\CoronaVirus (1).exe
  "C:\Users\Admin\Downloads\CoronaVirus (1).exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4244
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:4060
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:8244
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:20784
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:23664
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:22784
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:22676
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:22724
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:22660
- C:\Users\Admin\Downloads\CoronaVirus (1).exe
  "C:\Users\Admin\Downloads\CoronaVirus (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4712 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:23840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4864 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:23940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4516 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:23948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:24080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4768 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:24144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2036 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3160
- C:\Users\Admin\Downloads\BlueScreen.exe
  "C:\Users\Admin\Downloads\BlueScreen.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:24304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4476 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:24604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4748 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:24612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:24696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5160 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6060 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:24756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:24880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6056 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:25092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6124 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:25104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:25268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5948 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:25412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6064 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:25440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4476 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:27196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5772 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:15076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4748 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:26244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5776 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:26004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5656 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:27216
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:24784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 24784 -s 1136
    3⤵
    - Program crash
    PID:25436
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:25720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 25720 -s 1108
    3⤵
    - Program crash
    PID:25820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1780 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:27272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1620 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:27316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4460 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:27388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4492 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:11456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5748 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:27456
- C:\Users\Admin\Downloads\WinNuke.98.exe
  "C:\Users\Admin\Downloads\WinNuke.98.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:27520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=5176 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:27624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=3604 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=5960 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3824 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5740 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:8572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3820 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:8980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2252 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:8524
- C:\Users\Admin\Downloads\butterflyondesktop.exe
  "C:\Users\Admin\Downloads\butterflyondesktop.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:12048
- - C:\Users\Admin\AppData\Local\Temp\is-P5I4C.tmp\butterflyondesktop.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-P5I4C.tmp\butterflyondesktop.tmp" /SL5="$702C8,2719719,54272,C:\Users\Admin\Downloads\butterflyondesktop.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:11836
  - - C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe
      "C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of SendNotifyMessage
      PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4824 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:22364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2252 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:22632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4456 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6072 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:10792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1576 --field-trial-handle=1828,i,173991373670892844,13616858723662061404,131072 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:8092
- C:\Users\Admin\Downloads\Melting.exe
  "C:\Users\Admin\Downloads\Melting.exe"
  2⤵
  - Executes dropped EXE
  PID:8824

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1900

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:27260

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:22812

C:\Users\Admin\Downloads\CoronaVirus (1).exe
"C:\Users\Admin\Downloads\CoronaVirus (1).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:23528

C:\Users\Admin\Downloads\WarzoneRAT.exe
"C:\Users\Admin\Downloads\WarzoneRAT.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:26080
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAC2F.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:26224
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:26328
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:26352

C:\Users\Admin\Downloads\WarzoneRAT.exe
"C:\Users\Admin\Downloads\WarzoneRAT.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:26460
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBE31.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:26548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:26632
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:26664
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:26684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:26700

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:7012

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:6756

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:8336

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:11940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe

Filesize
3.0MB

MD5
81aab57e0ef37ddff02d0106ced6b91e

SHA1
6e3895b350ef1545902bd23e7162dfce4c64e029

SHA256
a70f9e100dddb177f68ee7339b327a20cd9289fae09dcdce3dbcbc3e86756287

SHA512
a651d0a526d31036a302f7ef1ee2273bb7c29b5206c9b17339baa149dd13958ca63db827d09b4e12202e44d79aac2e864522aca1228118ba3dcd259fe1fcf717

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-415CEBBD.[[email protected]].ncov

Filesize
2.7MB

MD5
5fa80a21b405113f81e3d0511ae28a0a

SHA1
583ca3939aa88b0aa49ea08f588181c5bac00804

SHA256
22611eb68fc3cb87ac9f2a0852dadd7844d695723cd675bbbe3a6e16a05a8d86

SHA512
2102136853d7561dcd72276db0cd8caad6a71d59e8767cfbf871384008816a0459f57614256a5cf6decb296d5b1a1dd6a7c87b2efcda4680f0f16ea4ccc223b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\05c790d4-d8dc-4ee9-a3f2-54e605c645c0.tmp

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
c64929d71f8769929406b672778db163

SHA1
9dcbf05f8029ec6263ec43b6958a54626adb62d1

SHA256
b8d3e55babd999d4d2ada4cdae8d09b2b34321266395960c07ec811d08b91a0a

SHA512
9ce6eaea812713c9dc9de55875f5899b21b34e2fd09666590f0a4b3a4c6b3dcce382c5c1e73e01f4066c4b99024cda816ddb324701deabf2756c76e6f5977332

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

Filesize
1.0MB

MD5
055d1462f66a350d9886542d4d79bc2b

SHA1
f1086d2f667d807dbb1aa362a7a809ea119f2565

SHA256
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

SHA512
2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e

Filesize
373KB

MD5
9c3e9e30d51489a891513e8a14d931e4

SHA1
4e5a5898389eef8f464dee04a74f3b5c217b7176

SHA256
f8f7b5f20ca57c61df6dc8ff49f2f5f90276a378ec17397249fdc099a6e1dcd8

SHA512
bf45677b7dd6c67ad350ec6ecad5bc3f04dea179fae0ff0a695c69f7de919476dd7a69c25b04c8530a35119e4933f4a8c327ed6dcef892b1114dfd7e494a19a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c4de2e1ff8b36883fc817c80bfd1e615

