dharma | d0019364aa3673c7d62a615e41f98c0585b72808fe9e32714a73b33c52b5bdb8

Resubmissions

24-09-2024 22:54

240924-2vmjwstbja 10

24-09-2024 22:40

240924-2lz4masfmc 8

24-09-2024 22:31

240924-2ffg2asdkd 8

Analysis

max time kernel
457s
max time network
456s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-09-2024 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fortnite-skin-changer-lobby.html
Size

10KB
MD5

e0884d5afacda7ac5d4dde84e12bdc5a
SHA1

198d0bd0c6a64f6045a12dca89140cb972bebbe0
SHA256

d0019364aa3673c7d62a615e41f98c0585b72808fe9e32714a73b33c52b5bdb8
SHA512

865fb35d877f5d21b111815387f67a8e9dbd4e5423347954bae4c34422f0f6ac500480b102d2f90a37b3977689819d0f9a9947d9da912b29fae50d828930a155
SSDEEP

192:zyHGqcEY1f+qL4lyVWdhQ82h83FEL1Q1Oso9X0F6YEUB2oKS19:wRcpf+NEknQBOTdEYz

Score

10^/10

dharma troldesh credential_access defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan

Malware Config

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (509) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

CoronaVirus (1).exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	CoronaVirus (1).exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	msedge.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Deletes itself 1 IoCs

Processes:

CoronaVirus (1).exe

pid	Process
5552	CoronaVirus (1).exe

Drops startup file 6 IoCs

Processes:

CoronaVirus (1).exeexplorer.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	CoronaVirus (1).exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\acb612a3.exe	explorer.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus (1).exe	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus (1).exe

Executes dropped EXE 36 IoCs

Processes:

$uckyLocker.exe$uckyLocker.exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exechrome.exemsedge.exeCoronaVirus (1).exechrome.exechrome.exemsedge.exemsedge.exemsedge.exeCryptoWall.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exeNoMoreRansom.exeNoMoreRansom.exeNoMoreRansom.exe

pid	Process
3460	$uckyLocker.exe
4788	$uckyLocker.exe
5552	CoronaVirus (1).exe
5608	CoronaVirus (1).exe
5644	CoronaVirus (1).exe
5668	CoronaVirus (1).exe
5692	CoronaVirus (1).exe
5724	CoronaVirus (1).exe
5756	CoronaVirus (1).exe
5824	CoronaVirus (1).exe
5832	CoronaVirus (1).exe
6044	CoronaVirus (1).exe
11992	CoronaVirus (1).exe
22160	CoronaVirus (1).exe
18988	CoronaVirus (1).exe
19272	CoronaVirus (1).exe
22152	CoronaVirus (1).exe
20264	chrome.exe
15700	msedge.exe
20856	CoronaVirus (1).exe
17892	chrome.exe
18128	chrome.exe
18844	msedge.exe
19164	msedge.exe
20100	msedge.exe
19756	CryptoWall.exe
21868	msedge.exe
452	msedge.exe
2208	msedge.exe
20764	msedge.exe
22008	msedge.exe
22380	msedge.exe
8684	msedge.exe
9024	NoMoreRansom.exe
8652	NoMoreRansom.exe
10128	NoMoreRansom.exe

Loads dropped DLL 16 IoCs

Processes:

chrome.exemsedge.exechrome.exechrome.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	Process
20264	chrome.exe
20264	chrome.exe
20264	chrome.exe
15700	msedge.exe
17892	chrome.exe
18128	chrome.exe
18844	msedge.exe
19164	msedge.exe
20100	msedge.exe
452	msedge.exe
21868	msedge.exe
2208	msedge.exe
20764	msedge.exe
22008	msedge.exe
22380	msedge.exe
8684	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

NoMoreRansom.exeCoronaVirus (1).exeexplorer.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	NoMoreRansom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus (1).exe = "C:\\Windows\\System32\\CoronaVirus (1).exe"	CoronaVirus (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	CoronaVirus (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	CoronaVirus (1).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\acb612a = "C:\\acb612a3\\acb612a3.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*cb612a = "C:\\acb612a3\\acb612a3.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\acb612a3 = "C:\\Users\\Admin\\AppData\\Roaming\\acb612a3.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*cb612a3 = "C:\\Users\\Admin\\AppData\\Roaming\\acb612a3.exe"	explorer.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

CoronaVirus (1).exe

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Program Files\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	CoronaVirus (1).exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Public\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	CoronaVirus (1).exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	CoronaVirus (1).exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus (1).exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
143	raw.githubusercontent.com
144	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
201	ip-addr.es
203	ip-addr.es

Drops file in System32 directory 2 IoCs

Processes:

CoronaVirus (1).exe

description	ioc	Process
File created	C:\Windows\System32\CoronaVirus (1).exe	CoronaVirus (1).exe
File created	C:\Windows\System32\Info.hta	CoronaVirus (1).exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

$uckyLocker.exe$uckyLocker.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\Desktop\Wallpaper = "0"	$uckyLocker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\Desktop\Wallpaper = "0"	$uckyLocker.exe

Drops file in Program Files directory 64 IoCs

Processes:

