chaos | hxxps://hatching[.]io/blog/tt-2024-11-07/

Analysis

max time kernel
221s
max time network
222s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
16-11-2024 08:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://hatching.io/blog/tt-2024-11-07/

Score

10^/10

chaos bootkit defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan upx

Malware Config

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 2 IoCs

resource	yara_rule
behavioral1/files/0x00280000000452b8-1535.dat	family_chaos
behavioral1/memory/5196-1539-0x0000000000400000-0x0000000000420000-memory.dmp	family_chaos

Chaos family
chaos

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Control Panel\International\Geo\Nation	Cov29Cry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Control Panel\International\Geo\Nation	svchost.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\covid29-is-here.txt	svchost.exe

Executes dropped EXE 3 IoCs

pid	Process
4188	mbr.exe
5196	Cov29Cry.exe
6072	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 31 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1263212995-3575756360-1418101905-1000\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
106	camo.githubusercontent.com
107	camo.githubusercontent.com
108	camo.githubusercontent.com
109	camo.githubusercontent.com
110	camo.githubusercontent.com
123	raw.githubusercontent.com
124	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	mbr.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2016-1508-0x0000000000400000-0x00000000005D5000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241116083945.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\cdb0b6a4-2c2d-40ea-b1f0-2f2bb5419acb.tmp	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cov29LockScreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TrojanRansomCovid29.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mbr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
632	PING.EXE
2052	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1912	vssadmin.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

T1112

pid	Process
888	reg.exe
2640	reg.exe
3740	reg.exe
3312	reg.exe
920	reg.exe
4264	reg.exe
1552	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 788214.crdownload:SmartScreen	msedge.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
632	PING.EXE
2052	PING.EXE

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
2816	msedge.exe
2816	msedge.exe
1388	identity_helper.exe
1388	identity_helper.exe
5024	msedge.exe
5024	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3036	msedge.exe
3036	msedge.exe
5196	Cov29Cry.exe
5196	Cov29Cry.exe
5196	Cov29Cry.exe
5196	Cov29Cry.exe
5196	Cov29Cry.exe
5196	Cov29Cry.exe
5196	Cov29Cry.exe
5196	Cov29Cry.exe
5196	Cov29Cry.exe
5196	Cov29Cry.exe
5196	Cov29Cry.exe
5196	Cov29Cry.exe
5196	Cov29Cry.exe
5196	Cov29Cry.exe
5196	Cov29Cry.exe
5196	Cov29Cry.exe
5196	Cov29Cry.exe
5196	Cov29Cry.exe
5196	Cov29Cry.exe
5196	Cov29Cry.exe
5196	Cov29Cry.exe
5196	Cov29Cry.exe
6072	svchost.exe
6072	svchost.exe
6072	svchost.exe
6072	svchost.exe
6072	svchost.exe
6072	svchost.exe
6072	svchost.exe
6072	svchost.exe
6072	svchost.exe
6072	svchost.exe
6072	svchost.exe
6072	svchost.exe
6072	svchost.exe
6072	svchost.exe
6072	svchost.exe
6072	svchost.exe
6072	svchost.exe
6072	svchost.exe
6072	svchost.exe
6072	svchost.exe
6072	svchost.exe
1736	WMIC.exe
1736	WMIC.exe
1736	WMIC.exe
1736	WMIC.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2324	shutdown.exe
Token: SeRemoteShutdownPrivilege	2324	shutdown.exe
Token: SeDebugPrivilege	5196	Cov29Cry.exe
Token: SeDebugPrivilege	6072	svchost.exe
Token: SeBackupPrivilege	3276	vssvc.exe
Token: SeRestorePrivilege	3276	vssvc.exe
Token: SeAuditPrivilege	3276	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1736	WMIC.exe
Token: SeSecurityPrivilege	1736	WMIC.exe
Token: SeTakeOwnershipPrivilege	1736	WMIC.exe
Token: SeLoadDriverPrivilege	1736	WMIC.exe
Token: SeSystemProfilePrivilege	1736	WMIC.exe
Token: SeSystemtimePrivilege	1736	WMIC.exe
Token: SeProfSingleProcessPrivilege	1736	WMIC.exe
Token: SeIncBasePriorityPrivilege	1736	WMIC.exe
Token: SeCreatePagefilePrivilege	1736	WMIC.exe
Token: SeBackupPrivilege	1736	WMIC.exe
Token: SeRestorePrivilege	1736	WMIC.exe
Token: SeShutdownPrivilege	1736	WMIC.exe
Token: SeDebugPrivilege	1736	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1736	WMIC.exe
Token: SeRemoteShutdownPrivilege	1736	WMIC.exe
Token: SeUndockPrivilege	1736	WMIC.exe
Token: SeManageVolumePrivilege	1736	WMIC.exe
Token: 33	1736	WMIC.exe
Token: 34	1736	WMIC.exe
Token: 35	1736	WMIC.exe
Token: 36	1736	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1736	WMIC.exe
Token: SeSecurityPrivilege	1736	WMIC.exe
Token: SeTakeOwnershipPrivilege	1736	WMIC.exe
Token: SeLoadDriverPrivilege	1736	WMIC.exe
Token: SeSystemProfilePrivilege	1736	WMIC.exe
Token: SeSystemtimePrivilege	1736	WMIC.exe
Token: SeProfSingleProcessPrivilege	1736	WMIC.exe
Token: SeIncBasePriorityPrivilege	1736	WMIC.exe
Token: SeCreatePagefilePrivilege	1736	WMIC.exe
Token: SeBackupPrivilege	1736	WMIC.exe
Token: SeRestorePrivilege	1736	WMIC.exe
Token: SeShutdownPrivilege	1736	WMIC.exe
Token: SeDebugPrivilege	1736	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1736	WMIC.exe
Token: SeRemoteShutdownPrivilege	1736	WMIC.exe
Token: SeUndockPrivilege	1736	WMIC.exe
Token: SeManageVolumePrivilege	1736	WMIC.exe
Token: 33	1736	WMIC.exe
Token: 34	1736	WMIC.exe
Token: 35	1736	WMIC.exe
Token: 36	1736	WMIC.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3024	Cov29LockScreen.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 4884	2816	msedge.exe	82
PID 2816 wrote to memory of 4884	2816	msedge.exe	82
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 1520	2816	msedge.exe	83
PID 2816 wrote to memory of 4660	2816	msedge.exe	84
PID 2816 wrote to memory of 4660	2816	msedge.exe	84
PID 2816 wrote to memory of 4488	2816	msedge.exe	85
PID 2816 wrote to memory of 4488	2816	msedge.exe	85
PID 2816 wrote to memory of 4488	2816	msedge.exe	85
PID 2816 wrote to memory of 4488	2816	msedge.exe	85
PID 2816 wrote to memory of 4488	2816	msedge.exe	85
PID 2816 wrote to memory of 4488	2816	msedge.exe	85
PID 2816 wrote to memory of 4488	2816	msedge.exe	85
PID 2816 wrote to memory of 4488	2816	msedge.exe	85
PID 2816 wrote to memory of 4488	2816	msedge.exe	85
PID 2816 wrote to memory of 4488	2816	msedge.exe	85
PID 2816 wrote to memory of 4488	2816	msedge.exe	85
PID 2816 wrote to memory of 4488	2816	msedge.exe	85
PID 2816 wrote to memory of 4488	2816	msedge.exe	85
PID 2816 wrote to memory of 4488	2816	msedge.exe	85
PID 2816 wrote to memory of 4488	2816	msedge.exe	85
PID 2816 wrote to memory of 4488	2816	msedge.exe	85
PID 2816 wrote to memory of 4488	2816	msedge.exe	85
PID 2816 wrote to memory of 4488	2816	msedge.exe	85
PID 2816 wrote to memory of 4488	2816	msedge.exe	85
PID 2816 wrote to memory of 4488	2816	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://hatching.io/blog/tt-2024-11-07/
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffedd8c46f8,0x7ffedd8c4708,0x7ffedd8c4718
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2104 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1352
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff72e335460,0x7ff72e335470,0x7ff72e335480
    3⤵
    PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1680 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1664 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,16212030793305885035,15435092205909350406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2844

