hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware

Resubmissions

11/01/2025, 18:34

250111-w7rfqaykfr 10

11/01/2025, 18:31

250111-w55kkawkav 10

11/01/2025, 18:28

250111-w4bk4ayjhj 9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2025, 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware

Score

9^/10

defense_evasion discovery execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Downloads MZ/PE file

Executes dropped EXE 9 IoCs

pid	Process
3592	satan.exe
2704	satan.exe
4192	xuafx.exe
636	xuafx.exe
4416	Fantom.exe
1568	Fantom.exe
3204	Annabelle.exe
1108	Annabelle.exe
408	Annabelle.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{0D5E0A4A-23D3-741B-5056-89006DF8340B} = "C:\\Users\\Admin\\AppData\\Roaming\\Umkyi\\xuafx.exe"	Explorer.EXE

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
74	raw.githubusercontent.com
75	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs

pid	Process
3460	Explorer.EXE
3460	Explorer.EXE
3460	Explorer.EXE
3460	Explorer.EXE
636	xuafx.exe
636	xuafx.exe
636	xuafx.exe
636	xuafx.exe
636	xuafx.exe
3204	Annabelle.exe
3204	Annabelle.exe
3204	Annabelle.exe
3204	Annabelle.exe
1108	Annabelle.exe
1108	Annabelle.exe
1108	Annabelle.exe
1108	Annabelle.exe
408	Annabelle.exe
408	Annabelle.exe
408	Annabelle.exe
408	Annabelle.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3592 set thread context of 2704	3592	satan.exe	116
PID 4192 set thread context of 636	4192	xuafx.exe	120

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	satan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	satan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fantom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fantom.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4032	vssadmin.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 934800.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 766007.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 955196.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 214398.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
2228	msedge.exe
2228	msedge.exe
4456	identity_helper.exe
4456	identity_helper.exe
1100	msedge.exe
1100	msedge.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
3592	satan.exe
4192	xuafx.exe
4192	xuafx.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeBackupPrivilege	2900	vssvc.exe
Token: SeRestorePrivilege	2900	vssvc.exe
Token: SeAuditPrivilege	2900	vssvc.exe
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeDebugPrivilege	4416	Fantom.exe
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeDebugPrivilege	1568	Fantom.exe
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2228	msedge.exe

Suspicious use of UnmapMainImage 3 IoCs

pid	Process
4020	RuntimeBroker.exe
812	RuntimeBroker.exe
4176	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 4716	2228	msedge.exe	82
PID 2228 wrote to memory of 4716	2228	msedge.exe	82
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 1716	2228	msedge.exe	83
PID 2228 wrote to memory of 3140	2228	msedge.exe	84
PID 2228 wrote to memory of 3140	2228	msedge.exe	84
PID 2228 wrote to memory of 4564	2228	msedge.exe	85
PID 2228 wrote to memory of 4564	2228	msedge.exe	85
PID 2228 wrote to memory of 4564	2228	msedge.exe	85
PID 2228 wrote to memory of 4564	2228	msedge.exe	85
PID 2228 wrote to memory of 4564	2228	msedge.exe	85
PID 2228 wrote to memory of 4564	2228	msedge.exe	85
PID 2228 wrote to memory of 4564	2228	msedge.exe	85
PID 2228 wrote to memory of 4564	2228	msedge.exe	85
PID 2228 wrote to memory of 4564	2228	msedge.exe	85
PID 2228 wrote to memory of 4564	2228	msedge.exe	85
PID 2228 wrote to memory of 4564	2228	msedge.exe	85
PID 2228 wrote to memory of 4564	2228	msedge.exe	85
PID 2228 wrote to memory of 4564	2228	msedge.exe	85
PID 2228 wrote to memory of 4564	2228	msedge.exe	85
PID 2228 wrote to memory of 4564	2228	msedge.exe	85
PID 2228 wrote to memory of 4564	2228	msedge.exe	85
PID 2228 wrote to memory of 4564	2228	msedge.exe	85
PID 2228 wrote to memory of 4564	2228	msedge.exe	85
PID 2228 wrote to memory of 4564	2228	msedge.exe	85
PID 2228 wrote to memory of 4564	2228	msedge.exe	85