CoronaVirus (1).exe

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.boot.tree.dat	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\canary.identity_helper.exe.manifest	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\he.pak.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsFormsIntegration.resources.dll	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms	CoronaVirus (1).exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover_2x.png.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_sr.dll.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Confirmation.png.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\ui-strings.js	CoronaVirus (1).exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Concurrent.dll.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\ui-strings.js	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-pl.xrm-ms.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS	CoronaVirus (1).exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\comments.win32.bundle.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll	CoronaVirus (1).exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationCore.resources.dll.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_hiContrast_bow.png.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ko-kr\ui-strings.js.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms	CoronaVirus (1).exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubMedTile.scale-200_contrast-black.png	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\ui-strings.js	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sv-se\ui-strings.js.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationProvider.resources.dll.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluNoSearchResults_180x160.svg	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\FPLACE.DLL.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\ui-strings.js.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-phn.xrm-ms	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\az_get.svg.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\MSFT_PackageManagementSource.schema.mfl	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL120.XML.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt	CoronaVirus (1).exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll	CoronaVirus (1).exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Xaml.resources.dll.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_contrast-white.png	CoronaVirus (1).exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-gb\ui-strings.js	CoronaVirus (1).exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\InAppSign.aapp.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL022.XML.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\plugins.dat	CoronaVirus (1).exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\FillnSign_visual.svg.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.id-37A3FD6C.[[email protected]].ncov	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.scale-200.png	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf	CoronaVirus (1).exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms	CoronaVirus (1).exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x	CoronaVirus (1).exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

svchost.exe$uckyLocker.exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exeNoMoreRansom.exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exeCryptoWall.exe$uckyLocker.exeNoMoreRansom.exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exeCoronaVirus (1).exeexplorer.exeNoMoreRansom.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$uckyLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoMoreRansom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoWall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$uckyLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoMoreRansom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoMoreRansom.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exechrome.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

Processes:

vssadmin.exevssadmin.exe

pid	Process
32724	vssadmin.exe
13216	vssadmin.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133716924365323396"	chrome.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	msedge.exe

NTFS ADS 7 IoCs

Processes:

msedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 269126.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 524951.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 935603.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 461140.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 764542.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 18794.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 901182.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exechrome.exemsedge.exeCoronaVirus (1).exe

pid	Process
2924	msedge.exe
2924	msedge.exe
1208	msedge.exe
1208	msedge.exe
2944	identity_helper.exe
2944	identity_helper.exe
228	msedge.exe
228	msedge.exe
1392	msedge.exe
1392	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4980	chrome.exe
4980	chrome.exe
5428	msedge.exe
5428	msedge.exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe
5552	CoronaVirus (1).exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msedge.exe

pid	Process
1208	msedge.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

CryptoWall.exeexplorer.exe

pid	Process
19756	CryptoWall.exe
19836	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

Processes:

msedge.exechrome.exe

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	Process
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe
Token: SeShutdownPrivilege	4980	chrome.exe
Token: SeCreatePagefilePrivilege	4980	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exechrome.exe

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exechrome.exe

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe
4980	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

msedge.exe

pid	Process
1208	msedge.exe
1208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 1208 wrote to memory of 1656	1208	msedge.exe	81
PID 1208 wrote to memory of 1656	1208	msedge.exe	81
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 932	1208	msedge.exe	82
PID 1208 wrote to memory of 2924	1208	msedge.exe	83
PID 1208 wrote to memory of 2924	1208	msedge.exe	83
PID 1208 wrote to memory of 4424	1208	msedge.exe	84
PID 1208 wrote to memory of 4424	1208	msedge.exe	84
PID 1208 wrote to memory of 4424	1208	msedge.exe	84
PID 1208 wrote to memory of 4424	1208	msedge.exe	84
PID 1208 wrote to memory of 4424	1208	msedge.exe	84
PID 1208 wrote to memory of 4424	1208	msedge.exe	84
PID 1208 wrote to memory of 4424	1208	msedge.exe	84
PID 1208 wrote to memory of 4424	1208	msedge.exe	84
PID 1208 wrote to memory of 4424	1208	msedge.exe	84
PID 1208 wrote to memory of 4424	1208	msedge.exe	84
PID 1208 wrote to memory of 4424	1208	msedge.exe	84
PID 1208 wrote to memory of 4424	1208	msedge.exe	84
PID 1208 wrote to memory of 4424	1208	msedge.exe	84
PID 1208 wrote to memory of 4424	1208	msedge.exe	84
PID 1208 wrote to memory of 4424	1208	msedge.exe	84
PID 1208 wrote to memory of 4424	1208	msedge.exe	84
PID 1208 wrote to memory of 4424	1208	msedge.exe	84
PID 1208 wrote to memory of 4424	1208	msedge.exe	84
PID 1208 wrote to memory of 4424	1208	msedge.exe	84
PID 1208 wrote to memory of 4424	1208	msedge.exe	84