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5712

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\f958a804-8aa9-4f1b-82ea-5876f319e0d0_Covid29 Ransomware.zip.0d0\readme.txt
1⤵
PID:2328

C:\Users\Admin\AppData\Local\Temp\ca8fd91f-aa8e-4176-8f40-553188e22312_Covid29 Ransomware.zip.312\source\Cov29LockScreen.exe
"C:\Users\Admin\AppData\Local\Temp\ca8fd91f-aa8e-4176-8f40-553188e22312_Covid29 Ransomware.zip.312\source\Cov29LockScreen.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3024

C:\Users\Admin\AppData\Local\Temp\0777675a-7d47-4aac-be08-3320fec88ccc_Covid29 Ransomware.zip.ccc\TrojanRansomCovid29.exe
"C:\Users\Admin\AppData\Local\Temp\0777675a-7d47-4aac-be08-3320fec88ccc_Covid29 Ransomware.zip.ccc\TrojanRansomCovid29.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B538.tmp\TrojanRansomCovid29.bat" "
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:5500
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\B538.tmp\fakeerror.vbs"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3356
- - C:\Windows\SysWOW64\PING.EXE
    ping localhost -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:632
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:888
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2640
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3740
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3312
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:920
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4264
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\B538.tmp\mbr.exe
    mbr.exe
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    PID:4188
- - C:\Users\Admin\AppData\Local\Temp\B538.tmp\Cov29Cry.exe
    Cov29Cry.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5196
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Drops desktop.ini file(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6072
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
        5⤵
        
        PID:5632
      - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:1912
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1736
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /r /t 300 /c "5 minutes to pay until you lose your data and system forever"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2324
- - C:\Windows\SysWOW64\PING.EXE
    ping localhost -n 9
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2052

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ef84d117d16b3d679146d02ac6e0136b

SHA1
3f6cc16ca6706b43779e84d24da752207030ccb4

SHA256
5d1f5e30dc4c664d08505498eda2cf0cf5eb93a234f0d9b24170b77ccad57000

SHA512
9f1a197dccbc2dcf64d28bebe07247df1a7a90e273474f80b4abd448c6427415bace98e829d40bccf2311de2723c3d1ad690a1cfdcf2e891b527344a9a2599d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
39191fa5187428284a12dd49cca7e9b9

SHA1
36942ceec06927950e7d19d65dcc6fe31f0834f5

SHA256
60bae7be70eb567baf3aaa0f196b5c577e353a6cabef9c0a87711424a6089671

SHA512
a0d4e5580990ab6efe5f80410ad378c40b53191a2f36a5217f236b8aac49a4d2abf87f751159e3f789eaa00ad7e33bcc2efebc658cd1a4bcccfd187a7205bdbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\227f2fee-2945-493d-ac65-a38e2c6b3b1f.tmp

Filesize
1KB

MD5
c61a8ad81a6d7157a737f895df676f2f

SHA1
ebf4da7d02568f5dc2bc2d7abe37fc80fd901f9d

SHA256
c636fc562c176be6d5204cb52ba2878332c47d2fb840ff65e59a4242e3ce88a3

SHA512
08646ab378d81e9d123fa59d1dca48bf962d1a89b91af3e3b3e3652f7a4f27cf5bed6ad8a1f203574a725b337ef2990c06f5b92f46cf7ebb0b4d51679b3436a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
47KB

MD5
9f96d459817e54de2e5c9733a9bbb010

SHA1
afbadc759b65670865c10b31b34ca3c3e000cd31

SHA256
51b37ee622ba3e2210a8175ecd99d26d3a3a9e991368d0efbb705f21ff9ac609

SHA512
aa2514018ef2e39ebde92125f5cc6fb7f778f2ab3c35d4ec3a075578fda41a76dbd7239fe2ea61533fb3262c04739c6500d1497c006f511aa3142bb2696d2307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
67KB

MD5
b275fa8d2d2d768231289d114f48e35f

SHA1
bb96003ff86bd9dedbd2976b1916d87ac6402073

SHA256
1b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1

SHA512
d28918346e3fda06cd1e1c5c43d81805b66188a83e8ffcab7c8b19fe695c9ca5e05c7b9808599966df3c4cd81e73728189a131789c94df93c5b2500ce8ec8811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
25KB