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2440

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2448

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2624

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d0cb46f8,0x7ff8d0cb4708,0x7ff8d0cb4718
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
    3⤵
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2068 /prefetch:8
    3⤵
    PID:2428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2204 /prefetch:1
    3⤵
    PID:1208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5656 /prefetch:8
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4168 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1100
- - C:\Users\Admin\Downloads\satan.exe
    "C:\Users\Admin\Downloads\satan.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3592
  - - C:\Users\Admin\Downloads\satan.exe
      "C:\Users\Admin\Downloads\satan.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2704
    - - C:\Users\Admin\AppData\Roaming\Umkyi\xuafx.exe
        
        "C:\Users\Admin\AppData\Roaming\Umkyi\xuafx.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:4192
      - C:\Users\Admin\AppData\Roaming\Umkyi\xuafx.exe
        
        "C:\Users\Admin\AppData\Roaming\Umkyi\xuafx.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:636
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_d58af9a2.bat"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
    3⤵
    PID:3648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6292 /prefetch:8
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6456 /prefetch:8
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6888 /prefetch:8
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6360 /prefetch:8
    3⤵
    PID:4808
- - C:\Users\Admin\Downloads\Fantom.exe
    "C:\Users\Admin\Downloads\Fantom.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6892 /prefetch:2
    3⤵
    PID:4900
- - C:\Users\Admin\Downloads\Fantom.exe
    "C:\Users\Admin\Downloads\Fantom.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
    3⤵
    PID:1624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5592 /prefetch:8
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,17522887087476118119,13138754894165309099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
    3⤵
    PID:2224
- - C:\Users\Admin\Downloads\Annabelle.exe
    "C:\Users\Admin\Downloads\Annabelle.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3204
- - C:\Users\Admin\Downloads\Annabelle.exe
    "C:\Users\Admin\Downloads\Annabelle.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1108
- - C:\Users\Admin\Downloads\Annabelle.exe
    "C:\Users\Admin\Downloads\Annabelle.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:408
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4032
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3624

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3856

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3956

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:4020

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3568

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:4176

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:2400

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5072

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca
1⤵
PID:4780

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
648da64ed4de63edc0f2da9bc60754c4

SHA1
495a446759d4e2e99fc60a61228d446a7c9519c2

SHA256
8c6393de0553c38a253c3e1fdb036dfaa8f622b027f64ede93fbfe00e6ddefdd

SHA512
5b573d24070e9027b3dd80d3fe7d8a0700193b1efad8ea172ec5512df8dcf4f6343a0230945384b1e6f1f3dc20d073de553d9ff547121cf8d891c16f0e6ae94c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
05cc4af9d390df2b779237e00c018682

SHA1
ddf92007febb0016930010da1280bbb67ace26cd

SHA256
4a83a373076b0549fc39bc75ca543ada3e9c7c655ff11e4e95ee13740b628dab

SHA512
c745b6747f92fed4e3b606365d58395a38082d9bb630c88666cfb97e130ba7634d1893a52e1e6ad5f948299f4f9533010ff21b517a460977674d4493a6c68f78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
45d3a1b1e29f842fe6f4e9b734ab2986

SHA1
ab2f749bac18e6ec9fddc7b7c5f62b432c35fb6e

SHA256
e7eb89fdc83d0aabc5a2de072c250573efe0be6c0a2a0fcf304714ecab60d81e

SHA512
de07937c40b1483fd5b967e3acc4cd525d153ea90ebab9ebdf8316962064c4c7e36a2ad0a039b1efa5d8c20deffc9aabd09af962dd6398b184c6171cb337f790

