dharma | 6514b345465786d232a61f8aca8e3b60e2bf8a3e45f237086e55caac0c19cb4d

max time kernel
821s
max time network
816s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
14-01-2025 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_1d93e8597dd860cf81cd913c4b997818.html
Size

25KB
MD5

1d93e8597dd860cf81cd913c4b997818
SHA1

a7dacf6a32b194720a87130a16f2222c44f036eb
SHA256

6514b345465786d232a61f8aca8e3b60e2bf8a3e45f237086e55caac0c19cb4d
SHA512

c35592acafe20b18914ba7ee31201faa7534136df292d7c14436fb3bcbdd5f07b96b3b63897509068b8263ec4e12f55e192de027996dac8e63e08712fb891e98
SSDEEP

384:PqlIcCtF4JVGTHyk9v1o99t5W9ISFaTGHx6QckT/gbpLOXguLZ:sZtSF5zg9ExLZ

Score

10^/10

dharma credential_access defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware stealer

Malware Config

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Dharma family
dharma
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (573) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Contacts a large (1138) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4556	netsh.exe
3428	netsh.exe

Sets service image path in registry 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mssqlaq\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\mssqlaq.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mssql\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\mssql.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\dgmscojkcazuuaivm\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\dgmscojkcazuuaivm.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\dheficfqdzomghgiu\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\dheficfqdzomghgiu.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\bboudqdceutqxn\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\bboudqdceutqxn.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xqjrzrbqrtweuv\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\xqjrzrbqrtweuv.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\jlrwusocqkgnpyy\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\jlrwusocqkgnpyy.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\gzetpttpdkjjngbd\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\gzetpttpdkjjngbd.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpouaqcjnrnrel\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\Ransomware\\ac\\mpouaqcjnrnrel.sys"	mssql.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Deletes itself 1 IoCs

pid	Process
4504	CoronaVirus.exe

Drops startup file 10 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4abbe3f8.exe	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4abbe3f8.exe.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4abbe3f8.exe.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4abbe3f8.exe	explorer.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	CoronaVirus.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\	Cerber5.exe

Executes dropped EXE 4 IoCs

pid	Process
1116	nc123.exe
3908	mssql.exe
896	mssql2.exe
3824	SearchHost.exe

Impair Defenses: Safe Mode Boot 1 TTPs 14 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\GZETPTTPDKJJNGBD.SYS	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\dgmscojkcazuuaivm.sys	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\jlrwusocqkgnpyy.sys	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\JLRWUSOCQKGNPYY.SYS	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\DGMSCOJKCAZUUAIVM.SYS	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\mpouaqcjnrnrel.sys	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\dheficfqdzomghgiu.sys	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\bboudqdceutqxn.sys	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\gzetpttpdkjjngbd.sys	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\MPOUAQCJNRNREL.SYS	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\DHEFICFQDZOMGHGIU.SYS	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\BBOUDQDCEUTQXN.SYS	mssql.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\MINIMAL\XQJRZRBQRTWEUV.SYS	mssql.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\xqjrzrbqrtweuv.sys	mssql.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4abbe3f = "C:\\4abbe3f8\\4abbe3f8.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4abbe3f8 = "C:\\Users\\Admin\\AppData\\Roaming\\4abbe3f8.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe"	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	CoronaVirus.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1581648047-808845429-2272123689-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	CoronaVirus.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1581648047-808845429-2272123689-1000\desktop.ini	CoronaVirus.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\s:	Cerber5.exe
File opened (read-only)	\??\j:	Cerber5.exe
File opened (read-only)	\??\o:	Cerber5.exe
File opened (read-only)	\??\r:	Cerber5.exe
File opened (read-only)	\??\n:	Cerber5.exe
File opened (read-only)	\??\D:	SearchHost.exe
File opened (read-only)	\??\a:	Cerber5.exe
File opened (read-only)	\??\g:	Cerber5.exe
File opened (read-only)	\??\h:	Cerber5.exe
File opened (read-only)	\??\p:	Cerber5.exe
File opened (read-only)	\??\q:	Cerber5.exe
File opened (read-only)	\??\t:	Cerber5.exe
File opened (read-only)	\??\u:	Cerber5.exe
File opened (read-only)	\??\v:	Cerber5.exe
File opened (read-only)	\??\k:	Cerber5.exe
File opened (read-only)	\??\l:	Cerber5.exe
File opened (read-only)	\??\m:	Cerber5.exe
File opened (read-only)	\??\x:	Cerber5.exe
File opened (read-only)	\??\y:	Cerber5.exe
File opened (read-only)	\??\w:	Cerber5.exe
File opened (read-only)	\??\z:	Cerber5.exe
File opened (read-only)	\??\b:	Cerber5.exe
File opened (read-only)	\??\e:	Cerber5.exe
File opened (read-only)	\??\i:	Cerber5.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3300	ip-addr.es
204	ip-addr.es
206	ip-addr.es