MD5
8b06b747bf45671dbbfd53cdf42b39b7

SHA1
036ab57ac56e3e82e24d25b1e8fc3da0e758dff5

SHA256
77b7ba43678eb41699aadb083add7958be7f1a7d3bdeca68e356ce734bebb623

SHA512
d8545ae12e2ee9da79e099d02e94b227e79bd7d4b79ebb65fae983c68b1234d3556951805a659876e184db92c8575512e84fa850ff2f2f90bf93e8eb17aa7b32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\03eef0e77feb64d4_0

Filesize
6KB

MD5
6032785cced4b65d628fc111349f5aac

SHA1
1a6cd4171f9589ec636d5c66cbebc77c747c9f4d

SHA256
a3acfad7964ad93f84d65a5e72e2e1792b120067333d1ed67a02bd663d2e0406

SHA512
58b425d4be380627b01d6e902a18e12cd18b9a860ca0ab6535b591d22b1ec09764ebf09f4eb989cbf3ecb39f653fa896908f95b523a2501cee30d7a55f9d6fdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\14ff8116b518ca2d_0

Filesize
2KB

MD5
47f38188544093e63a948078cdaf6da5

SHA1
549c7f9e16901b2b6d4b85d3ab6ebf778de38a60

SHA256
1d4d32224618a6fc61cceb3c1798d9eeffe3f2dee014a51a514c2d6d5d42c31d

SHA512
b3d6d9b69b86ba2ff9cba49d420c13d9edef7f25089e1e1d994ce4a472ab9e39c0168d85f74db374836505d1b4867bb8718b8332ca6237301820f65ed0d07ea9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2f4680e8f8f8a14f_0

Filesize
13KB

MD5
47a96d244d9e5408d0832c2a410863ce

SHA1
22537647ac1a13375c62b030c6e46b368b4dd344

SHA256
3e11cf18ff1478ddef4ef35762a85c21ee09213fa12a79cb45ab866fb973a342

SHA512
f6061fd690b60594e99ca92b38d88c3ce117953562222a200030c39673d3d412626c8e5050c4b7489ab4131574ce902d047812113621ad07de16e47389128e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

Filesize
1KB

MD5
8d246c190344656bcfc495ea73414cba

SHA1
0cd7747939f8f9939ccd5a6f0f9b132f38757fc8

SHA256
3afb32c84ac07ecd3e5134980a5283c186f4cbba03c21d2017f0ecf737cd30ea

SHA512
6a7e6be0c136570f7b8f810dcd186aaf85607e36417ed254b69bb430912f0e67d9d16d743d9db8bd0524cfdf786c3fe96318007d5692db0193db6bfa6fcae0e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ac5abc87e80789_0

Filesize
3KB

MD5
6c04a8100290d41848cf1fb6bc3fdbd9

SHA1
7cf234e5a0170491e666bf2ecaaed99ea5ac92cf

SHA256
63cff6742a048bf357e2e182b602a99784a28960a7df4ae08f96be1a0de6c76c

SHA512
ea75f7ed8d56677eb74869b9eaaf6eee117b4ce6bdb7bffc15432ea2612cd80f2542dea79e520e1ab524040fb121e47b42c5e37be8434016affe13cd190ea874

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5dd1e579c9681f95_0

Filesize
2KB

MD5
a33b4373ec4741e68ae76f0d26ac5abe

SHA1
b30de006801bec7b457473c5962d77384bbeeb91

SHA256
49a84e13d39a052d1621620cfe1453ee8e7ca037ac804f9f993448bffc675ec4

SHA512
a97436e063ad51ca79a673da026e5d93c701a493ac8aa75de738205352fe909d44f5783b6d36c75f3ddab5d77fc25118d5dd7ffdc305fa78f3ac9e24ca8e275c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5f1d94d5862e00f1_0

Filesize
11KB

MD5
60c214697d13e12a624382981267b515

SHA1
c2c75ce6617a14b4427f19d808388b59e1517f87

SHA256
0c9e7435c2cd0ce6fa163443a7c9a3e1fc9325236e3b555019f7a85652927c6a

SHA512
fc22a48b6f7aef8dc8909c4001cb065093dc77bca07358ef7c226ed99b850e6434c905e16daf091ffa18d2f9af9ed0dba5b17620f0d7f89f7774d7d0fd651d2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\61a0b4d20ae0e222_0

Filesize
14KB

MD5
279a0cf645f977973f862234ff626789

SHA1
77901c42ecaa619ab6c1ae1a18e6ebefab5e0f47

SHA256
cc2922877d6d40397d7efb447acffbcbc059a4846dbd2bc29c1e46b0b28c67fd

SHA512
2cffba13ade8fcc2378f681926d46b3879697252b492655096882315bc25243ebae57c17d39c38fff973091d46ab5022db4efaa222238937cc586d04035c49f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\635e64b37935c888_0

Filesize
1KB

MD5
c7b608c759e2ea9c5653edc77f4dfeb1

SHA1
5beb9949fc3dcbb126408a2d3584513618ea0854

SHA256
a2c047c6bad3e47816daf462f10af144246e6614b0c4fb19faa600e09f6406a1

SHA512
27e4d9fc92e519acbf121ffea0f2bb2929c3f34348a61b4f417452d3f206f1cfee3e74310139cfa91e1fafe465e10ec5bf60b6ea32043fe0f23786da51921d3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6aa9a2943612cce1_0

Filesize
3KB

MD5
b8da4a43223765049978b4776d443a58

SHA1
6d5d5b047c53ac9f2fa18ccfaf7e47bf72841ed7

SHA256
63463e2911db6e60bbb0e8c3bd3d3bcd23017cd27ea089854866344105a104c9

SHA512
574beca1ee3d5f5d66b41afec53d08b35f762595cf46a4dd8c138879be67ba2857c46dae0b026121f193644bb3c050744f01000a28562c1fbd6af7f94b8fa82a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6db290dce274a012_0