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9555308c7a037aeaecbf3ef4b48f013a

SHA1
6f4ab24f73f15bb236d7be28fa62f559862bf73d

SHA256
ac0519060e2f7371aefd67e014afcbeb3c6db02bb5774196ed3c5e51db0417c5

SHA512
0b73aa6ec6fa6dae30c4e9e4f815e257f0639ed89ee0d7325a00365ca0afa0f8d072cefe00ee4531dfc1c4ac5465a2125cbf69cb4687890d4c63eeb80601a7fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3ff7892a7fb70cea0d35b7c1348314a6

SHA1
e4a3f6ed8c327aad013384f04f0619256f7e3535

SHA256
c292ce3100f510327914468111202648da99ebe7711b272fb92c634029fde2a7

SHA512
a1489d3358d31672285e5db0268e516fd179dce12ad469bd9ecd0ee3c21c390efbd350d081b18063346388578e6dc09e529ed73ef79467d78acc5a0fe514039d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e6ccb544c835ac0e0a39e41d61c8d14b

SHA1
18feed2b02dce7f715260d52860fea6aa63f704a

SHA256
cd25a49543a787874ffa9b19fab450fa461ac5be506923f3212f1a35ed9130a2

SHA512
9ec958d6d9e76b3c74c7e6381ee290337532a737595906eebe81ef3eb0c39bf88a23ffeb1a65d38c5f83a765bf95a54d1db4f5d800484b0fea75735b7dece179

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0cb52f91f9199f562aab7a9f3e7965e4

SHA1
f6904e6f14775c0a7672c0d6a6d164d8de257943

SHA256
e12a03b2cff41e439aafb3ab4c7c9776e35618c5332668d20c2a9a5a69df4c50

SHA512
9215a4f2c84c2e5ea6246cd9ef4c10253476b1f230272b2a846a6b8e5c3acc6d5eaf1f8f526f3e87d79bda8e5f53536f3a88b1dc87f1df5bed81683f98f5a9be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e1ac86f0a524e233d8b496347344b761

SHA1
b36c2f7d5e4656d8d0624f2ba918f50c821469e7

SHA256
20802d91c7913cc850171b96f9f38c1c6c030a2c7b15bb8557482a7192c7305c

SHA512
df280955fbdb9bae608554e04da5e2f8d2020eb458de3afd27eb94d918150b286942a27f96413e79d9a156aaf1ca0e911054b220b9ac57df818361a367cb25e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
60d67c4d25b391803353454bcc4551ad

SHA1
06ad7a7badc91ce345b83d587f932c0c32e24029

SHA256
738de7fa47cafba445b8430f2a68bcd8e6f5deb425835f664da400f3b7c439aa

SHA512
387e2bbf8a28943d35e103abea60f409d865c7885206c5e24cf848e403b9aa33ffb0338bbc8cb4b27943e4e93703f1295160aec3a00ace4516031468b2c2b873

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5873d3.TMP

Filesize
874B

MD5
82756b32515d8003efb8611e121e5873

SHA1
9bc824cee8f39b8f0eab487fc87933a937c68f56

SHA256
5bf2ffe7c3c8eca7596685fa988783f6c1bb25134e0968315459045ecd8abdc0

SHA512
c61cf2d82084f1e95670ae3940aa215d169bc2829c7fb1a184c613d3ca19f3a854bcb75ee98a61e25c3d0a290f4cddeb27dfde5c5f37c616fc0448e07ebc8d50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3daf3fade661df0cd666acb1e106777f

SHA1
388bc264fb678d2b99738142290ee23649195858

SHA256
c2d23b83c58684a095f9206ff09e24815e67447c41b52373b40f8f15535813b4

SHA512
85074f40e7fd545a603c4ac932c2b657d9db00b1dfb752593e48fa4f63e02acc1c4450e7d229d170a2c6084e6a0497de418058d8a24a8bd82ee055343ce1b9f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4b3c41eedf5fbd94be4dbda7c81983ed