Drops file in System32 directory 40 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat!	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote	Cerber5.exe
File created	C:\Windows\System32\Info.hta	CoronaVirus.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\desktop	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\documents	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat!	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird	Cerber5.exe
File created	C:\Windows\System32\CoronaVirus.exe	CoronaVirus.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word	Cerber5.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel	Cerber5.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationBuildTasks.resources.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Encoding.dll.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\eu-es\ui-strings.js.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-de_de.gif.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ppd.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\Social.DATA	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\Microsoft.VisualBasic.Forms.resources.dll	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\protect_poster.jpg.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationProvider.resources.dll.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-locale-l1-1-0.dll.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\DIFF_MATCH_PATCH_WIN32.DLL	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libxa_plugin.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libgl_plugin.dll.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon.png	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\next-arrow-disabled.svg.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_chromecast_plugin.dll.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_mi.dll	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeNullOrEmpty.ps1	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-fr\ui-strings.js.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ja-jp\ui-strings.js.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-environment-l1-1-0.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcp120.dll	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ko-kr\ui-strings.js	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_chromecast_plugin.dll	CoronaVirus.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\catalog.json.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalResume.dotx.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Input.Manipulations.resources.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hr-hr\ui-strings.js.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\standards_poster.png.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\core_icons.png.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluDCFilesEmpty_180x180.svg	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2-2x.gif.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.StackTrace.dll.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\pt-PT.pak.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\PREVIEW.GIF.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\OFFICE.DLL.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART5.BDR	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\adc_logo.png.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN020.XML.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Input.Manipulations.resources.dll.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\find-text.png	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.id-B7BA3716.[[email protected]].ncov	CoronaVirus.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\desktop	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat!	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\desktop	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat!	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word	Cerber5.exe
File opened for modification	\??\c:\windows\	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\office	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\word	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\documents	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\the bat!	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\documents	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\excel	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\office	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\outlook	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\excel	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\steam	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\word	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel	Cerber5.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel	Cerber5.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dharma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nc123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssql2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cerber5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoWall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SearchHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
19364	PING.EXE
19296	cmd.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
32224	vssadmin.exe
20180	vssadmin.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
18988	taskkill.exe