Filesize
4KB

MD5
33ad1c2af94862f91252ff56a14ec794

SHA1
42e1c746392b3cc54c0bab4f564b6980087b0049

SHA256
73bac83c5f5bc6f300b12146a018c0c4926d7fb8cb931a40cb80d4cf047e8b5b

SHA512
8225c95021f1a43fe0b15512f753b66e184033b7d635cc3aad1efcb8ef69b733aa13d76759c224795aa3a7defa6d7e625be9fc0ba33ba90ff2ecb89cefb79c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6e1427d19ff38087_0

Filesize
5KB

MD5
43b5780e576a0fcb24635170f6c2c68b

SHA1
154008b56bfb945a532162a554bbe509d739af1d

SHA256
5903a27cb95c474c96d944413de4fa4b23da337b017dd8907f4c71120bd41fc6

SHA512
b157752457ca62c28aa17935f380fe21df45a7b38d270a621edaf68c5cc3a1910e6d8d62e7542b50102453d711e64e1452df9b02bb37a350435e45900eabea19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6e2f3d5cfcb3712c_0

Filesize
18KB

MD5
3ff0044419457779cd1a153fffc38400

SHA1
6481ee4bf856b8c21e04120dfc524124c2a1d63c

SHA256
a2643af646f433d1cda63ff421ef73db3fbed0581647525fad045c863dd0c0ad

SHA512
204d0609b8ece7ba71d378b7289ef6a7af0c731959e18a023d797e819410a22fa33ec9cbbb40e74dbb94cfea62b41b6cb8b3a093b4d861ab82b26d58941adafc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\71d68e68ea4089fe_0

Filesize
6KB

MD5
aa0b2116a4e2a80f65b4c7131afa1dfd

SHA1
74a8649264dfeeba7c0d2731609968424a182c18

SHA256
260d46ef70fe64013bf7032fac8cc79ccaa50b4facaa76216f7deeec7ed3c1f9

SHA512
fe2956d984dc4be0590d5f2f33fa60109cf643e8d404f40a975a4fc74ca595408357e0e159f085e85aae202b2b738ab4681764b4bcbf5962c993c11c39ed4dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\78bc646c0524ce58_0

Filesize
2KB

MD5
d21ac04a7bdcb262d9e82ff23068b384

SHA1
cee278f9de8ba749d83d82fcb32205493219773d

SHA256
0d89c2ccfc92cb6e63dfa3adcdc83526bac8de7cebf3861d44a4238f8b8d9e8c

SHA512
c0a44519461f7c3c97ec092a5e34e6a0df529c772343432a5b9836adc566914d71faf81e4cccde4a87123440968d86b2eb1246488ba3c8d712705168703deea3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7cf9843337c39c04_0

Filesize
1KB

MD5
691af4293cb085835e9a4fbe9c862b42

SHA1
1d75fda5ff7ad91157ac0b4f6a8349a6b7714976

SHA256
3706b2252d0f1253d0dafade5a6a33364e312e50c86f9982bc1ff4226ddd1c06

SHA512
f98d501220746b5388f521357e916f73204dcd8fecf6c4e44f190033b0e65cf0a0b0e7e4d314719a50e38563a2d25d72af8e7fb6867b6ec5206de86faf74205d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\996f94088648ba82_0

Filesize
2KB

MD5
4c6fcf2f7f85ab4fe7ec9d8d57b01b6c

SHA1
46c73bed00ca9297fda7d00f8437ac455f8b1957

SHA256
a15a235f0a01da69def86bf593078ce57beeb24d8f614557b279d2a984870969

SHA512
4a14ec3dcf3dce18786ac1b21e32020eab0bb0508de75ecf6580d53951d47e8d5df75f1a06781b396e3012dddd1e876aa4f6010ead82ffa4756f29f2d78f42be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9ba0d3d1ac7bd8dd_0

Filesize
2KB

MD5
5b57d797e252656c418b3c551aee39c5

SHA1
772428f3b7fb88b093089cca16dda3c842b61f8f

SHA256
9b13466a383552095fdf666f7a6e7c6ff58c0d817e5bc3811cc6cf6b7a089592

SHA512
4db9dc42c25e71a6b1860b502688f1b3115b0b0dc2c91e6ec4ccd12d58e2883d55d50fdf5a83db51a659346a6b529120448f89ab7efd8fdef3eaa5ad35c22ff2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9dbb949d27873cbc_0

Filesize
2KB

MD5
de79b08c08fb5744bd6f1fd36c249015

SHA1
71c07c0cc0ad7b97b634b48da7d2a509cdc3aa12

SHA256
79d9dfe6573cd641dcc7e495d55f5bafce29ea175d5fa6dc8a8e6ed12e2b550b

SHA512
08970582867dc221ad699cc579aab429955332f88c66c8cda32e435cb2a1238cd5c5ea2ae54befae84dee68bb3040f4ed23b6daa7e4b4bc6decb70aaac6f5433

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\af2cfcaf6d9b18bc_0

Filesize
3KB

MD5
922985afe6c46aa57a7ad6c1669d653c

SHA1
e2a381af1dd7b722f2ab89bd892859a295a971f4

SHA256
19214b315874886938e4be889edfb5f125a97ff8fa4fbda0786fc3a4dae23538

SHA512
d39db58b49c0d4defc5baaa59825c37d818143d9428297ddcab8c1cf7e2b59c81e42a7fc3b19c252b29452e701a29374ebb95a38cd145bc4e585b435afc28b1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be6d12311ce2b399_0

Filesize
2KB

MD5
23e62c1d22c74ff78cb64c557e87401e

SHA1
c3e2b02a357e929b6c270a920bec9d4a1cc12e11

SHA256
cacf144f685c5392f57ee60b49c3b56e3c2609d61e17a7d9557bc23a2abacdf6

SHA512
191d8b02c8e1dc77174d4f7ba34b6d567d8c39403a87af5c2846a702bebb9a8f329b9765a243a67b90e8cca8241a23289c99b42a58312a64a167a0f71b626bc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c211c9dc68f4bf01_0