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fortnite-skin-changer-lobby.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe024c46f8,0x7ffe024c4708,0x7ffe024c4718
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3456 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2880 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2340 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1392
- C:\Users\Admin\Downloads\$uckyLocker.exe
  "C:\Users\Admin\Downloads\$uckyLocker.exe"
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  PID:4788
- C:\Users\Admin\Downloads\$uckyLocker.exe
  "C:\Users\Admin\Downloads\$uckyLocker.exe"
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5068 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2200 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6908 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5428
- C:\Users\Admin\Downloads\CoronaVirus (1).exe
  "C:\Users\Admin\Downloads\CoronaVirus (1).exe"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5552
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:5872
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:11004
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:32724
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:21788
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:16184
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:13216
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:15100
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:13520
- C:\Users\Admin\Downloads\CoronaVirus (1).exe
  "C:\Users\Admin\Downloads\CoronaVirus (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5608
- C:\Users\Admin\Downloads\CoronaVirus (1).exe
  "C:\Users\Admin\Downloads\CoronaVirus (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5644
- C:\Users\Admin\Downloads\CoronaVirus (1).exe
  "C:\Users\Admin\Downloads\CoronaVirus (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5668
- C:\Users\Admin\Downloads\CoronaVirus (1).exe
  "C:\Users\Admin\Downloads\CoronaVirus (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5692
- C:\Users\Admin\Downloads\CoronaVirus (1).exe
  "C:\Users\Admin\Downloads\CoronaVirus (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5724
- C:\Users\Admin\Downloads\CoronaVirus (1).exe
  "C:\Users\Admin\Downloads\CoronaVirus (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5756
- C:\Users\Admin\Downloads\CoronaVirus (1).exe
  "C:\Users\Admin\Downloads\CoronaVirus (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5824
- C:\Users\Admin\Downloads\CoronaVirus (1).exe
  "C:\Users\Admin\Downloads\CoronaVirus (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5832
- C:\Users\Admin\Downloads\CoronaVirus (1).exe
  "C:\Users\Admin\Downloads\CoronaVirus (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6044
- C:\Users\Admin\Downloads\CoronaVirus (1).exe
  "C:\Users\Admin\Downloads\CoronaVirus (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:11992
- C:\Users\Admin\Downloads\CoronaVirus (1).exe
  "C:\Users\Admin\Downloads\CoronaVirus (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:18988
- C:\Users\Admin\Downloads\CoronaVirus (1).exe
  "C:\Users\Admin\Downloads\CoronaVirus (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:19272
- C:\Users\Admin\Downloads\CoronaVirus (1).exe
  "C:\Users\Admin\Downloads\CoronaVirus (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:22152
- C:\Users\Admin\Downloads\CoronaVirus (1).exe
  "C:\Users\Admin\Downloads\CoronaVirus (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:22160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1716 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:15700
- C:\Users\Admin\Downloads\CoronaVirus (1).exe
  "C:\Users\Admin\Downloads\CoronaVirus (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:20856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:18844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7036 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:19164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:20100
- C:\Users\Admin\Downloads\CryptoWall.exe
  "C:\Users\Admin\Downloads\CryptoWall.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  PID:19756
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\syswow64\explorer.exe"
    3⤵
    - Drops startup file
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    PID:19836
  - - C:\Windows\SysWOW64\svchost.exe
      -k netsvcs
      4⤵
      System Location Discovery: System Language Discovery
      PID:19612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:21868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1928 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=7120 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:20764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:22008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:22380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,712446207065100362,15071974152264821797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:8684
- C:\Users\Admin\Downloads\NoMoreRansom.exe
  "C:\Users\Admin\Downloads\NoMoreRansom.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:9024
- C:\Users\Admin\Downloads\NoMoreRansom.exe
  "C:\Users\Admin\Downloads\NoMoreRansom.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:8652
- C:\Users\Admin\Downloads\NoMoreRansom.exe
  "C:\Users\Admin\Downloads\NoMoreRansom.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:10128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4480

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdf10ccc40,0x7ffdf10ccc4c,0x7ffdf10ccc58
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,13173705150383227101,5813186204649745885,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2208,i,13173705150383227101,5813186204649745885,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2236,i,13173705150383227101,5813186204649745885,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,13173705150383227101,5813186204649745885,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3148,i,13173705150383227101,5813186204649745885,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4436,i,13173705150383227101,5813186204649745885,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4480 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4628,i,13173705150383227101,5813186204649745885,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4636 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4644,i,13173705150383227101,5813186204649745885,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4608 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5096,i,13173705150383227101,5813186204649745885,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:20264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5000,i,13173705150383227101,5813186204649745885,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:17892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5072,i,13173705150383227101,5813186204649745885,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:18128

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4596

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:27940

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\462b9dbf66ee48ce98b4ca1951ea21aa /t 14624 /p 15100
1⤵
PID:14952

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\7ed6f26330ea456286bbf62c1d1bd840 /t 12964 /p 13520
1⤵
PID:13388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:17412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:17968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:18272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-37A3FD6C.[[email protected]].ncov

Filesize
3.2MB

MD5
70f777a8d500754dc73f668037b50961

SHA1
73bcc8d3e31f742c06ac2af02cf013b437c2ef23

SHA256
db6fada8d3a76ed4a6d7d3ca63b716af8ece4ee49a0aa7ff7d2f9f2be97cfc75

SHA512
dd694007a165b719853670ddb2de9d47bdff84ffcea60acffb9a97e1e38e8bff2060cf00acf4c7304b677619fa73acf89fc238981aa10f0fa02e6dcd579b7500

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
351c122d0dcf6b8e21badb1e02e39fa8

SHA1
068536a4f89f482e56ebf5cc175fade49af418bf

SHA256
51a0f851e7eacf13a5d18e101c4312c18246a58908eea31941ab27ebef837ca4

SHA512
107859e48eb0076ce176a01c65fb43b7b8695d8bd06a45d7af2213e4000470b41fb6064564690a1a9578615020e122848515092f269b0f17562e58a63a82ef4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
9633c990763d3eab6d07456e956723af

SHA1
20eb430aabb2613b834783081dc1d58588d45eab

SHA256
f587c46fb3a948d6bb5e9db5c69ce3abdedb84d4d897cb32990533ffe74dee99

SHA512
44e986d9b73aec606294c92b1a4fb0906356e17eecb73cab7c508bd14ed093a60b274d3da53e9b0a5bfe19259a77531f5b57f6d3b47c5ed11055a568c3e9e962

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State~RFe5d6072.TMP

Filesize
2KB

MD5
7e1ccac8113c99e2aba26e66cceb5b95

SHA1
d15d1ee13a4b53dc41166f9ac59bec667f7c0cdb

SHA256
921f9356e72f724305f52289ffcb90feaca94efdd87a797f7d692f371ed87656

SHA512
21e2dc8c03ddac45f7afa27b5b5ecb09eddc3a303dd2a036261498a3045344d77c51b8fc0bf01db0515d3260bd305a7c94839a4f5ec0a6526dba862556a3373b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
fb9f01613b81e565aabb153e9a47d611

SHA1
27c7e473c1e31cb6342af5391d623aee370816a0

SHA256
541a4e2a7b70ba11d64773646b7d7c23cb0e1c7592ec71427c9e31d320bd215f

SHA512
1bbe834ff55f8973efecee30b8cd1745e8e26efd65ab0441af5b13e07d6c491a9549675eceee3f03b88c6e6d942e67edba8829e11bfc3634fb30df179fcbb1e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
01ef7f166166b60fc3f2ded1938a10a1