Modifies registry class 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\.cps	Powder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\.cps\ = "PowderToySave"	Powder.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\PowderToySave	Powder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\PowderToySave\ = "Powder Toy Save"	Powder.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\ncov_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\ptsave\ = "Powder Toy Save"	Powder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\鰀䆟縀䆁\ = "ncov_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\ncov_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\ptsave\shell\open\command	Powder.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\PowderToySave\shell\open\command	Powder.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\PowderToySave\shell	Powder.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\鰀䆟縀䆁	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\ptsave\DefaultIcon	Powder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\ptsave\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\powder (1)\\Powder.exe\" ddir \"C:\\Users\\Admin\\AppData\\Roaming\\The Powder Toy\" \"%1\""	Powder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\.stm\ = "PowderToySave"	Powder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\PowderToySave\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\powder (1)\\Powder.exe,-102"	Powder.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\ncov_auto_file\shell\edit	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\ptsave\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\powder (1)\\Powder.exe,-102"	Powder.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\ptsave\shell\open	Powder.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\PowderToySave\DefaultIcon	Powder.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\ncov_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\ncov_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\ptsave\URL Protocol	Powder.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\ptsave\shell	Powder.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\.stm	Powder.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\.ncov	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\ncov_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\ptsave	Powder.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\PowderToySave\shell\open	Powder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\PowderToySave\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\powder (1)\\Powder.exe\" ddir \"C:\\Users\\Admin\\AppData\\Roaming\\The Powder Toy\" \"file://%1\""	Powder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\.ncov\ = "ncov_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\ncov_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1581648047-808845429-2272123689-1000_Classes\ncov_auto_file\shell\open\command	OpenWith.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
19364	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4792	msedge.exe
4792	msedge.exe
4688	msedge.exe
4688	msedge.exe
4300	msedge.exe
4300	msedge.exe
4680	identity_helper.exe
4680	identity_helper.exe
1952	msedge.exe
1952	msedge.exe
2832	msedge.exe
2832	msedge.exe
3372	identity_helper.exe
3372	identity_helper.exe
3304	msedge.exe
3304	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
3908	msedge.exe
3908	msedge.exe
1148	msedge.exe
1148	msedge.exe
4568	WMIC.exe
4568	WMIC.exe
4568	WMIC.exe
4568	WMIC.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe
4504	CoronaVirus.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
19716	OpenWith.exe