SHA1
6b6adc0ceda89d17667ad8136687c97dab6ee6bf

SHA256
a68595785b07caa82dd692967b64ee6468c990ff12d912b28b0c7d8ed0c738d5

SHA512
4ba1fcf49b9b1e9965677b1c2d0cfc7f34aed769c22cb04248b3e239cca0eb933b17bef79ce5d78d4e14c06e902126a9d02101e2728831023e76f904ca819db6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
89eca17432ddccc2d7b792c49b316900

SHA1
bb38bf9b5d3b536ba552330895de6dc514d81293

SHA256
d77d25ee794f78296778debde1e563cc382df94a9109f5bf3f16c9021e965b58

SHA512
9b7709c4c591ccc75318228c38f09601a37c0aa40aeffbec4b0cb7c39d8aaff74f163f5ea2248b5d18484c9c424926e7177fb1a22cab939eba208a8f377785ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
554a3f9ceabc449d67d08e6f7803452b

SHA1
cf700fa2571b405c6e61053625bd708768f7324c

SHA256
41f290af2724f5194579e2493ecb710cc80ed04ff37c0d4e30cd2506336ca9db

SHA512
fd4b797b25f481ca79f3f2f3031325b6f6ba4048b9da8f1a5cf3b62b6c35a891a7911914b1649dd9aadb99e7f242bd558d95fee1b4b2a5688233ab000243f5fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59cdf5.TMP

Filesize
2KB

MD5
d3d2f188160b1a996f470c12f8967899

SHA1
bf490393ce1acc6193d72aed5e62983bd22e2720

SHA256
a90751aab5517a3e62defaf46a2e6950c43e5bd732edbe61c21f87fe51b5c2e3

SHA512
f89d4b12cafae292de586b5e547bd75936f85d87c7aa970ca40f0b4a9b08ac4df3a83d9d8276358e1d0fb94e42a71069779f531d6150db2b11275c5dd791ceda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1018B

MD5
3d9c649769448b834574c90b0b061b05

SHA1
a612e7323feefd1500a45b930926997bbb3ecd23

SHA256
f79fa5365b4771aba488693271b0aac4196e8212ba77ba3386bea9ef7bbadeec

SHA512
4ffaa3d5c5a193261fbf4a524a0b78cdef729c0ff68367b7870f05916707d2c10cb1b3a71e611c26fa08d9507b997ac5cdb959bf68076c664b10b5c9be1ba4c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
b68283ee4c988009672b65d62f95a5cf

SHA1
61b8c6b7f7a083906475035cf2b6e5a3fd7e2ba2

SHA256
169ad06fab92cfebfd33639e13effebb9e9d3c52ff84eb7d525a4e527b91c953

SHA512
e6e6680cceffd3421fe2eeba62bc11b8f459c8ef631d1c7de5d7d4952419407f04af38c1f2fd79d33c27568e8f0b5c11f2ea3947ad995486e22149e6bc3c18df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
33ec9242f10148e67cd6b3b3758caa0e

SHA1
f184729ef994e81c31c903d69c96d0073fe49cbc

SHA256
4641d14b5d958b50d8b87a0b28e75ee62bb537cbf3bfc3d8811c254bc81d8b37

SHA512
0a7581d5f17bdb660a5557a08ca95fee5a90d8e281493b9d21b82e63276178e8786c134317a17d12880129602c40a06edf01d77f6b46ba0ceccb952d7746be59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State~RFe5d0969.TMP

Filesize
1KB

MD5
345573e6d7f25b37e2b7a06bb6c9d4af

SHA1
0ae01d04fd8a34c717725e60b0249146cb14c309

SHA256
7e07200251e5758eb94046ae437850b19b1bb6bd9ec661c57bd947f51f8018cc

SHA512
b47de23f666317a95e5582240a970d5c3e84960b8040a2c1b7bf917f7a9f3fddc2a2cc81f8dbe764bf7f9cd8da0c72d83b518d0f144d7f3ec894d1183f8af961

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
38a4a3e1d9b46bc658a7ccc0509d8287

SHA1
6f82eabfdfb7b7a3b7aeb64317fb45cae8d924cf

SHA256
2b3fa5bd4b94989e91fb2ef97c8f763439c7c4d403a384ca5c59bbd688c222da

SHA512
bbc6b36b208f4e43cceafdcfa8981c9a543c799bc5ed77d9b5eb6a57d583687c16e48a361cac561bf45831907b8d9d34a4c35b3b00cb9710395d3ff38f4bbb1f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
635121b16c17f9b9b6526d8bc0ac04fa

SHA1
7de7407a53c6d2adedacee5da4ad29e5726944ca

SHA256
07888fc82eff07b5742f95634529b70bfb9255b222a1550dbb8f01bb06f4c53b

SHA512
e42ced7a236903d046840fdcde8a45a06593b719b9fb09330462ee6f98cb46bdeb301bf91d09e42af3716a3286ca27328590bbc3b1a3dff628e54f936dba4a49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
cd5bf5d5141b83ff290ee5cf680d5bce