SHA1
f83b1fb11132ee6f4d1a4e46f673490be7f5f8d3

SHA256
6f9d833bfb3031105b6acd4f8c025f604ac3215dde3e79146ee05e11670cabf0

SHA512
9726065bc63304d3191fd30bc7ae6a6a26c26beca9d5b485c93bcf90f8b14359fa4d4b5b6c71baa021bbffa780e8506de8961ac62d71d28897473ee3809c72f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
40d3bdf65478fb626e3a091a43f4917f

SHA1
8392d215cb5101c7c96394505b253118e8e61d65

SHA256
100bf43da48851f934988d738f4867c61e9e5b1c343bcfa940a2539a7612199b

SHA512
1d527f10e9863cec1eb0b3514f12bf3c14b9f26092bbf87a896e23b15610d125204054eb19fda50c6f758622e3405a87d551b9d50704093312c7803de46a1566

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp_d58af9a2.bat

Filesize
172B

MD5
cc27a5d937cbefccec04b76d7f01dea5

SHA1
35f7a5d68f682b405ae811c14e6354c7e0620053

SHA256
20e34bcefee78e234567b7514e1a14bf6ea986ec6f1c3e86bb4580bf02c5cb90

SHA512
92234180da1ad34920acd68b8156d6ab16c1d68d4f9e11df0f665e59b8423d945a774ab9c01fd5f22377953105d6d9fb233cab6c99c307bd2f8ebf89e5394c17

Download Submit
C:\Users\Admin\AppData\Roaming\Umkyi\xuafx.exe

Filesize
67KB

MD5
9c209d629a5ae23c3de26600761997fe

SHA1
6d5194da77010bf4f80798615f78c0035ba48842

SHA256
9fe51007708faa01eed1569d832cf4d4b6735e9d84e506890f2072fc0f18f73c

SHA512
f9de1fe89e9c6eaa075c492259c1526a9394d5340cbfa4baebeef2921761003bcf5fd8599507dc640d507a948367fe6aa5ce57ccaa78ad7e2593e4215c5b2db1

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 214398.crdownload

Filesize
261KB

MD5
7d80230df68ccba871815d68f016c282

SHA1
e10874c6108a26ceedfc84f50881824462b5b6b6

SHA256
f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

SHA512
64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 766007.crdownload

Filesize
184KB

MD5
c9c341eaf04c89933ed28cbc2739d325

SHA1
c5b7d47aef3bd33a24293138fcba3a5ff286c2a8

SHA256
1a0a2fd546e3c05e15b2db3b531cb8e8755641f5f1c17910ce2fb7bbce2a05b7

SHA512
7cfa6ec0be0f5ae80404c6c709a6fd00ca10a18b6def5ca746611d0d32a9552f7961ab0ebf8a336b27f7058d700205be7fcc859a30d7d185aa9457267090f99b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 934800.crdownload

Filesize
15.9MB

MD5
0f743287c9911b4b1c726c7c7edcaf7d

SHA1
9760579e73095455fcbaddfe1e7e98a2bb28bfe0

SHA256
716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac

SHA512
2a6dd6288303700ef9cb06ae1efeb1e121c89c97708e5ecd15ed9b2a35d0ecff03d8da58b30daeadad89bd38dc4649521ada149fb457408e5a2bdf1512f88677

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 955196.crdownload

Filesize
211KB

MD5
a933a1a402775cfa94b6bee0963f4b46

SHA1
18aa7b02f933c753989ba3d16698a5ee3a4d9420

SHA256
146581f0b3fbe00026ee3ebe68797b0e57f39d1d8aecc99fdc3290e9cfadc4fc

SHA512
d83da3c97ffd78c42f49b7bfb50525e7c964004b4b7d9cba839c0d8bf3a5fe0424be3b3782e33c57debc6b13b5420a3fa096643c8b7376b3accfb1bc4e7d7368