Suspicious behavior: LoadsDriver 32 IoCs

pid	Process
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe
3908	mssql.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
324	CryptoWall.exe
1468	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 49 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1208	Cerber5.exe
Token: SeCreatePagefilePrivilege	1208	Cerber5.exe
Token: SeDebugPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeDebugPrivilege	896	mssql2.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeLoadDriverPrivilege	3908	mssql.exe
Token: SeIncreaseQuotaPrivilege	4568	WMIC.exe
Token: SeSecurityPrivilege	4568	WMIC.exe
Token: SeTakeOwnershipPrivilege	4568	WMIC.exe
Token: SeLoadDriverPrivilege	4568	WMIC.exe
Token: SeSystemProfilePrivilege	4568	WMIC.exe
Token: SeSystemtimePrivilege	4568	WMIC.exe
Token: SeProfSingleProcessPrivilege	4568	WMIC.exe
Token: SeIncBasePriorityPrivilege	4568	WMIC.exe
Token: SeCreatePagefilePrivilege	4568	WMIC.exe
Token: SeBackupPrivilege	4568	WMIC.exe
Token: SeRestorePrivilege	4568	WMIC.exe
Token: SeShutdownPrivilege	4568	WMIC.exe
Token: SeDebugPrivilege	4568	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4568	WMIC.exe
Token: SeRemoteShutdownPrivilege	4568	WMIC.exe
Token: SeUndockPrivilege	4568	WMIC.exe
Token: SeManageVolumePrivilege	4568	WMIC.exe
Token: 33	4568	WMIC.exe
Token: 34	4568	WMIC.exe
Token: 35	4568	WMIC.exe
Token: 36	4568	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4568	WMIC.exe
Token: SeSecurityPrivilege	4568	WMIC.exe
Token: SeTakeOwnershipPrivilege	4568	WMIC.exe
Token: SeLoadDriverPrivilege	4568	WMIC.exe
Token: SeSystemProfilePrivilege	4568	WMIC.exe
Token: SeSystemtimePrivilege	4568	WMIC.exe
Token: SeProfSingleProcessPrivilege	4568	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
3908	mssql.exe
896	mssql2.exe
3824	SearchHost.exe
3908	mssql.exe
19636	OpenWith.exe
19716	OpenWith.exe
19716	OpenWith.exe
19716	OpenWith.exe
19716	OpenWith.exe
19716	OpenWith.exe
19716	OpenWith.exe
19716	OpenWith.exe
19716	OpenWith.exe
19716	OpenWith.exe
19716	OpenWith.exe
19716	OpenWith.exe
19716	OpenWith.exe
19716	OpenWith.exe
19716	OpenWith.exe
19716	OpenWith.exe
19716	OpenWith.exe
19716	OpenWith.exe
19716	OpenWith.exe
19716	OpenWith.exe
19716	OpenWith.exe
19716	OpenWith.exe
19716	OpenWith.exe
19716	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 2104	4792	msedge.exe	81
PID 4792 wrote to memory of 2104	4792	msedge.exe	81
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 952	4792	msedge.exe	83
PID 4792 wrote to memory of 4220	4792	msedge.exe	84
PID 4792 wrote to memory of 4220	4792	msedge.exe	84
PID 4792 wrote to memory of 4948	4792	msedge.exe	85
PID 4792 wrote to memory of 4948	4792	msedge.exe	85
PID 4792 wrote to memory of 4948	4792	msedge.exe	85
PID 4792 wrote to memory of 4948	4792	msedge.exe	85
PID 4792 wrote to memory of 4948	4792	msedge.exe	85
PID 4792 wrote to memory of 4948	4792	msedge.exe	85
PID 4792 wrote to memory of 4948	4792	msedge.exe	85
PID 4792 wrote to memory of 4948	4792	msedge.exe	85
PID 4792 wrote to memory of 4948	4792	msedge.exe	85
PID 4792 wrote to memory of 4948	4792	msedge.exe	85
PID 4792 wrote to memory of 4948	4792	msedge.exe	85
PID 4792 wrote to memory of 4948	4792	msedge.exe	85
PID 4792 wrote to memory of 4948	4792	msedge.exe	85
PID 4792 wrote to memory of 4948	4792	msedge.exe	85
PID 4792 wrote to memory of 4948	4792	msedge.exe	85
PID 4792 wrote to memory of 4948	4792	msedge.exe	85
PID 4792 wrote to memory of 4948	4792	msedge.exe	85
PID 4792 wrote to memory of 4948	4792	msedge.exe	85
PID 4792 wrote to memory of 4948	4792	msedge.exe	85
PID 4792 wrote to memory of 4948	4792	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d93e8597dd860cf81cd913c4b997818.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fffd49146f8,0x7fffd4914708,0x7fffd4914718
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,2214457234391647051,2536866500304940216,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,2214457234391647051,2536866500304940216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,2214457234391647051,2536866500304940216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2214457234391647051,2536866500304940216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2214457234391647051,2536866500304940216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2214457234391647051,2536866500304940216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:1292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\TestDebug.mht
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x124,0x150,0x7fffd49146f8,0x7fffd4914708,0x7fffd4914718
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2316,12387464773998242750,17435548373104440685,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2316,12387464773998242750,17435548373104440685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2316,12387464773998242750,17435548373104440685,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2316,12387464773998242750,17435548373104440685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2316,12387464773998242750,17435548373104440685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2316,12387464773998242750,17435548373104440685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2316,12387464773998242750,17435548373104440685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2316,12387464773998242750,17435548373104440685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2316,12387464773998242750,17435548373104440685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2316,12387464773998242750,17435548373104440685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2316,12387464773998242750,17435548373104440685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:3892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\TestDebug.mhtml
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fffd49146f8,0x7fffd4914708,0x7fffd4914718
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2560 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2140 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1320 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6060 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2588 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2588 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1916 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7472 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8156 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8180 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11495441364825741181,11539125740508153817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7788 /prefetch:1
  2⤵
  PID:1476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4072

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:644

C:\Users\Admin\Downloads\powder (1)\Powder.exe
"C:\Users\Admin\Downloads\powder (1)\Powder.exe"
1⤵
- Modifies registry class
PID:3704