SHA1
246916475d55a637e96fc4580bc073d18cacbb58

SHA256
bb13346b23df1be11a361e4175acabd6984c2de5f13f837999c26a2381d5cd18

SHA512
23d1cee1e5e0b2266e64f06526b21029520dfa3187e2f413e7e74a6f741f38571df0d1c19ff6f6a33fced39c75b433ae67228d248fab2b20fc52258368fcea17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
7f810bf110159308036fb32968574b75

SHA1
0ca09372328d30ee43bd10edc357b5a8e58c733d

SHA256
6731511f9ead00a696480e7faddc602ad5087151262d2191f4218159d4554fbc

SHA512
d1fc54a2282d85750de19c5f9403c700f3da2d69c8b3f5c37fbc20523e4494d2f081b2571c8227bb67ff9fa963cd18945c9c45fba27f3383ecb77433a2363ee7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9cf14117f584b7e616ff2c282bd1adc9

SHA1
a5d02314802767e9bbcb4e0dbcb219a6d5113d70

SHA256
fac26ae22acd0cb66b433a9096cb94494a1a0506f49ffe8460b682b6cfdacec4

SHA512
417d3540194b958b5a890ff95e86e8b75c8e257d46624c6e827f80ef47d3fcdbeaf6e3381ae1af5f8b361dff7bd383e75fdad0838e4aea1da9bae5463f600a2a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
88f5ca0210d9abd861683c61d59a5c8a

SHA1
5853901d1a2b18d2473b2dc692c7b1273711c04e

SHA256
c6ab47ed822a2bfa23cf183cf4a1ad1250751a82d32a5de00a8bf427361e54b7

SHA512
22b01c3395167cfd3db0f7bb29a7f76ed70d6074ee17c32b14c2c8cc6a9bd117e9ebe07e281f1a927246edc5fa553d9681e13a70bdaa44cbc7f51c08f0a9b6a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b7fc60959337334f771a202804829f56

SHA1
08abe9ee3209cfb30ab57ecc80a1b91a65775f6f

SHA256
e35fae7868467630e85cfb06cbb9568b0d4be2c48e0b202861623b6d98bbaae5

SHA512
66eee5e07fd8bee8f4d762200dbf1e574adaff3e4c15ff620226a3ba24a921663aade0302b7c7f8a6ce5301f0cde791cbc6122476af22604ee17fdf8834c47a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
16b13cf63734f8cf75b956bf8438cba9

SHA1
fe09fc3af39f669da14733798f6deeb59a38ce17

SHA256
0e5d608cf16edddfc671d79ab2bf5a8b6bcf2b1f67a1a03d339eab6ed472b135

SHA512
8e89859e99be859efdbfe066971b7236180d3dd6051e4537b2b7a381a4b395614797314625b7b4f47a037ef1fec748aaa6a235e0c78fdfda8df5c6ed105eeb4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e54d5c293e53efffc26be41a8c6b440c

SHA1
d6be94dab71ca4b7646f83161c56dd426d79875f

SHA256
df8ef12dfc3e18ab54bee74c5e57d554801d208ad41a09368d23debc4f79c8e3

SHA512
96f8bf5686545b70f30259e11c2533177d596e52cd0c554c506f775ccf0cada1b4e948e4acfbfed22bb3ef544f34c7ec0cf0fda0c9715ce6e2cba36a4f6cdbca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
150a22b5c7da185c3dc334a6b494ef2c

SHA1
2b49627923efc8a8471748310440ee985c7a12a5

SHA256
24be3874535ecdbad3de808493f9e81532a6ef392e9eab2f9853ab09c0b7f721

SHA512
03514a1aa9eca8cb8030e851939c0bf406c2c73e59a214a97032c51e7639cb4285cc6c289da47fe487629d23ecaf830f433917564a6ccf7839e7246b32f2450d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
11ab015d1d670e87341a994f25e1cb39

SHA1
a03b551383bf278116b66a80e84447eef4aa9427

SHA256
9bc52ea2d052eff104675e8893e71ac7d5e81e585d25bb6914bb032690502376

SHA512
883520fcec64ab5d8185a03c043ff5309752f7dd9af0b231bf00ecf7464aa98d9c35422b8ebcdcf3cdc27652253b2a7cfe5d6df155240f31af0d481c9602f319

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
1d389b3bf68b6366f1ec490ae3c5378e

SHA1
ab204667785e1235449ca2d650f98d4738f673b7

SHA256
e54945033c302598892d96d57d3d59660bff5a27dbf7692b20ec24173c66a225

SHA512
05e9ab7089f1461c68c35f41336ded4a2eae9bf619efcaf4630cd5d6dd2bcb957c3e96ba023fec42ddc3a541a520608d6828c7efe445b067117ef590448127ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
bcc90ba4e14f53655a0e760cc0fb466e

SHA1
4a4f1c88f81018aaee06e442f44ab0002565f950

SHA256
34be180ffc80c7716f6f163b9c5166377d7a544526c1f821afabc39ae530de18

SHA512
591d57477cd0a5a5b74b5905e81a081f4b6e40e63b75cce1272fed9b072e5fd6804b2e0c27d5055bba0f4ba091b416882c9f888f0ffc280c126a0b79435cb2fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b81f5221375d7ebc7fe7b50005f48ac0