Download Submit
memory/636-262-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/636-337-0x0000000004C10000-0x0000000004C27000-memory.dmp

Filesize
92KB

Download
memory/636-333-0x0000000004C10000-0x0000000004C27000-memory.dmp

Filesize
92KB

Download
memory/636-334-0x0000000004C10000-0x0000000004C27000-memory.dmp

Filesize
92KB

Download
memory/636-259-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/636-336-0x0000000004C10000-0x0000000004C27000-memory.dmp

Filesize
92KB

Download
memory/812-306-0x00000200E7B40000-0x00000200E7B57000-memory.dmp

Filesize
92KB

Download
memory/812-310-0x00000200E7B40000-0x00000200E7B57000-memory.dmp

Filesize
92KB

Download
memory/2400-309-0x000002820E590000-0x000002820E5A7000-memory.dmp

Filesize
92KB

Download
memory/2400-305-0x000002820E590000-0x000002820E5A7000-memory.dmp

Filesize
92KB

Download
memory/2440-267-0x0000020BAE340000-0x0000020BAE357000-memory.dmp

Filesize
92KB

Download
memory/2440-287-0x0000020BAE340000-0x0000020BAE357000-memory.dmp

Filesize
92KB

Download
memory/2448-298-0x000001E2022A0000-0x000001E2022B7000-memory.dmp

Filesize
92KB

Download
memory/2448-268-0x000001E2022A0000-0x000001E2022B7000-memory.dmp

Filesize
92KB

Download
memory/2624-299-0x0000024173550000-0x0000024173567000-memory.dmp

Filesize
92KB

Download
memory/2624-269-0x0000024173550000-0x0000024173567000-memory.dmp

Filesize
92KB

Download
memory/2704-251-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2704-257-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2704-249-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3204-1040-0x00000238365C0000-0x00000238375B4000-memory.dmp