SHA1
91ff54ae61f15a5994687a9dca5daae3490656cb

SHA256
2a3f7c7e519c82e2bf2e8f21215a0ecab50cd2c9d9e45e5a4fcc0968c68e488d

SHA512
76a117c3d38e3b42c3dd2d23fd28e6931ad83cad6adaee93bb088f797e1976675bc1344dda25471bce25651077d022e94d22a3f51540ad77266a2ee5a23abc6d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
77f967eb0ce28002212abc70dc579797

SHA1
a61225e1cd85820271b5ec8562d1eb829da832fb

SHA256
9673c6fac7d6bb64ee6891e6ab2b02441a13bdc0323ae9a23ac1874636cf3f4f

SHA512
a44a2bd8c29ecbe6d85c2f2dce3d2b6c20d2be5c83f7c6d8996d76059d5fb1fae2f978b69e1dbafd24467542b3b4ad3325d7d31b859cec9db6879c6c02fb7731

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
aba7454c105dcf9a7b082fcf02b62421

SHA1
cc1a55c9f969a44b17ced571233617818510e97e

SHA256
e636f3253e6a38c40fd4838a4360847074c20459ef75af0197b45e06c0018984

SHA512
6eb0646a7fa1c4304b8a428c20043a5c222bdce7f0c4123d4a6e30355807797ea56afd3f602128dd1ac4cbce7b7525c93571741745b9b02b3e66fd4ec134533b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f96bb5726cada2b4fb67e1c56505ce04

SHA1
111fc37c6a856b4247b6f70082f8f2cb5ce8a451

SHA256
14813cd321e11a81e92c0d6ba30d541b032fbe01ace0bd30ec927c3820ea2d04

SHA512
700d6b6de6d450fa63b605b9941f3f228fcc8acf9559cf85ca7b8925f55a658cfc217156195df3ba7a0e50f9ba91fc94c795470d27fededb1482b5fe2270bfc6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4f9e9c8d4d401907f472406f25138a12

SHA1
daee7a157b5283aa61f49d700a1952d475a89034

SHA256
6b9ead8ffa8a1afa71815f0f2802ad9aadb13c54976e6de535dce8c0d78a584a

SHA512
c38ecf0d68ef22ad1e542481920e4abcd20e2beb2acaab58eeaf2427ab6108510ecae0736973fa6cb67221137222b85d98a697bbe0143537cf9dd270f6953fd9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a7720d00f1638c3c3be41055a7abe2ed

SHA1
1b6ccd8e018814f2a6cb837b8e41eb682031dbea

SHA256
9a000661ee62c65fb301d41423544d4e18714ada99dd0778f30580f44a2c7247

SHA512
6f1c898e7a1673ba6c4598b2be212891471ad32bfb952994611d7e312416002a5a64ed85f16d0e735196184912daa821ac38114920e0303116f5a49caed4d4e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7d21498002eae6dbf301b7b8dfe1da4a

SHA1
6630684916add48991a73d1880676ed1a5bbd24d

SHA256
fd3d30c1b881925a94ae55691dcbc90ea03bdd6bf9940901d7eb2832ed477b77

SHA512
f850affaf17f7380ceb3755c3b2b96eafe124204a8ea3bb6dd9f9d25364420b4e72a27c613e7b8cc2c151f47bde2678ef45222f2c3a8612a93d7f540d4209fcb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e3e0e05faaabdb48f4593646b462a436

SHA1
9c0e0bee9058e6972d1881ce3ae42b684739ef57

SHA256
07205dc9bd37ab827bc457c039bcb6f8aa9b909a3010a36d367f0531e8b19222

SHA512
581063e3acd678b331b7f560d7dae0743bea88d5a29b181057f2b4d3fa7a7f1f3fca11e2057e9936e2284e557be953262b054f569d2ffc697f845b3b04713d71

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
acc3567cc25be5dab03f2a284c3a0812

SHA1
5a6f596fa4f9c86dcda19cead1f9ee4d425f2cea

SHA256
932911f1692912027138016b2166fad285281d8762353b698b266d1508bb7ced

SHA512
aec2597fe27d20581fe9c0486214424fca953ae76fd533b454bcd9d5e6091f2ac8de9648495dae1da7f9ba66422ab9f1b9860dbeb95d41c8b26872646554b68e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a32bd6620a13bbfa2bb38f9b1cfb791d

SHA1
e1065a7931cc5a8acb80b78d493eea11e431ca45

SHA256
c45e473e60bfd328d1daf50d512b285bfc779bf28f6806ab774cbe2ed686a15d

SHA512
d211f1d96d54a13ef8ec40d4c79139eb7668967487b72ab36f00a6ff8d0bcfd1e90d574d70e9a5ccfcb63569a136b354abac56da9edd26225aecdae2c7c1caed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8c35cae9e0f5d497c839e40c677aaedd

SHA1
9d288341cf9113063a2f27f406b62d4d0b95f27f

SHA256
e78d326cb33cbe3835ea75b966ca2dff730fa3c55d453babdfa0dbff2d485250

SHA512
8f026d2f42138cf3f693b56eaba5d0e32a27a3cebb8c6cf4d8daca48a0360a2ceaa69dd504b53f45901b7eb7542a4f365338c7f51323bb19ec20e082c3d86f2b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9c27c33e642c2ad5d964ac68f45f0d6c

SHA1
cd04ff8f9813931088f141f0db21ab61adc54962

SHA256
2b0d0a0cd578dd4a17cc315d3a313875b8fdf462ba08f61cd0841b302bf1d6c0

SHA512
265908fcc2742612a205d56bfe0db727f0096d6b8063836622410cf2e06a2f3a6d5fa36a02b0c32888c4685611163c79421fe64aa7202cd9304ba690ba0f12be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d0aa09510deb90f7223edfd8f88ad58d