SHA1
925fbf530e6d927aca19ae6cc544dc1ad774e12f

SHA256
698cd746961b808d53de709ad86b74f3be8be6724829da3a49172380ad59f0af

SHA512
dd1b159bf822f0202a424ff32de4c1a4640d7f4ceb1d57766388aaf0448260aa16e09da8b1b9dd08cbfec5e892259405dfab67e2c4dd0e7587bf63d7c09ebedf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
0a611c5130532a06d18ccffc84ddb7bd

SHA1
ebe9b2773b339591ae1be84ab8559bdb6615eaaa

SHA256
53d1b283bea5a6bcbaeb65e5d86660768f53598cf23990ef6a551c990df71d5f

SHA512
f0ef92eeb6fb5e3dc7d3b1f89e3a637c33a313b4d94171f77c44b593505fb1fe7c01300f410a53ef8c756cbfeb5d9d60b3df9cb41d7ec6afe4bf2c9a81588a9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
6c9f6295f773703734158af5a376a8e2

SHA1
e7d8dc963838dfa81827156f69b5737f1794a907

SHA256
db6956fef9b8c33fe72248cc267cd14980887afe4b004aa36b3b356a171f1f1f

SHA512
a680c6e4a0c0c5b9af9b119c15df348873e32ed427fd9f3dbb42a4ea10bb3a11d5335a4ef22051af36c7f232d40ed82ef8289e0dab7404b230c90a3f71c7b830

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
674367ad869b0f026d15c6216c5d2a98

SHA1
20669fb3df6ced83f7efb2d9d933e0b0071ee374

SHA256
c3e0ad093440ec5d7d1ac8feaa25371121d254ac562e0a1182a8730ffd9b7277

SHA512
4c6d13c3c40f7459b7c0152879cbe75c5edf6aed8e206d8c9deb1da7d288641bdbb0d1b812a39115557d550bafe14d054d183fab2d1dee2047ff2cad621839b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
6db146868867026259467a55c22499f1

SHA1
93a136986c979234d495bc2a515f926e567b3b1f

SHA256
5a83e697e5e7fdee51bd5c3b155148db3c916c2d21d247e65da95e44d81869e9

SHA512
a5af67e9474d7258d7611eb2ad7779f133ad9d929443a4dd86bb3d8bee58b928701b33704af81204338b8395cf7e5fe4520b5ccbcc04556ec3ba5e3107b3231a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
26f0d1394b10891fc2c98620025afc15

SHA1
1554fab0f05fd3495c0c5f9f4c3627240fda1a1d

SHA256
d5e46ccc834317c5c316b7f684357102726b721015284d1cd3eeeec8328a69b8

SHA512
f39f3ec4fabdd9ba091b898cad97d031189cbb2bb87e6576e3b1c3ae006ef13636607c35b6cf56eeab49e36f2d63504a986f293a6e16fbd3d6ffb8eb38e3093f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9eb291df7248919dad955110cd4d0f8a

SHA1
afacdb9a97dcaba527af28d84d358251d4ff101f

SHA256
012b868be21901a52c2b6c276de46e95b8dbebafc71e247b05ea616758ba201b

SHA512
b71da43e4e2a67a10218310082c1eece23fff47e85dbe4a458a828be3c0eb1e250f130a95b6a1fd6de28bd8dec77a3d0c76ef395216f99f09721a72ab0505cad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
98338494969bce2b0fcf306ae898fd70

SHA1
d6f9f77ec134f4a11daedb053e3b453294e27465

SHA256
58ba4fa48eace1b6774646afc23cc1b40d1f23d836638583b1009c226d610ab9

SHA512
16c3fa6d7cb064c52e8e6f3c2bcb4c2fc11ea038c1a8bcdb9b4c5f24e25cc05a654d87cbaadaae6ae6dffc87c9a1951361e383c92bd09ca6d3c0cd2b3b21aef9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3090319ae3cad8ab979f1c5f57e54157

SHA1
c69b493c03ff6b1bba97ac5c89fc46d3f5504b60

SHA256
35c87ae82210a463198ba6198eae001a23b0c4dd90210efce07413cf602445f5

SHA512
235075743e11ef758189395b65553e41952b492ed7d3c450330423bb09c358d39693a9efcf0b0fa1666173f9c2df1ce8e54676f6d929fb8fdc0a153bf801efeb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e392675420145f061f8f6cc701824bbe

SHA1
c89ecb812521b8806ee37567dcc03f1470f48798

SHA256
3d424cc85c816075a63e3ced19ff0b34992edf01b1a603508f27cfac70bbddf1

SHA512
135f29e4c478c10c3df1f8cca3cc193005e168d403090059674d9dd29e76c0d501ab9880bbfe087186c72883422b697a91c88f8e981993db445eb7dc77f88fa3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f708247e8157f960149ce4860d95fbc8

SHA1
68666caca7bfcc30330e870664673d43f5348127

SHA256
1d75f6740a69ca6827858e40fa4876971ce842a33d3664f6d8c60e325645759b

SHA512
efb74ba43fdf3db9148d86edc7718020ef1cd2cc70be7b85a8b24f0cecd6cac1459b7ebd35fba42f543602f406ba3bf149fd9bad76d2c44e6e289ea56685b5eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
80ece79fd125a81401b2e3283affff88