Filesize
16.0MB

Download
memory/3244-314-0x000001A1F7710000-0x000001A1F7727000-memory.dmp

Filesize
92KB

Download
memory/3244-315-0x000001A1F7710000-0x000001A1F7727000-memory.dmp

Filesize
92KB

Download
memory/3460-294-0x00000000031F0000-0x0000000003207000-memory.dmp

Filesize
92KB

Download
memory/3460-292-0x00000000031F0000-0x0000000003207000-memory.dmp

Filesize
92KB

Download
memory/3460-291-0x00000000031F0000-0x0000000003207000-memory.dmp

Filesize
92KB

Download
memory/3460-270-0x00000000031F0000-0x0000000003207000-memory.dmp

Filesize
92KB

Download
memory/3460-295-0x00000000031F0000-0x0000000003207000-memory.dmp

Filesize
92KB

Download
memory/3460-293-0x00000000031F0000-0x0000000003207000-memory.dmp

Filesize
92KB

Download
memory/3568-303-0x000001AAB7820000-0x000001AAB7837000-memory.dmp

Filesize
92KB

Download
memory/3624-271-0x000001C63CFA0000-0x000001C63CFB7000-memory.dmp

Filesize
92KB

Download
memory/3624-302-0x000001C63CFA0000-0x000001C63CFB7000-memory.dmp

Filesize
92KB

Download
memory/3856-300-0x0000019939B40000-0x0000019939B57000-memory.dmp

Filesize
92KB

Download
memory/3856-272-0x0000019939B40000-0x0000019939B57000-memory.dmp

Filesize
92KB

Download
memory/3956-297-0x00000237C78D0000-0x00000237C78E7000-memory.dmp

Filesize
92KB

Download
memory/3956-273-0x00000237C78D0000-0x00000237C78E7000-memory.dmp

Filesize
92KB

Download
memory/4020-301-0x0000021F96A60000-0x0000021F96A77000-memory.dmp

Filesize
92KB

Download
memory/4020-296-0x0000021F96A60000-0x0000021F96A77000-memory.dmp

Filesize
92KB

Download
memory/4032-313-0x00000193FED30000-0x00000193FED47000-memory.dmp

Filesize
92KB

Download
memory/4032-316-0x00000193FED30000-0x00000193FED47000-memory.dmp

Filesize
92KB

Download
memory/4176-304-0x00000268ACC90000-0x00000268ACCA7000-memory.dmp

Filesize
92KB

Download
memory/4176-308-0x00000268ACC90000-0x00000268ACCA7000-memory.dmp

Filesize
92KB

Download
memory/4192-281-0x0000000001200000-0x000000000129D000-memory.dmp

Filesize
628KB

Download
memory/4192-284-0x0000000002BD0000-0x0000000002C01000-memory.dmp

Filesize
196KB

Download
memory/4192-275-0x0000000000D20000-0x0000000000D42000-memory.dmp

Filesize
136KB

Download
memory/4192-290-0x00000000030C0000-0x0000000003143000-memory.dmp

Filesize
524KB

Download
memory/4192-276-0x0000000000D50000-0x0000000000D7B000-memory.dmp

Filesize
172KB

Download
memory/4192-277-0x0000000000D80000-0x0000000000E1E000-memory.dmp

Filesize
632KB

Download
memory/4192-265-0x0000000000170000-0x0000000000200000-memory.dmp

Filesize
576KB

Download
memory/4192-279-0x0000000000EC0000-0x0000000000FEA000-memory.dmp

Filesize
1.2MB

Download
memory/4192-264-0x0000000000620000-0x00000000008E9000-memory.dmp

Filesize
2.8MB

Download
memory/4192-280-0x0000000000FF0000-0x00000000010FB000-memory.dmp

Filesize
1.0MB

Download
memory/4192-282-0x00000000012A0000-0x00000000013A0000-memory.dmp

Filesize
1024KB

Download
memory/4192-283-0x00000000015A0000-0x00000000015D0000-memory.dmp

Filesize
192KB

Download
memory/4192-263-0x0000000000560000-0x000000000061E000-memory.dmp

Filesize
760KB

Download
memory/4192-266-0x00000000009C0000-0x0000000000B61000-memory.dmp

Filesize
1.6MB

Download
memory/4192-274-0x0000000000B70000-0x0000000000C1C000-memory.dmp

Filesize
688KB

Download
memory/4192-278-0x0000000000E20000-0x0000000000EBB000-memory.dmp

Filesize
620KB

Download
memory/4192-285-0x0000000002C10000-0x0000000002C28000-memory.dmp

Filesize
96KB

Download
memory/4192-286-0x0000000002CF0000-0x0000000002D24000-memory.dmp

Filesize
208KB

Download
memory/4192-288-0x0000000002D40000-0x0000000002D67000-memory.dmp

Filesize
156KB

Download
memory/4192-289-0x00000000030B0000-0x00000000030BC000-memory.dmp

Filesize
48KB

Download
memory/4416-653-0x0000000002400000-0x0000000002432000-memory.dmp

Filesize
200KB

Download
memory/4416-654-0x0000000004980000-0x00000000049B2000-memory.dmp

Filesize
200KB

Download
memory/4416-779-0x0000000004AD0000-0x0000000005074000-memory.dmp

Filesize
5.6MB

Download
memory/4416-780-0x0000000005080000-0x0000000005112000-memory.dmp

Filesize
584KB

Download
memory/4416-781-0x0000000005230000-0x000000000523A000-memory.dmp

Filesize
40KB

Download
memory/4456-311-0x000001BEF4E00000-0x000001BEF4E17000-memory.dmp

Filesize
92KB

Download
memory/4456-307-0x000001BEF4E00000-0x000001BEF4E17000-memory.dmp

Filesize
92KB

Download
memory/4780-312-0x000002B0AC260000-0x000002B0AC277000-memory.dmp

Filesize
92KB

Download