SHA1
df137badd571db7d323dbe2b6450f0bb1903c1fb

SHA256
688fba585d738bbe662fc096975e4f20a3282801447fd17aefb26a676639deb7

SHA512
f261e828412b7423d547d40749d8a0321deaa97d8b615cde69ba7c1345223f1538731bca987612b24c55fe74f6efc74e41a03048450a923ab41c3f16feb7a6fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
dff9c673a64696ffe587f2cc74f71902

SHA1
0e5b31a34708b40c4b8d60e215bb31c640c06ad6

SHA256
5979e37d2ab0ec43e54559b88c8ebdf0aa7691e5ad334075149d4b10d7681169

SHA512
2438c03655631b78a6f7f179ed20d24563c52e435a590e61aefc74ee6f96fefb6e143d4f596580a402d99f11ea6351cb5b03334cd6787e3716ac9494cdbd5ca1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
36f3e5e87ec9440d250e290a593f827e

SHA1
415dfd0303513025fa6525e3b0115cf88f33a6e8

SHA256
6c882e778cff0ba4737fa1b40ed897afd757d52eeb11c09d2f8b0aaca10deeb9

SHA512
ebf9a40013692cc839963ff19f8583e4a37cd3806d2159774de41db2494567029abb3b1c0641a4c70d89be70bfff73c80892e1f6417660fc95b907edabe0aae9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6c907b894e1d14c474a62c5d21a5c535

SHA1
d4e8d1f2bfb8ff7e0408c0321c228a3c4ea02a7f

SHA256
b4744eda3020b3eee9bfe62509b3afc988a5845b6d02285acc36404079b0935a

SHA512
92f357e1f3c9b147e9808b9e11ab9d8e8a396fdd451b2ad8978eb3b66d8b7abc0f8b5e6648d3179e9aa0b380c6083c0e0cf8e312d2b8a715c8003bb29fb3876a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a5be686f610f0e6807d49a2b5d7039b5

SHA1
12e843831eabb55f045eba6f37aa267b4d69d70e

SHA256
d48f037ef7a4c3a589705ca3c462c1cb8e4860515a315278bed15277cd80657f

SHA512
feb37a6ad0a85bafaff59fb38d34fc0537f0f25784bc0da6c26f4c8717384efc46323ca6180b82c014d376560453817b39992bb34ee39aa7e39ddc8c6ff20eac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe5bcf81.TMP

Filesize
9KB

MD5
08a24f135de3dca9009242525e178b0c

SHA1
67de2ae271659391f3fb649f86686e8e0da9c92f

SHA256
211ca14bfd603380d4bcbcc4d66a6ba38ccf56c88e0ceef7122a4dacd8691e67

SHA512
536c08697aeb832c043ceed54414164d9bb506b3e364a8eb82200cd2421488744bee6043a8c40dcc9ffcd85cdf9f19afac8d1910d54a3116864bfabb50818446

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
adcf4185d897e5423a7e2282cb60a9ef

SHA1
31175bc6c68db87e6a817ceb0807173f0527ee34

SHA256
718c6bd1857f9e5bf8c397631068640a47ffe3ec658abf1543cb515a8d6f2588

SHA512
d2d2a34295a2ce20e810450e8395acce2432553ee9403d4e619dd093ac554261d284a8e23ef0db8f34df49de2215bea0d0cec5e6f107f5009c97b070dadfa4c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
e6fe8300fe5949ebe8a150ce8bd416c7

SHA1
5bc3fec4abd20d8ce01a6cd7bf43fb6dca5d0465

SHA256
b9a631977732540fd286655ad782c25a01104d7e5031895e6efbe8a1d62c544d

SHA512
447fe3eef0b48a816f5d6eba573c8747ca282ea8e439db44a56c7b4edffa0932fa266f6efb173f11e4524bbfa954c4e1e80dc1b3745d2899ce833d5f5cf38e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
70KB

MD5
4308671e9d218f479c8810d2c04ea6c6

SHA1
dd3686818bc62f93c6ab0190ed611031f97fdfcf

SHA256
5addbdd4fe74ff8afc4ca92f35eb60778af623e4f8b5911323ab58a9beed6a9a

SHA512
5936b6465140968acb7ad7f7486c50980081482766002c35d493f0bdd1cc648712eebf30225b6b7e29f6f3123458451d71e62d9328f7e0d9889028bff66e2ad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
f5d3a782a55c6a0882f4a732bd37fedc

SHA1
1f3a2aa003ff4d24733e9ca8ba2da5225973a27f

SHA256
ab2b400454465a3b117c7258ca3a08492dabeef99a7f899301064aac8d081fa6

SHA512
4beea0ca56dcf969e5fdcc2f8597364575588ff425d912fdae47335702959e8478f7fa2f5fd042ce63b94a70719bd357684fbf574cb332b562ae79824b243c31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
cb433937b0007e06f694e7be90921fad

SHA1
9a93bb8d352cd1ce9ff540ec4f20e36339e57e47

SHA256
1670171bba62c0caf6f3669df06d20074d4b03b89a495801b7ffc021984b922f

SHA512
a44be9e978579ea276bfc8a8d582959924653db566024fdf5c0ec1cab73e907dda21b788b5c4bd8d96f5736fbf6c0bf4e47c4354cb980eb278553c841309726c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e01421739140b12aa1aa661f49d1e71d

SHA1
2c3661e8d5774a8d38382eac83faf8f50210d613

SHA256
870c49744d73ebb5b9aa79a46f5817c535207d5543c108da972925db7f6e2da5

SHA512
378f7339c9eb7bde866e109d652f4fd2722af162766633eda9c371f9598cc8f6315203c03cdf94f92bf100d7e13357f045dd4cb9dbac1383052e25cdfbfc29bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2c641f2cebb92d0f8ec0a4c27b8760ea

SHA1
05a032cb28e441e4898f504f3001dc6838a5cec7

SHA256
ce3e9e09f82704a3a2f293efeb4379673f53a744af54bb6dad23fafd15818f3a

SHA512
0e69b087de211100351d85b76aa3430d9ef0baa96f6aeef0d1f4e32bf2097000105098050be5868ef676a314d401e14877b8154087f53ad4a0bba00bd69ae429