SHA1
8937db3b6730d43dc5d23931f619deec4fd9533a

SHA256
3d9d0be198060714ff9692d5cda0fd9fdadc6b1ed4d11a271a83b68e1c156e88

SHA512
f876a228668f9765cbec3b9b077497072b97b55544e5c07c3f0ba4634f1317f8c093f31a246dc9ca1450d13d1149c0cb5f7ae9dffd0beeea3550a6ff43bd03d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
0f3d2d86e8e2cfa38a7ccc162b652015

SHA1
d3bab2a77535ce8c027b33755a9e9abbf628cadd

SHA256
e5cfd984ea57a339d496500c71d83142724609de9900294759de3c6c36926710

SHA512
4d60c4de8902e6b35f1c4cb445f2a059e07cdf773a4a8397d110523d893b994b3d6a891c98c59b9ef332473448a97d603990262d89e2a7f98aee34104d5581be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
88ed88da35ab9a8700208243757de5d5

SHA1
fdcb4e07b475197a6844538934a2a3bbef83bc06

SHA256
2863856e49ab1a78bd22a6fe401ce150777b0a65be9c7c8ebface52188b0a261

SHA512
3519395e62afb6ac891f009ee8498cac819a25df9c625f13346450c3645be7ac249e192bd6c64cb87908220acdbc9582ce0e73f39fae1c2599e33a5b0358b645

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
5ffa55ee64b57be18d5ac827063f4e4b

SHA1
41c4ceb16f9f24d1fef43229886a7d5e1e4e2933

SHA256
1418994b36863a6b424a3007f64f4ff0357d2af88a06f75f78a85d33dfd2b33e

SHA512
e1f8782733cd017d13e990ba76aa217c4f06574a37aa372ddad38247198361fbc6c88046cad7f7dd57600c8d9a6178d658555a0a1cc5f8f39b5bc3d467a46083

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
66ad6269d6adbe1f2e0ea595d0b204cb

SHA1
4b699850adf610a686ad7a2fdf54cbb2469b61ba

SHA256
805e7bbbf23db35f62facc5170d8b14d3b977c71665245bc282be3c52dbef343

SHA512
953ba35ea900ef04cef07adfbfe317ddfb842e5e9c763e4ab19e695daf85e72b73fa548ffda01509e2124d0f286e2bfee65fe468cf303e4676eb4f62f5310827

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity~RFe593157.TMP

Filesize
1KB

MD5
e1be9b55d3d4c8c7bcb0143a16783966

SHA1
d26e295deaaaf874aaf1c539a4d9670278d9246b

SHA256
5090654c8ae9efefb49ecb067ab10c3c13d2bdefeacf6a84b9c1ee8930ce1c4e

SHA512
295a3db99d22714d81dfdf6f1c08cae027cc53ba21b4ec9fd894b10829795b06965f59b8f61c32b18cd7bc5ffab7e0496dc95572c71973eb02407d4957cfece6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ef4ed7c3f1ddfee4b63d1cae3e9a2d13

SHA1
1ed2bb7b1de0b3d2b41a3ab7d1a14f00ee3eaaee

SHA256
5915b1a6f5b49a95527f1363ba0555f860fef6cd0b0250f64530e3767816d7ae

SHA512
20aa89f88dd119e7dcbe2b48af9b6123b87dac7d06333d7b8a244f1299148897017f93a6373b38f60a7e0a76846f9ed8564fc54e59e81ddafeb720054bbaa936

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
892842797cbc166a5fec0b42d1f9af6a

SHA1
bbca4f6f13d7b71174a6d1fc0a11d08f3cf8bd5a

SHA256
9cd735714c46de3595df2f04de88ddac4864271d6269b760bba43e9b69b68370

SHA512
27b5db92354a7bccc475ae72b9dda2cc6521c1436e50b0c63085cbd79e48189123c11d0a65dcfbb08b7c3f227661e85b04afe65530b260b14f13cc09f0f23fa4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
aedf8de2a6a0dc1f7276e99d1944bdb7

SHA1
777dd889554c6060bf21d32cf49576fbf43a451a

SHA256
92dedff7a2bb46f72e82e06b7cc28f5d5967ed7ca455df6fc2d13f16e6f781d2

SHA512
a5442bc5fc4954f545ed5494373faf6b559dccd58ca65bae703bdfe177aefe7c32efe0c896928c1507aefeb6b1964cc5ee9be1328babceea810ad7da591ced18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
46da02ab07cb7eb7a8fbbaa92c61902b

SHA1
7db816ed4c4676ca423e6436e1b439e283c73b4b

SHA256
efed9bd05cd56559f26d78aeb3c31fe29b2d952fe7c0a2be152abc82f8735631

SHA512
786ae2f9c1a5c70d368a794caf86b0da1a4f85ec707b95b58c1c84b7a3485cb258987cb2a67e2609e9681566471cad8d8d05ef3422e81ca5947541a52aae57d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b45f8f1091c22b4bf768ca2ff8a87872