Filesize
5KB

MD5
15e2872efdef90a6028b4c902ffcac2b

SHA1
a86a8a2075d4b598e9e38309286394fa7754a9ad

SHA256
abac00efe849d49217b37fe8eb179716c25876eea4dabef69294b52c626d9614

SHA512
7406d8cfa1a7f815ba93893304c79a1ff3e5f38ae00870aec0edc06acede557e3fe0341d59b3671d0a0886976c610b414b10092300d719affe2dc6c4b35e377f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ca5bb3c84b908d6e_0

Filesize
2KB

MD5
68e8eb36a5041fffa4f7e482f1aad412

SHA1
5dd409da6ad6e7a774e080537599c8fea2cc3898

SHA256
54f8f734991e600a44b1beed7721f4b332c779e5d7ceb3ef2773ee081a61755a

SHA512
8cd893439d3b22841e479603f04b9e19b205eb53a30528ff4ccda37d6c08ae03ab1cc4572bf36b95139117eb0648d961b8a44ee8be47087e0a40b1979c7bbf10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d45aae6d8d9c9ff2_0

Filesize
2KB

MD5
623b3d496d84aff50c2bf9f210d3ba4e

SHA1
71080f41cbd4647c1db5c0221377acea1cdbe786

SHA256
fed8f5ee3ce76971e3fe38b4b704b553c12d58632c6619945c590f12b7911b76

SHA512
19a7d6350ecaf5815233e3d06207aa6c1f9892dbbd6d060934e1107c2f0ece66982eeea1fde7734c029778f01e902ae32022264df63e3653ed4f886ad784cdd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e55f0a6d1b533c66_0

Filesize
2KB

MD5
6ccd1ed94a187881fbb5ab3dfb3ab3b2

SHA1
52a45dd80deb60181befd4efe55712157f20705a

SHA256
3c1ce6e02d48a70226a5742ab45435dde50b73c738ec576d99441f66d1bab4e8

SHA512
2fc9d1c7f9ce2091a09a290a92cc9f5bae2e9a544543c297e478504748a10b3cc23c4540ef35d786910d35d389c4643049c92bc2c49366b56dec9c410d1be3b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
e43028e992f87b736611b8e7e2060710

SHA1
8653255db9c0abeb295e7533bfb7fc56bcf02952

SHA256
f14c4ba323fa32010bf7e7dcf0e44816ac0341d9eebf50418584fdf94e769e98

SHA512
bb0af0a855479b20c11bc7f65787f77fa48b47e0c45fa46b86c93bc8a440699e20fe4f16ac97b2c06c73d4d8b5a3ed29364a754424238086d6eeb20df86e7e08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
55637c1532636255236daf597d6f4316

SHA1
33bacdbe9c901679efa038e59cd7e9f827c9e110

SHA256
e856cc4dd96dcf4743f58318e509fd82e6e42f0deda7b8f4d453da3714225d58

SHA512
2e7083bc932d3ba300041edcad42d80855b2521eb67c5939ec13aba0021237ea820ee816c0490ef5ec5ca1ccf68917d92e1a5f3f2bedd14255b57a75e522b766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
df9176bda327c61936bf4c63f29962e5

SHA1
9c6db824aa0f8adeada088e4a81443b68db0a338

SHA256
8039e5777c2ad99b814519ff9c0a1d817379d9290a84ad97d174f8efbed3d1ef

SHA512
990f16a87289a712f2f47c17a425304d0ee48f739eb7de5073f2577f7c0b865a27280813a4af96c39f41bf286a4181f67efa48c53c1f627037c077949cc2de80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe588c0e.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8126ab1b566db403b9d7180645c99689

SHA1
a22b6a405c807c4b41ca165666b21ba07d80e2c6

SHA256
570628e73dca697a347752ad94642f57d40427c7a525e9f5781612e5dc652c19

SHA512
5f8dfe39d5c88a4638e408c8edeec2d055456a39d01108c8c9875933e7090215fee47b6edfb20b9375552109a80814cee0e44597ac65570c6afbfbbcb26bd5f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d67bdc045bc3684c7660c663e971a235

SHA1
b1d965821ec44df52237eb200ea0b3f4910ad044

SHA256
ceb71055cdb835f5bc6625be864600dfd04e5d61c7874c4f8adb5ddb2b118b96

SHA512
f7e193d088043d98428ab3116e1c46970743bcfa441fee27a2398caa35a4fe2fddf196c3d56b576a67126cbd1d9a6717f522dbf7e2099769088e9e1e7cfed711

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f225236ac0d43441310fe245de90f39

SHA1
86fbf121d55c06c064e8381694d934d807f91b33

SHA256
909431a52921e3ee39c547dc041da447a6537bcf69167dee584071f09a51babb

SHA512
535be6aee75f224d2c8408466981439473e752d916dc82326d113a8b8ebb33d9f5364a99dfcc94f31d06575a3c8c40449e49f8dc9786947a980207274fe6fd13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
80e0382fae73c25a7301a11d25edda7a

SHA1
884e1284ebe364871d641595d007fd51c3925e75

SHA256
92f89f3c42e0982aa5f1af39d12b088c2d9d0a20cafd3fe60c7dd6c44f05dd4b

SHA512
35587ba826c6f0b13fc3a7393b5e6c8f3ea5e0a25a5032af3de85fb4ecdb2570ad976604b51a1dd51811c94d3bf3f5e632b06b47dd0592f20690e93bb99e93e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d9fd7572796b70d083d17a17ce4bae71

SHA1
6f56e7abdb0924b14fd977ee87fda2f41d3a58e8

SHA256
9e11542d25b4746449c98de0f9b655bd85040a3df9c544934364d89f7bb9dc1f

SHA512
119ce750b51ff6f2a9b1aae97f2408af9108717e5faa86f6b107e5cb1d69fafd10163d31c17f65cce23afe97a0d24f8d67a2def4ab35a31f3cfadd2a4a6decaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8dc37959363fc3c8bacf040d8fdd2c3f

SHA1
f70621cee5baeca2991549d9b9617f267e63b9a3

SHA256
e870c156bad52a2ad11d31b6823b1e63785548f9a8e1e552efe44bf93e4d4de5

SHA512
a6b1f7be85fd5bb1baa1091f29f8786a6e1b713d295ba2568f0f4eefd0aecd156f9f2be06f3a60fd04d43fadc14a59827082fecf9b2db6254b9c5d6d42ce71d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f9e995a7b6a17c62c806783bb69a08a