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Cerber5.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Cerber5.exe"
1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1208
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4556
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall reset
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3428
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "C" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:19296
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im "C"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:18988
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:19364

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CoronaVirus.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CoronaVirus.exe"
1⤵
- Deletes itself
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4504
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:3060
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:32128
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:32224
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:19444
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:18896
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:20180
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  PID:19556
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  PID:19584

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CryptoWall.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CryptoWall.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
PID:324
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\syswow64\explorer.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  PID:1468
- - C:\Windows\SysWOW64\svchost.exe
    -k netsvcs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:404

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Dharma.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\Dharma.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4668
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\nc123.exe
  "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\nc123.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4296
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\mssql.exe
  "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\mssql.exe"
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Impair Defenses: Safe Mode Boot
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3908
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\mssql2.exe
  "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\mssql2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\Shadow.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\systembackup.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1260
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value | Find "="
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4072
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4568
  - - C:\Windows\SysWOW64\find.exe
      Find "="
      4⤵
      System Location Discovery: System Language Discovery
      PID:4136
- - C:\Windows\SysWOW64\net.exe
    net user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:35252
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
      4⤵
      System Location Discovery: System Language Discovery
      PID:16572
- C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\EVER\SearchHost.exe
  "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\EVER\SearchHost.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3824

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:32256

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:19636

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:19716
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\000.exe.id-B7BA3716.[[email protected]].ncov
  2⤵
  PID:6184

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Bezilom.exe.id-B7BA3716.[[email protected]].ncov
1⤵
PID:6700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Safe Mode Boot

T1562.009

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Windows Credential Manager

T1555.004

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-B7BA3716.[[email protected]].ncov

Filesize
2.7MB

MD5
e5e69790956762ca13639ac6bd4ce90a

SHA1
5a302b36200ba93f0b67f04e1d599845d5ea1f6f

SHA256
d48e09c04e840c1a4799caad8b40c0f1f38c6abc64385d4a3744881f4aaa775a

SHA512
ccd1e62172de8e4d54fdec597162b7435a49fb72976007c9ac47c081f50ed45f011cb9fe57caf945f171ac4da74b185375351a739e997883ae6d3bd6ed07fbdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d2444bd36844308c00907bcdda3066e

SHA1
d602d08f1b06a3f3888cc16234d09d97686efc81

SHA256
ec10841bc777167cc1055ddf2b51aab172a4bf6c8b786bf1b1ccecf721194a3e

SHA512
7ea25ff95cb9da32de0f76bbbeb1f154e077cecbc2eeb2dfdf6f2464acc61877ba0bef6e279e66dc985f92da0c94d7f8c887cc244e79927e5a2108d5248187b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d4bc32eb841f2b788106b7b5a44c13f4

SHA1
27868013e809484e5ac5cb21ee306b919ee0916e

SHA256
051cdf1896c2091e9ff822c2118fda400e2de25ee323e856bf9eb0c64c7a7257

SHA512
7a4963ea09832503179642ee750b1c8024373c66b4fce2bd316b782d1fc670c1c77cdb31f9316b34c78b6f3f1c99d90fb50e0500b72f4a647adf7653c44d242b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d40c7290836fddb7323ac9263a19d7e7

SHA1
efad822fed414b1e524218a94ca17a785363406a

SHA256
8111a49a6ceeb8e0bf83f835e8ce8b0e6ccfbaa4528ac8635640b5d2aca3f93b

SHA512
27d627e6163ad4ad57b45a8ba0bf34e500599eb06777937c2ac868ccd109affd8cff0a179af322be3126a95e4ef69eeaf34e2dc5fe7d626572be8ddb13e3c95a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c8eb7d84aaea5c0c37cdce43d1ad96dd