SHA1
05882141a9ba34fc2e835dec1347661eb7cc1a59

SHA256
09ffa12377d9ff019760aaad2c65b9e0a1b9371c91ebbea6ac9094f2aca02c6b

SHA512
f908f124fdba02e8dfd3e437c6e802560096d22d32c29eaf07bb3b6d41eb0043886fa8d9524e5dbb8e089b993b9bf5e4c2d0b329e9ddd6df15e2fe10f9bdea78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
d0595a7038917bb3439e9846d8320a39

SHA1
0ed30c15210ffe19cf915a0c756137a735970d5d

SHA256
7d9e22ebefb9b9436c3d7164167c005f7615d6383531945eb0088ae00545d284

SHA512
ac3faa8beec0aeb68d95404f4a9f3abb7c0cf754966649340eb826a478cadf0d0d8253ad0a50ca3e7623021a62fabe6914d06e3affa4ccbc744dfe1080148152

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
74474f6293fd8468be78638bc88d9ab2

SHA1
24d312e7d07162a558efb5262a25ad9b53a16db9

SHA256
ff60f5dc5d4b31ed8ec3653900b15e1391fb438ef650e496a1bba1ef77a2dd52

SHA512
9eb270ca7b03425eb981795ac338d0f70c54ef72c478aef371475258a5f363dde0d1a9478731e3b767f1dad7530652ab21bd18200501e048947018423748729d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
42865e53eefb3864ae97499611e8aa9d

SHA1
a6c2188cfab8315b9a5758a1145deb90632cb745

SHA256
4349ea72c5f1105abe2a332a5829d7ee2b9e81d1128c2e039f0876d2d4900f89

SHA512
ff1cca47f9822652184443cb50290856e5465c5c7753410c308188c1530884b73624aae942da4e17afd4269c98fd2d237aec2c15361f3ddddb23b4e1dab37b75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
984631b2f5d9c902dd5f20fe12a34ad3

SHA1
f3d02e6152072c6a35a3961d4f8c2019e3cdb255

SHA256
d16bd3fa8a24bb131ef8548df9f2fb043255b86dfa16603db6f659f33dd64ebd

SHA512
f8157307df4fe6f26edc6f44a92f506dda264874d6451bb961a851373261f052e73623410355ecc768b486c225cd1814e58962c8f0f49e967819b0dd78787694

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
8c99619e2bd79bc332bd68ae3cb9cee4

SHA1
521f4ed1d41a6a60acd9e12cccccf6c71a3eb0f2

SHA256
7730cbf7d1affa1be59f922057f1c212d19d145a6e613c252c86953beaf8c78b

SHA512
64d29882eec7582cf3f283728c1a39bc852d061a715bb49869b280203f54086b874b49ae347a84b7e953329e5fb0c42a5cbb0f5a1841fd9645d83e99b0a4d0c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0629f292b9328ce4eccbd5e24aea0956

SHA1
5f2f854dc35209f4ce2b20f811e5920c4278d97a

SHA256
91b8bb7f4dc6f52ed89b9e9d29c7331a40713959d823c520dd85c8670019fc1a

SHA512
4876675a28b850f0fc520af4487b6445ac0d90d64e6958706f6b497663d7db201df7fd33ec3fb9405b2e6e1ab5e9488ccd9bf682bc0ee378680a30ae9ad34f81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
dd19a11ce4fe46523d878e46f1379045

SHA1
0064ea03d35aacd63a1865174c7195fbbd8c0eaf

SHA256
24996312aebdde59ff097338f2a2f67a80ea945fa9063620482717f33a709b26

SHA512
1d13094af64f4e66979b16fb7f268807a24ce7603379b7311c7a84de0dc0debf0414620e5cfa60e5ecd7ef4062691eb084101d36a52876b8ddb35792127fae34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
5e8709ce5310b037344a3499bef4746b

SHA1
186dacdb67d46aa3da89b849d1c6dd246dde7a07

SHA256
00f655f253a1d146d5f45693069af196cfc5cd19e539cb7f07389c9904ac502b

SHA512
79982ce7375d02c3ec807f26af47093221a7d6344dd4964e3e2d11c49696592738db09691c3a758c5eb5806126c6e05f0164574a965bc44b12ee1ebb46ccf613

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
aac601f1543cc240d0a929d8750c0938

SHA1
1ed7ac8ffa30f26c45bc187ce9593bc4c743a60a

SHA256
99ef5e5e14d3433b9d1a39c4f8853d70c958842c29e6c85207dbad686d1c366d

SHA512
4210276132e19401a453d5c294a779a0cb68d93bfeebe97cf5c9d458a27400f68ad15a7ca92b42accd4fdbb27f2301f21c73c84bd1eb33f9e83f277ffcae2d75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
295e1c463f792d31aa5e8f445018c7e6

SHA1
82436783ee8d6cf0e05cfdf3de226087bb3aafaf

SHA256
9358e7b8e07ac510a39d9c07f08f737d7df4de164564ec9ca6bf8864d4c883ad

SHA512
9911485b7a4189123acebc694284b61f9199b8452685e9428d7a6eee497d3823cdeb4708b1bc46f9dcc1999892452801464b95575f4f3032d7f00c8ff3d12789