SHA1
14d8e872b90cc1ac674c7ab9fe1aef5b2cff484d

SHA256
f20e3d8b00e0eac1c0c1347dd27f4fa2bc49abc456ab5e4dcfff3aca7a9cc495

SHA512
bc4eb1584ebeb2f81d4f099619bd544c68a66f3987c20fd76507e2f535b77d08591ff5fca5c6815758715be27f8a106f6efd689e8f383bdd1d83b6c7e1ba9606

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
612d9b5fdfc20f6db1f55e0b0a4b8a41

SHA1
c1737e13fcdf079a0d0ee7cae947149dff80215e

SHA256
382134feb09a1d79bf47454ba5adf4f24fd58ae58275cd33f12c45a962ec2100

SHA512
3c73312b3c93da0a47cb0d68bb2c7a9fea07689d596bee625eeef5a62c07ac8483a459d3fdce6078a1d2bb3daafbe55b933e14664da00ddb46920c9f23d6ac7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eb3b35f805385a783fdaa7b0cccf0359

SHA1
e83266d9b9cfca3bf3e6284456e55dfdd47cf420

SHA256
b4b662ddc1daf98facc9a78c0037e3656f6463edd0821f471a08a56331aef3e0

SHA512
2d1d4fbccb8a7d918bdc4c4940a4ae5b624d42e3adc05f6bb2497a2ed60514d305c246e5bfda8f4761a0deb81378d154a58e2a43df190cd1350946f6699560ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
215dfd362649ddc30d2df0c2747a540b

SHA1
c61571a93f66cd44fadc2c08acf0fdec452f9e97

SHA256
f9226106582b1e256ffbcb07e646027fb65c8a44b2a346550968d8f06a32e0d4

SHA512
a5353ed46b90ec7173d32595ee975bd47b5084a342978026b1d9835f70d8b1b58ff454370d6d043073c6c3b84bec87ca6f88f11e897aaa509832edbfd69df2e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
60d82bd601d64fd00bb0373f5ecd65b8

SHA1
0e8bde426270dfa3ea285c2c5b7282ab37771d4c

SHA256
bdec91a5061c6a400ef33c2dca5b1d0c16c1fe9e464f8ec99a72442b752e6a97

SHA512
5ea1b33784438acd246c02c95716f72c78293bc8d8e8e6d71aeaab370ae9fc2063ba8ffa443bbfc26c96e45a95549b62894b846a459c986531b34a110d0be38d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0e98d1679e15688ad133f11eee8458ee

SHA1
a4b1a83f0a3f2867954d3146d95d314441950606

SHA256
8aa7eaf918f2969424996a8f3575478006d9d74b308a750f996fe4f5f045554e

SHA512
eb34d52a8df4992444000a93c8d0d11254069b5f43a68a6def21061be03a538f36c42b2e968a8637f12b93235de3140002b0212aa2cdebe0950fd115c04bc72f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2a6d0d7291ffea66e94d8f1c5597eab0

SHA1
878fc3087198b4791cdb014d6ea65fa3a1c566c0

SHA256
f6932fdab3c78b61ab48623244d505abb9b688e4f62db8467328a7e122a7fe2f

SHA512
1b6764279e87f8afdbee52190d326f6503f5344dc088688c80a13cf6eb8d19d3e7ccf1e48c79b77149748829d9f1ae0702f7ee566f6fe0233e6b0c3e63c5df01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c9dbce6d617cb1f156648353cd4ef2c3

SHA1
277136deedc2925c2622f63f9f90ae082e486d3f

SHA256
dff6f1eff95dec65a460045e9c30cbad1e72272ebfa20083230ba430d2b0c826

SHA512
242638e7230edf5329037450bcda49f0bffd7c1ac51b6ede0541184696d0abf89a8e58d08f323414dd11f2f2bc3110d9c0580592a5b02023eac572eb016181ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
06c5f336fa28775af8a8361efefefc2d

SHA1
d768c5e3df9c01afff640d6ac27dd0f6917eb9e4

SHA256
ac7e68f5a1c60224d164865d804442811424f3c50bd4304e6991180569d74981

SHA512
3e46c4a7a385cd210a6647859cbf2e9b6318e6c86bc75af2b0f29f48d63decfcf01a9bb9e3fce237d35d5c3a7c6d3d2e7d4857ca88c7fc84706270095cabcf3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ed72e15ade3a62f387f776aa37087f49

SHA1
fd36adb4540eef8798fe0b0a69dc7bf21a7e2d8b

SHA256
3676ceae48649a7ead010bbfdf11ecae4973c57fec99a9909e6da443e9b93ce1

SHA512
5567f71ffd55ccdd3897e8cfa61b0cfdd9d9678d54e83f2aec6008377a2a3d2e2d52f21cc8df19bab9aa93d3687c98f48cbe59a3adcf6624408ed4fab0e16a04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
61b1d05cf3b773b9f87c7e13589c3854

SHA1
24612891af22b9826073838122469613d02ba442

SHA256
cc4bc079b1b2fc54e3403baf7bb195a207d3738dc1a9a72093f46e7c4fc4226f

SHA512
8998e811d0c7462095d4744ae5d3b2d6421c333c7f88e93a7ad15e57793eb54534745658936cf5666176c0412ef5323cf078faddef19ce3d97b1b9db9e7c13bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f40fc3d4a1dfb902d3aa8d69460c91b7

SHA1
ba2c61e60035beea4723cc9e5fd488e21dc6b404

SHA256
e0d515ae1ae7179b91c05b1958d4a8848be6fa1134110bcafcf67a893e7ca630

SHA512
8f58f05208c8680864098bb321b239665ee75f1eed0a98f7a836dec5312dce96a12cd003b14f76f88923edccfed96f7b2f6cd3bfa8652088f2e39f46c70d521e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
23e7997dbbc4686aff08a4e78d3bbb23