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
091dca3f996bf6824873fbbdf01bd896

SHA1
a43b7b0884c2d438e393cfc26ca0c1ba3b01e096

SHA256
f71bbe9d21473239a9c9967d890c8e40faab262ff7c9eecaff36efff4c5d226c

SHA512
05c16ee32bd5ccd56b086cd20da88439b5f9b4253c5e93c6323c498d4d414b6bf0461cd2d77d75499638f19725e54eec4b065b58ad4b55251c5c29a8ee7fa132

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4ceb56c7b9a73ffdd3735234a6653a6c

SHA1
5a9b45bd0e7507c99d27b9fed56bd49247ec3846

SHA256
3c83520cadc6cf4cb8808a73ea09a16a073762c38b0d1347fd809eb665cb0c65

SHA512
19ced447338f39024b480c39a8c8f2fb55ae3666825912efd3ad9a4cb321136181778838c10471878b60cd02415bbce48326736015ffe2d28d9644be96ca5a14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b8fb066ab98e5937a30618ecc0e77dd2

SHA1
50f3e5923ffe1950bdc3b7a83a17e486b9e80c77

SHA256
ffb075af0616527d31dd6259480c2016684aae2a1cc316deb8be61bb0c27f5d9

SHA512
bfb1f1a49f10c2e3c85cd5833bc9ffed4558e6f95c02663c66bcc0f22d8b749444dd438e5ac6320d52df7b2913558177556ae2fd82ce9423d6041e816b2fbeb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
887719ebd39534d796892114787a68cb

SHA1
aa946f0360bba4a95b9214dd17638570afcf8c41

SHA256
bd4c3a96f5740aee34d8bcd94baafd413a6e6c16820519376cc2bbf4f9c9b037

SHA512
20bcd5c12b372a9106efebc9468ea7e718330382e448b49b9f0c0f940c83d50d3599035c51f32870aa657a3b8929a557092dd2300249acc8c078a8102ee2aab9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
54a5aad9edc31a282b09b610264c9267

SHA1
8e31a460ab4bde95ad27c23c0d88331bdbfbc453

SHA256
2904864c277786f3c234298c5cdb122c81fdfbd773e43081e86a77d9b7bd5019

SHA512
00e53f675ea5c0b497e8ce7db13a60457b17c7eef45743b768cfa8eaa38a4855624b5e2baf1fa02b61e4ff702c4495ed90efc04f8b6e03fcbcafc668b197fb2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
13109b7a64095a2701b35d06e65492dd

SHA1
dab84f2f90c3fd5a8fa067e58a51a98111ab4910

SHA256
177675836b5108f38f3a432089a832b0f9601ea991e2708faab095a58afbe74f

SHA512
db72c34bd484bdd003619c68be372d58aab3f52373acbb2a4093f15e71813ffbee6d5fddb97aab6c5bcf69fc63f065ea300d21b02a15fda22e8243d4556729de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
067e2cf89dcb3f86bbe51a41a5185a3c

SHA1
388474c0ea1368a30787a97795e658303bdae521

SHA256
f23fec00dc6deb5cd890a31626bdcc1f990aad08f8b11d607e32daf60dde3936

SHA512
7b096dd4f307a912847f279b421b186e9e85f5547f0d8d1b231d5a8fad01a2fd93eb1253345d13fc4e42de549fbed6c9e6824b098ca436ecbe016e535719aaf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8be3f822da7430a43ff3097f3415975c

SHA1
3da5fbf12f71de0b993bdf065de7c52379a20a1a

SHA256
f3cef37fa6208e4448b28ad1c2640e0f1b340d2b77177dc5cd5bb0cf9b7fcf4c

SHA512
894418b1034bbefe9d967124659e39d60fde9f871587edf8c43fe4c344030cc4cdad1854d1056963f0de363d722d36712bc122cd532077cf12134f679c10e699

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cf40fb7c4a8756da6ceb9e100522425e

SHA1
b4bc9beb7dd4d7da0f364544ab3022dfcfe5b683

SHA256
134081069a4498960ebe5c6f64efef32213588e5e7540f0dca54e276faa87d8d

SHA512
2f7f6a7c51d825adde20c7c5b116734ccafea6ce76fc0de4183484a73eceb7caf2b4bd33aaf659fe931e71a0c0b0dcebb84b7654cfe6a4da6624aac74b5e620d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b0be509ed51997560a92009ce8bbc68a

SHA1
f45ded401e163c5fa9e6f64e6186306b233e11f2

SHA256
a6eb37bd8cdf3db277c4e2dc41b2645c4869a798e976b2f950ba6fab759cb3b0

SHA512
458849684fe7800f2de5d311d184e6f93c4dbeea36d0e4c4a2f9e0bdbaca105c36eddaa8051800165dd0d06576740ac403ce42b8b4f837b4fba8757f4d9a03f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
22e594c4314726e23bd3f301a7bce433

SHA1
08284ee9ffdd36caf12e17a7581e3e929e0f4fbd

SHA256
0ff732f89e9790abbd3b54e686dd63b6f1fb2d9e5261c72c1917990a4c2f2804

SHA512
0c0dc263c6f21e7d4edd71897884ffe82c81d4c7a40ec0f984cec7efcf3a2ef1c03920a67775ba5a9111f5a5f8870d2853b300fc76bda99071403ac950ab60ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c5d113e6bee2864941673cd5f515be18

SHA1
deec1f663428c420af3401a900e428b911288917

SHA256
f05fed2a292738475ab948446261c4ef07aee834f576f177857ac7ae417acf37

SHA512
c50e6ddfbe2c66fc226176980a8242b52bb6a6a54f1c1d22b5551216c6cacde5f9aedb6ee08b9aa897f46bb4aad7376bf24b3a94d6aa04282e8b32d20a22e627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
2101ce619a3a20e8f6ddb764a51f8c33