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
16a73f5fb0b1a673b10f6eef28cd66e1

SHA1
c66a1efccf6dbf28510e456362101877383b5517

SHA256
e230760b137f9a2e4220b5966c2192e3dbf9c762647de622a5b150eec8a45622

SHA512
3fc0f8c03c7f53fbaec377c103c1660c95065a19b1ed18d849a34dba104632610024cb6e9ceb593e38e32435ac9899ac2802d45fb2b7af854de0a72e1ef0f482

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe597f87.TMP

Filesize
6KB

MD5
aab232e326722cbdcbac1173384d7ae8

SHA1
8ff09520fb6d604878644d85bd5b5018c564ecf8

SHA256
9e544875cfcac32bba07fcf8b74baf87925a5801e38ef0aeb2737502fd273955

SHA512
8d69a8aa64a5ec41dc479bc6841721362e3d0ce598b685c6cfeb62e8fe04eda3de5c8e38cad9d1c6eccb0eb92f33acbe26ffa306ae2b0a4de11a4b2b467898cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
001fab7eeaaf68c7184ad7100fbf88a3

SHA1
7011d34b3eee8e567fe96f70be166bdb372287db

SHA256
e1aeb73f9c8429358a4bae586d482181c4dbaa2a9ced0050feeae07c42b4b03f

SHA512
9b3831eac6307ae57fb45c0b8535f50acd735481f19a9f6be26e4d3b4f38d3904304f5130090ea1cad5dd6a2400f99338a545eb7fbe0017d330dc99af16d4bf6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
872c7ce0849f2962097f84f1873a7e88

SHA1
1edf8a8e0c3e19d45776e0d46777b5ddb77e9c8c

SHA256
58d0af9f7a299c2989fa2f0a5804e93a1c52d5e6c0cbe2a603dbeb97bb62bb7e

SHA512
d1d9425245573b0e14df025e9b64ce7d69765bbf52653ee172bd8bf4fe535f2e973fb4d64eea3b7c13030231b43a37a48d563dfd8770095fef2980d671270226

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State~RFe5c70d2.TMP

Filesize
136KB

MD5
e1a0f47d228554fede1c3082c8f4df6e

SHA1
b4537876f080bad9df7d615a2d77a4b835151379

SHA256
fc794e38a1aa8a7c8f16917f5b11273ecd8a534b29c6e2435cea7a2025ec3453

SHA512
e1db6a77daaa90422f2bbaff40e41b5c4280c49481ae2575a47ca7c93d2a59f3ffb59a1494d24081375d904bf5346455f84ccabc98d7322112d26909f7a6bd20

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
111KB

MD5
1cd47f23b2f3974e55ed2fd4fd628b98

SHA1
b3cbd0439dc6febffdaf803f5cb043121ffbda69

SHA256
ad117ef712ae34109cf4096519f53e31fa0b917e6d453a949d5af7824e96c86d

SHA512
f768f02b7b126a1415004e317535b870030208bcce1fffe9b4cc47f98d56d941c95b11c58e7189c092526ae5728c4984928942d88cedce8e06c21b7d97db8b38

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57e06d.TMP

Filesize
98KB

MD5
8297fb56b49858b0b7aa53c70953faba

SHA1
e283e4e14b1706101e9fb90789588e51733b72c1

SHA256
75e2a5385d5531ce6be632a755607c53b455c3b53ddf3755805c559e04f70791

SHA512
b23ceb524a7ac1351fb9e3517fe2f822a439cda74b6af2a498bb5f89499a1f1d42a00351f4e8e39d99902723db4e42ab880d81179aa95b8021428623c98d19dd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\DS69HDT5\favicon[1].ico

Filesize
1KB

MD5
972196f80fc453debb271c6bfdf1d1be

SHA1
01965ba3f3c61a9a23d261bc69f7ef5abe0b2dc3

SHA256
769684bc8078079c7c13898e1cccce6bc8ddec801bafde8a6aec2331c532f778

SHA512
cb74de07067d43477bd62ab7875e83da00fad5ac1f9f08b8b30f5ebb14b1da720e0af5867b6e4ab2a02acd93f4134e26d9f1a56c896da071fc23a4241dc767f1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms

Filesize
1KB

MD5
35091107ffad70079c8a9631bea65c0d

SHA1
460fac06be2ee3c1d7d05c80d0eda9c72e394bb8

SHA256
a297d14d898f224b53c39fbe7bb378ca2985adff89fa49468084b77268f3ae5e

SHA512
769bdd5687742db25e9c57feaa6558545650b65ad04e58dfe092a132d737145234c3b635359e1968ba96b6d52f3faa71425ad75015f734d9c337e82daeb57f44

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
5KB

MD5
b797f4c64f80989697d5f715a6e7b15a

SHA1
0358a432b110a0e8d3772bd40eaee3eff0593c84

SHA256
8369d04b5d09835b7e6d07cd680fede611f90f6f0cff63a71c99da9a5c178ce5

SHA512
8010441611e3a683fa0a19b40dcc076272e98ae70b35e1a9ced27ab82aaf69731e591cf7043148c331ff01447eefaecce9c9269299e30743d6dad3e5385ff268