SHA1
2aeac711be5ad2ae0813452a42447e0dadb5c7c8

SHA256
3aa002220e828d04ddd2b9d3dd47dd835b7aa8c26a91e55e88fbf73664593adb

SHA512
8c7cc51e310d6809e214ce9b51a88000713a4e1b6e1a67513f8b256d54d1d4999c8ba3c92b8c31d12df57c911b16b63db9550ec59d15f70cffd5218f19024e2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5c3a897c74be78baff404d999f6b5fc1

SHA1
d36870397f18532600a52515722d95fc35eb901e

SHA256
367b5a36f3f2fbc8c34f643be5d38223a6ec3e910d2d0988fc1f747b31dbb857

SHA512
491466ad4b27a7b8743128026ee86863337f2d5bbd665ff88fe8ce1e047ac5a2b0c532319f0ba3428b277ffaf65aedc9a0262c9b315aa2a129a0f0b5f2a83044

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
553752b3de45f7f847325fcfe30c03fe

SHA1
00c708af6ada207c49217ce8ef5e126b94f16411

SHA256
79b574f6cd951b2ef6614b2e8f0676b8b34303210e176770a45bb0ee10787973

SHA512
2327b62424d9ebed3efbef1a67fb7abbc54631b305d389f561988a172e4b4d886613ade99b29939c0ddaa56454686b33c84e496aaf0634905eb596dc5345d00c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
5d7b1469a72d1d9c8edcc0ebc1417cc1

SHA1
aaccea526f06494c2dd8e3dd299682d530eea308

SHA256
86a46fcc901d636a19becfe8c272b6f3ed74b7c266c70759299d6213fe1cb067

SHA512
1a0b14f3736984d63b317887d7413f333628bdeb6b89523e106065c5ec7111221e6af444332470aacd2cee8e7ae96ecaba46477652cef9ae4b0f3ed2d0c9664f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
764a1a52f04571339ca2213baf80278b

SHA1
e1b5779d70f5034f58c826fd71dd21cdc9399468

SHA256
b74375102bb537c29c08bdd89c02bf066a1ddf5aaf18363db3cafb4c2f9b49c3

SHA512
3f695d6d045204b7d00549cac725c324393a8d43ccc32d0385681ccec4d21aef50b6285b738b371deb810a1ca73a46ec6ca9c6b0db864a9edbb5f8a8c51e3dd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
148e36c1d0786be02af0ae416959c254

SHA1
d16351b2d356bdaa9e3ebf2bfb9f2b04bccfb37c

SHA256
28b78a1ceabec83cbf405265f45bdbe17761994b9f36b5d646ec417b372f46a8

SHA512
4d283b617ed966171527c897e95f614e5fa654b35cb5f003a85f47a898d2fa22aeaa1653ef485c8707037eb1ea68de95c93a3192fef79e899b276b63d0608579

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
435fff43f220863f111c4c16c11d1c6a

SHA1
d6899dfdce4d74b0fb35fde7cdd5c99439292fa1

SHA256
466353d76d505776255a94f431935c94b37ca914fbe0145bf2e33a9a026bdc18

SHA512
8cf9a23926d9e655de8b84fd7d8b61bd58ddefdbd21e800bdc7d2382c47de34fde965e5044243a542e0432241d11f9db6a9e58746e04ef1d9dcdc86954680fde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c822.TMP

Filesize
872B

MD5
647fe3a09da47a7dcba8c73b349c1bb3

SHA1
8c2aa3fe135b46b95b34565536c567a5c2b3f3cb

SHA256
15ae4b3eddb8746034c26a463c72b58a5411381588eb1e195ee4b2e37c30afe1

SHA512
d8be11704b3c553182cec37c1bfea05feda774378fabf944a0631237fdc2e6fb3eac021a1ea1b80a27466cda299b3674ae49a48507577111488b2b00d64415d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
23cb7216daec45d61417ab654f4752c6

SHA1
bd03efe324da5dd12776288efe3c90fac3fd67b6

SHA256
ea75b42b5ecf4884cad89ea62bf321869116ac0bf6c4cf0c1df9346169781e87

SHA512
9bf8478b6a127b009603c7cb8caf5fca75e1ecf4f9cefeac4a4e35b080e837e9e607db0a4f019824de27fe95d6b94e135f89bf9b1360f703cb81c10324d5a5db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
aac8ddf9af66e5eff7f4b3de4d7024a5

SHA1
731872c600ebbb34e5e57a7627aaaf3cbee801a3

SHA256
813ddb815109d5263e760d90508e8784757d9af34d84b00a882102463999c429

SHA512
2c054ab5d23ffebbe18ae54d635b42e0893e43e3c136347c9205db909e983af465f3e9b086882462dc0e461cd1e9157a7a5ebe19bac411467c7e87f3c4af17c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
eb625e2a9d4df4349c847ba1be4262c9

SHA1
46d7dd325d7b9231ae9e10e3f238289f614da201

SHA256
bdd14dd6d4c1fe3da28374411d67827ce54f6ca21d541478378b0d5be5680142

SHA512
aed2f67628474472d83803f93a1aebc3b1a957db7b5fe00db2a470dc84b0368726e81550eeb308129cd9bc517f2c48d53a1310ecef1e1b152fc43adc1f3c87ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
904868b51b1ce1dcddc3d82b441c65a3

SHA1
a450e4d16d9c879ccc9ced111aa431cf725c28c4

SHA256
3b1cb181e6b1d7764cb9f9cc39e856671ff04b10e98093d7e10851d1b974cd2a

SHA512
4c061ce14d318f0e82ab4c20e8e2d0dbba80ade6a866e6ecd319fa4ec6ca6210fe80d29d4d13d65471fe218ccffe09314ed666a380a0ac37b5407268975767d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2bcae7289c7505f18642270cd30730de

SHA1
053f0d5caa8f1f08f573abde25894b0a26a544fb

SHA256
8f915fdcadcf938cca70a81165c94dc3022dd9c51200453bc21990aa05964c4b

SHA512
3bf28e4c235b3819515292d7f3d6bf0f3a31ff0121f5931293bf9750b11df37c22559a879a94d30724b16828c508b33616bee273afac58e796b5f0737a8e2ae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\B538.tmp\Cov29Cry.exe.death