SHA1
b2a98f3ed766ce9ae629513f1a01355b8d4a1e3c

SHA256
fbffd277508841bda7720c896a52732ffdfae2301886a102eee20c1bb4f38b79

SHA512
8871a940af32f60765189ac24f0bc60b68e9333298ac4cf4eb9f5df57c7eb661a7ddc5fb3084874ccda03634d173c809b13820ad08f4e075c2cc028348294969

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e4eea934e515b5da78aadcb1539ca9f7

SHA1
57ad7194564ec8e81b3b37568c1f30355d47ac6a

SHA256
08b02a5f2673ecb23740f433d2d3a09ed74c9a8ab0f70077c99a41c7563accb9

SHA512
0f753887359b07599f5ce3e3c57491901297e107dd45a4e0d2295e6aaaae6f18aacee44846473a161be0fc394b205a69c84620e2b99bd73446f6b4538b341aa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9cbe07533e1c57ba8041fb0524bc85f3

SHA1
9a77e0c356a7612b358572242545ada7be26d125

SHA256
50e0be5b42c3d9466e06a504d65a67ff42aa126fa69ca3793efb77be87842c88

SHA512
6ef45e37f7f12e4bf114390a0ef7e2477087bbebb495a28ecc20d84d52083caf5c2f6a4188dc6c8bbfb9ae54918d451d57b8e8e23f511be78819523b9847035b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
43f2e50667f665470781c7a34d21ce20

SHA1
4daf40c3485c15ebd494691364d1ebe439e91b30

SHA256
217c69be231a7430552c2a73e8aecf4487375095908e4293b4060cbd0103d770

SHA512
32aa0435aab933d4a479670ecc3452add1ec81e7425de59c1c2fa729d110bd942485977dea16749c4c9b3de75d272a7d22181298d14acba2efccf6241acc52d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
80269821866f6f63f4d90a49298dd837

SHA1
5257612112f864c0fe5b15df0aeb2da036957049

SHA256
a450a1ed2312306d9d67d01ebbaaae59f262025738c7dd79afbc14876c516449

SHA512
cfbf61e37fe8bf76668cacbbf803ba7a728d0b3f0d1683596ee1643dd051f3866c717855cdab342d641fbe8935690f036d2b73b6435232a727115ace15f0d398

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bb6020f04824e0ed2d78e5256fe15352

SHA1
3885517b16a41081d3a34977f23c72485d01cdf0

SHA256
7b6dd847856f83f105a339ff02b1b5801e01974054bd7af19ef6e6ff8ca7cceb

SHA512
e11890265bb71973db571c9d4156339c4c3e1221dcb69c3eb099b6593af9efb1dd04933c61bc829e91308cbbe789b0d1f834c6fd3c17d94659ce2d3e2e61f874

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fccf.TMP

Filesize
203B

MD5
446ce49c05827a65efc7bc3f6f415496

SHA1
11ce44b21fcdd676dab65bb1d52c53b0d375e716

SHA256
97d6952a16327162b6d6622229ccc9e164cb4926e06e6a7257235a64ca0c933e

SHA512
49cccbf88a30cdcf4d02009c137eec66d4536c44e3013810dc5a231c8a3e20c9f25a223fb7ac267ee018b39c6acdd37071f71cde2034e71dd7b3ba1005b4d1ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5d8f71.TMP

Filesize
1KB

MD5
490823a4d0d01030f9752a3191418da4

SHA1
7e50dfa878e936023c7873bfb82b9358ac472c50

SHA256
b1c530fac7de5aa98ef25bd691881a2a6b13e1eaa3f884af6d08e6aeaafec61a

SHA512
9df839d28dcb0fe1551dee949b2d37350d51303fe6ea2254b0e99fd6f6a31f8ca7ab0d14c152e23e8e8dfef92aca36f648e393053e4704f747b938f44330e7b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ec5039837b3e7ece871189476b809fc6

SHA1
f442193d29b0947cf664a410cf739b6e6102f5f3

SHA256
48cc87264dd4deafe4f86320f5b58b92f8b1c6cb86f03f97e291c6dca9eb03e8

SHA512
ee1b7de94f53aceaa9bed3a21fbfe7926dd18e6df412d621a357d855832dc15a1f07d5df888cec9348c7845cd5e589cd5c23bb5df0cc2e070f9faba1c9958e7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cc30c2863aabeef3c14bd4836bef25dd

SHA1
efddef3d02fb8a6c111a6925c98e9cd1b24efeaa

SHA256
7f1c21e1813473a5fdc90bd525dd36bc1f80e4935cfeb362a00118c2667beee0

SHA512
46858dd45e5c2f19b3a4c86200cb47c3b7e20f06ca934a20b6b0ec64a4207648329f18cd9e424a2ddcf8ae289cc6ad67e156196ca8548a443cf9ef819354db2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2e23089601d363d084fe6d63df45b609

SHA1
20cc900667ade949918a2a9072151846b34f6ef4

SHA256
b8106f493bf7c6d49a77accf758abe36aa7403c65f34db0d0305795ccff7c97a

SHA512
b63d7e710e41163c5e4b2070194629f0f0bb156b84de8c4010f988a0b5801e267444cd24c63917dd3639b1fea0c09fc177555605e3e51b27f94491c010c67ed8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
82cf26ff94d609bea4694e4ea1137796

SHA1
c103732bf16002f380ea6768c70e2374779b78be

SHA256
f0c0cd0286fb3c808294295a8f0287a2699c6c4264bb5c140f233dd35ffa822e

SHA512
c32a7b18bac2aca679805e7cabe59557982d9a3006809361a67899e8e0f1c3572f7de5c23d1bc5da3b2e38ae84ee197380ea2cc6a7afb61beb90f5b932e41e0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fbb18ecc0ea0ac684e01d22ef032757d