Download Submit
C:\Users\Admin\Downloads\Adwind.exe

Filesize
5KB

MD5
fe537a3346590c04d81d357e3c4be6e8

SHA1
b1285f1d8618292e17e490857d1bdf0a79104837

SHA256
bbc572cced7c94d63a7208f4aba4ed20d1350bef153b099035a86c95c8d96d4a

SHA512
50a5c1ad99ee9f3a540cb30e87ebfdf7561f0a0ee35b3d06c394fa2bad06ca6088a04848ddcb25f449b3c98b89a91d1ba5859f1ed6737119b606968be250c8ce

Download Submit
C:\Users\Admin\Downloads\BlueScreen.exe

Filesize
9KB

MD5
b01ee228c4a61a5c06b01160790f9f7c

SHA1
e7cc238b6767401f6e3018d3f0acfe6d207450f8

SHA256
14e6ac84d824c0cf6ea8ebb5b3be10f8893449474096e59ff0fd878d49d0c160

SHA512
c849231c19590e61fbf15847af5062f817247f2bcd476700f1e1fa52dcafa5f0417cc01906b44c890be8cef9347e3c8f6b1594d750b1cebdd6a71256fed79140

Download Submit
C:\Users\Admin\Downloads\CryptoLocker.exe

Filesize
338KB

MD5
04fb36199787f2e3e2135611a38321eb

SHA1
65559245709fe98052eb284577f1fd61c01ad20d

SHA256
d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9

SHA512
533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444

Download Submit
C:\Users\Admin\Downloads\Melting.exe

Filesize
12KB

MD5
833619a4c9e8c808f092bf477af62618

SHA1
b4a0efa26f790e991cb17542c8e6aeb5030d1ebf

SHA256
92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76

SHA512
4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 66009.crdownload

Filesize
2.8MB

MD5
1535aa21451192109b86be9bcc7c4345

SHA1
1af211c686c4d4bf0239ed6620358a19691cf88c

SHA256
4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6

SHA512
1762b29f7b26911a7e6d244454eac7268235e2e0c27cd2ca639b8acdde2528c9ddf202ed59ca3155ee1d6ad3deba559a6eaf4ed74624c68688761e3e404e54da

Download Submit
C:\Users\Admin\Downloads\WarzoneRAT.exe

Filesize
321KB

MD5
600e0dbaefc03f7bf50abb0def3fb465

SHA1
1b5f0ac48e06edc4ed8243be61d71077f770f2b4

SHA256
61e6a93f43049712b5f2d949fd233fa8015fe4bef01b9e1285d3d87b12f894f2

SHA512
151eebac8f8f6e72d130114f030f048dff5bce0f99ff8d3a22e8fed7616155b3e87d29acf79f488d6b53ed2c5c9b05b57f76f1f91a568c21fe9bca228efb23d9

Download Submit
C:\Users\Admin\Downloads\WinNuke.98.exe

Filesize
32KB

MD5
eb9324121994e5e41f1738b5af8944b1

SHA1
aa63c521b64602fa9c3a73dadd412fdaf181b690

SHA256
2f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a

SHA512
7f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2

Download Submit
C:\Users\Admin\Downloads\YouAreAnIdiot.exe

Filesize
424KB

MD5
e263c5b306480143855655233f76dc5a

SHA1
e7dcd6c23c72209ee5aa0890372de1ce52045815

SHA256
1f69810b8fe71e30a8738278adf09dd982f7de0ab9891d296ce7ea61b3fa4f69

SHA512
e95981eae02d0a8bf44493c64cca8b7e50023332e91d75164735a1d0e38138f358100c93633ff3a0652e1c12a5155cba77d81e01027422d7d5f71000eafb4113

Download Submit
memory/2804-8660-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/2804-10253-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/2804-358-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/4244-359-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/4244-6102-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/4244-354-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/7012-23282-0x000002656ED20000-0x000002656ED30000-memory.dmp

Filesize
64KB

Download
memory/7012-23266-0x000002656EC20000-0x000002656EC30000-memory.dmp

Filesize
64KB

Download
memory/11836-23241-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/12048-23240-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/12048-23195-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/23528-22625-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/23528-22627-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/24304-22706-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/24304-22708-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/24784-22910-0x0000000004FB0000-0x0000000005006000-memory.dmp

Filesize
344KB

Download
memory/24784-22909-0x0000000004D40000-0x0000000004D4A000-memory.dmp

Filesize
40KB

Download
memory/24784-22908-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/26080-22846-0x0000000005920000-0x0000000005E1E000-memory.dmp

Filesize
5.0MB

Download
memory/26080-22848-0x00000000054B0000-0x00000000054B8000-memory.dmp

Filesize
32KB

Download
memory/26080-22847-0x00000000054D0000-0x0000000005562000-memory.dmp

Filesize
584KB

Download
memory/26080-22849-0x0000000005850000-0x00000000058EC000-memory.dmp

Filesize
624KB

Download
memory/26080-22845-0x0000000000870000-0x00000000008C6000-memory.dmp

Filesize
344KB

Download
memory/26080-22850-0x00000000057C0000-0x00000000057E8000-memory.dmp

Filesize
160KB

Download
memory/26352-22855-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/26352-22857-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download