Filesize
103KB

MD5
8bcd083e16af6c15e14520d5a0bd7e6a

SHA1
c4d2f35d1fdb295db887f31bbc9237ac9263d782

SHA256
b4f78ff66dc3f5f8ddd694166e6b596d533830792f9b5f1634d3f5f17d6a884a

SHA512
35999577be0626b50eeab65b493d48af2ab42b699f7241d2780647bf7d72069216d99f5f708337a109e79b9c9229613b8341f44c6d96245fd1f3ac9f05814d6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\B538.tmp\TrojanRansomCovid29.bat

Filesize
1KB

MD5
57f0432c8e31d4ff4da7962db27ef4e8

SHA1
d5023b3123c0b7fae683588ac0480cd2731a0c5e

SHA256
b82e64e533789c639d8e193b78e06fc028ea227f55d7568865120be080179afc

SHA512
bc082486503a95f8e2ce7689d31423386a03054c5e8e20e61250ca7b7a701e98489f5932eba4837e05ec935057f18633798a10f6f84573a95fcf086ee7cabcbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\B538.tmp\fakeerror.vbs

Filesize
144B

MD5
c0437fe3a53e181c5e904f2d13431718

SHA1
44f9547e7259a7fb4fe718e42e499371aa188ab6

SHA256
f2571f03eb9d5ee4dca29a8fec1317ded02973c5dd233d582f56cebe98544f22

SHA512
a6b488fc74dc69fc4227f92a06deb297d19cd54b0e07659f9c9a76ce15d1ef1d8fa4d607acdd03d30d3e2be2a0f59503e27fc95f03f3006e137fa2f92825e7e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\B538.tmp\mbr.exe.danger

Filesize
1.3MB

MD5
35af6068d91ba1cc6ce21b461f242f94

SHA1
cb054789ff03aa1617a6f5741ad53e4598184ffa

SHA256
9ac99df89c676a55b48de00384506f4c232c75956b1e465f7fe437266002655e

SHA512
136e3066c6e44af30691bcd76d9af304af0edf69f350211cf74d6713c4c952817a551757194b71c3b49ac3f87a6f0aa88fb80eb1e770d0f0dd82b29bfce80169

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk

Filesize
2KB

MD5
dc55e3bdc109927a5ec7d0ef3df6d1b5

SHA1
360673537d90a76c0356fab928af6333bc805f05

SHA256
7341dd4156ebe1c16a76dc4b291dbb6561f3f94e4f338ebf94709e0acc89a1e0

SHA512
9fe35a3ca22fa9a53c175f22e8d2f8370641a129c069b732e0f638a2acaacb95a6161920d44454a0b1fbfa4b59c9fda18788dea8c5aa3d35dd68cbbe4eb70aa9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
1b6db5d368942260136661a9f3aed2ab

SHA1
e836520a7bbbc6329440797a920bdb4ec38eb9b4

SHA256
585c428fac002263907972f78852144f7e8e8df0318ac5d3f4aab77534356c69

SHA512
72b5b363c98985db13fa7e752004abc1bf3dfea39dbe20107b1d4970db875dd3a8a46d00036325d913ebe0b4a18c1fa7fbd1e35015540b9065cddd9e0708bf26

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
09f7635110276433908dec2294d3843b

SHA1
8cda89d68e3520110511c2a88e239efc8ae4ac26

SHA256
6bd468afc66deda4b8d1126e023ae6eca5bc1fa002ea5e091e6ad9c63b6c9af1

SHA512
71b9eacc29f4c77775697cac6bea3e16bed705e8a6d4d29828433b4bae485822eb84601918ecbf0b0c1cc20e732b09f64fb7ff7091904d72d616eecfac127f64

Download Submit
C:\Users\Admin\Desktop\covid29-is-here.txt

Filesize
861B

MD5
c53dee51c26d1d759667c25918d3ed10

SHA1
da194c2de15b232811ba9d43a46194d9729507f0

SHA256
dd5b3d185ae1809407e7822de4fced945115b48cc33b2950a8da9ebd77a68c52

SHA512
da41cef03f1b5f21a1fca2cfbf1b2b180c261a75d391be3a1ba36e8d4d4aefab8db024391bbee06b99de0cb0b8eb8c89f2a304c27e20c0af171b77db33b2d12c

Download Submit
C:\Users\Admin\Downloads\Coronavirus (666) Demonic Ransomware.zip

Filesize
156KB

MD5
f71075f49b70a2a37a955836d13cf49b

SHA1
4f2457b6df6dcd57c128132a7a49777a0e7d2cc1

SHA256
521621037efa7f0b3570237e7df550562133c30a13359fcc09a591420784276e

SHA512
48060e0ba7f9f2802eb0449dbaffdec94f17bbda21950716f841ea45c84ad1ed269fc7c48d6a7b3c60a2d9dec90af2650048aaa7cb816590855da3fafbf858ae

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 788214.crdownload

Filesize
982KB

MD5
d1bfa4726bd51bc486725dfbec91f007

SHA1
147d2fbe06b083e107dd2709292703cb26f09841

SHA256
29944768d8d93078ee98c57fd67476e8e24dc7c86d727f2161cd97c3110e000d

SHA512
9e505680bb79a00a681560362815a24c1fdd82ac39b12a5da49ebc2180a00f5cbe9de69158f27983dec4cbcaf0b45cd75e48e2e20634e4c5365b8e6038a7f8df

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 920295.crdownload

Filesize
1.7MB

MD5
272d3e458250acd2ea839eb24b427ce5

SHA1
fae7194da5c969f2d8220ed9250aa1de7bf56609

SHA256
bbb5c6b4f85c81a323d11d34629776e99ca40e983c5ce0d0a3d540addb1c2fe3

SHA512
d05bb280775515b6eedf717f88d63ed11edbaae01321ec593ecc0725b348e9a0caacf7ebcd2c25a6e0dc79b2cdae127df5aa380b48480332a6f5cd2b32d4e55c

Download Submit
memory/2016-1508-0x0000000000400000-0x00000000005D5000-memory.dmp

Filesize
1.8MB

Download
memory/4188-1538-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5196-1539-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download