SHA1
f54e464bfa61b21d8609e58b23b95a8f7fdeee9b

SHA256
8cfc3b7b6aa0b0068ce64d991b651b39f7c76ca0f8a1fff6c3210879a5251d31

SHA512
a5485acdf8fddc8cf45f68fd320fd7d1fd3180080a5007fab8cb8cc2dd326ebc2bd338550f88bf801eb770549105c36e67f11e78d60e487bcdc385372f0d2611

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
261c164f5ec7786091d9a74208c19d65

SHA1
a566851165c303e35383c3e3339bd1e5e24523e3

SHA256
43592c0ffb5a263cd08fa3173aa57613a6f969c3e3a06eaa98b340b2bd3e12f5

SHA512
de177d41c1e3f0ba6b36b2255fb93adb14e32a8d9cec654e3530e4163ad9dbfef2ee4b95c09cb61f04c807892dfee91f5762464c5ed2ddfa66e7d45c165ae0b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
55dd539e5b13e0a8d652b3e558475c2c

SHA1
1f203d2aa1d1dd5660845f137513410d9f5b2971

SHA256
7ba634b8e887fdc24756755ebb33ef4df111a3081add9ebcd82adf4ec4fdbc67

SHA512
5e5af43d50ceb00a3f7f6e4c267397fe7bb9743f0808be768dc9141f44e92789f637103789726d8960862a3d9cf2a0f6e11e08493638992c4852e1a35f05a2de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ab392c063d85a01b77a002c6e8d67205

SHA1
3b6f922499385db5b8e84ad141e093199e8b92f5

SHA256
a545752f839bb7b82504b9ac6f30c9176021507d0b442df0756961eafd218acd

SHA512
68190077a97d68f0f8a9a6994b998f1d58639d04a5fec562d95292e575b0feee00447d3d280aea782952aacfb36eb52e8e8449a6a2d4120e5512e50d5133d296

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 18794.crdownload

Filesize
297KB

MD5
e722efb666ff25a5661b6216385acee6

SHA1
827bb0f5f84740f592f90e5a23890bcf7091da6d

SHA256
7ce8fbd2973d83619a09113a83c6aa9567fb66a7a5b160668bb4a4a264981c40

SHA512
0ee0e9c3006b04b1ac27d4c57a7bbfa375c730cf0bce68cc34af1bf7cba156d05231f54560a1cff6c606e7399252b91b42c53c954266af944c14c636ef52216c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 269126.crdownload

Filesize
1.0MB

MD5
055d1462f66a350d9886542d4d79bc2b

SHA1
f1086d2f667d807dbb1aa362a7a809ea119f2565

SHA256
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

SHA512
2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 461140.crdownload

Filesize
1.4MB

MD5
63210f8f1dde6c40a7f3643ccf0ff313

SHA1
57edd72391d710d71bead504d44389d0462ccec9

SHA256
2aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f

SHA512
87a89e8ab85be150a783a9f8d41797cfa12f86fdccb48f2180c0498bfd2b1040b730dee4665fe2c83b98d436453680226051b7f1532e1c0e0cda0cf702e80a11

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 524951.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 764542.crdownload

Filesize
297KB

MD5
348085a03c62cf183c14d12102a6f2d1

SHA1
d053fc0565a110207da05fcdb40d8efdd861c6aa

SHA256
5d7230eb61ae461d30ea6198c9708639041229c30ccdce8260618c062d52673d

SHA512
b3e1a0b7a25bc8ef93b9eb4dc987963c4958adda0d4b46ebb8190293f2311452b75e81344cc7e85c7b434f08891b4cb7741588d4f17993828558b677b416668d

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 901182.crdownload

Filesize
414KB

MD5
c850f942ccf6e45230169cc4bd9eb5c8

SHA1
51c647e2b150e781bd1910cac4061a2cee1daf89

SHA256
86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f

SHA512
2b3890241b8c8690aab0aed347daa778aba20f29f76e8b79b02953b6252324317520b91ea60d3ef73e42ad403f7a6e0e3f2a057799f21ed447dae7096b2f47d9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 935603.crdownload

Filesize
132KB

MD5
919034c8efb9678f96b47a20fa6199f2

SHA1
747070c74d0400cffeb28fbea17b64297f14cfbd

SHA256
e036d68b8f8b7afc6c8b6252876e1e290f11a26d4ad18ac6f310662845b2c734

SHA512
745a81c50bbfd62234edb9788c83a22e0588c5d25c00881901923a02d7096c71ef5f0cd5b73f92ad974e5174de064b0c5ea8044509039aab14b2aed83735a7c4

Download Submit
\??\pipe\LOCAL\crashpad_1208_JIOSUNLUOSXTWVFJ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3460-734-0x0000000005E00000-0x00000000063A4000-memory.dmp

Filesize
5.6MB

Download
memory/3460-735-0x0000000005930000-0x00000000059C2000-memory.dmp

Filesize
584KB

Download
memory/3460-745-0x0000000005AD0000-0x0000000005ADA000-memory.dmp

Filesize
40KB

Download
memory/4788-733-0x0000000000B10000-0x0000000000B7E000-memory.dmp

Filesize
440KB

Download
memory/5552-954-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5552-5153-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5552-932-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5608-935-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5608-2891-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5608-5883-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5644-6528-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5644-5905-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5668-7499-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5668-6968-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5692-7452-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5692-6854-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5692-939-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5724-6701-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5724-941-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5724-6853-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5756-6856-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5756-6848-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5756-943-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5824-14916-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5824-14911-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5824-959-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5832-14920-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5832-14912-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/6044-15006-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/6044-2441-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/6044-14914-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/11992-14913-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/11992-5885-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/11992-14922-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/17412-26253-0x00000212BE640000-0x00000212BE650000-memory.dmp

Filesize
64KB

Download
memory/18988-15013-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/18988-5903-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/18988-16845-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/19272-16933-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/19272-15181-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/19272-5904-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/20856-26207-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/20856-26206-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/22152-16555-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/22152-18245-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/22160-14917-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/22160-14918-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/22160-5902-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download