SHA1
0a27d004b734e4c486372c6888111b813e806811

SHA256
27ec491fe2b7f0eb567a44deb50c74408376ff3addf6c88a2b1060adc4a5976e

SHA512
f39070a20583f7ff33b7b3c0e97c08da2a3ff36049e256bbe0d0031bf15579c6d9c3da8d1f9daac1073519b648a1d005a8fa195ee2232b2962516e9aa14dac3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e41fc3d4b45f1c9ce7d44a8f971082c

SHA1
0b71eade32889dfc1ddf149e8d68483106b3a648

SHA256
f0c837c442077c61d6538474291d4f65188030d591a4b10c9699e78a21118393

SHA512
c38363f3d1fb926b44872bf929a05163cf9c0a766d456036fc41b75224616798a8bc649630cf91ed5c60da82429914b2cdeb9e950f8dc91942c411e5014f99fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
47KB

MD5
9f96d459817e54de2e5c9733a9bbb010

SHA1
afbadc759b65670865c10b31b34ca3c3e000cd31

SHA256
51b37ee622ba3e2210a8175ecd99d26d3a3a9e991368d0efbb705f21ff9ac609

SHA512
aa2514018ef2e39ebde92125f5cc6fb7f778f2ab3c35d4ec3a075578fda41a76dbd7239fe2ea61533fb3262c04739c6500d1497c006f511aa3142bb2696d2307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
26KB

MD5
5dea626a3a08cc0f2676427e427eb467

SHA1
ad21ac31d0bbdee76eb909484277421630ea2dbd

SHA256
b19581c0e86b74b904a2b3a418040957a12e9b5ae6a8de07787d8bb0e4324ed6

SHA512
118016178abe2c714636232edc1e289a37442cc12914b5e067396803aa321ceaec3bcfd4684def47a95274bb0efd72ca6b2d7bc27bb93467984b84bc57931fcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\index

Filesize
256KB

MD5
919f55bc01d1ff57ead04202f5f9bd99

SHA1
4bb69239b59d1316b46852098d0b215437090c9c

SHA256
743741388e0acd5c2357e1c52c9a802d6c833f5ddf82e1abf202c17254c99992

SHA512
465e06bbbfc4799f340d3b6fa734664f4d62afbff6ba5b47435b1957c6c98b24e775e0a5712aaecd6025389e29af2e0db9a56c80c4cba205ff3037a02a1d553b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\03eef0e77feb64d4_0

Filesize
6KB

MD5
ef0c30b068f4b23dc5b377d65b93c841

SHA1
8b0bab116f01a7b804c950ecf2ff428c66e99bab

SHA256
72375565f1430bc9ca52f1df25925db2ab810975700264da9487c4ef525238b2

SHA512
cca72d07a0d35225ab38bf97faa1f68a581c4a4cddc1878db21184341ac8bbc0cf72a5b2d89ee0e747c8f89db792122e2f8333354a7c0879bd36228eeb17fce9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\063aab44c09d4e27_0

Filesize
289KB

MD5
f07c104cd559edc13a76a276d8d5812a

SHA1
a754f4f8509495a2f4762818db116b4816d1d5b0

SHA256
582b362f8ea7281643ce0415aa214809aff83e7688d2cc1ecdd28a1eac1791f9

SHA512
3b7d9883579b0432e503de5d4a95ea8b30aea1467a652ebf8038348a39a3bb60173374e88bcc74f4c960a0c109a5bd304149fd1534c46d1780823c60ac7a0d25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\06cdbb7047afc473_0

Filesize
262B

MD5
15c2c064b7306d35097e355cf90bcf1c

SHA1
5dfc099ae82ae9f81bae8c23f3edaee656710c29

SHA256
2d4587d45aec2d78972697f15c3d22a06e618ef24730bf59df9431d0eff245fe

SHA512
16b31cc96f4983e040e8e4ff419a8cb2dfae34f320e1422d49c26d99583e533f6e54d5d0c8858dac9a198cfb29b1a80f12dc9deeacc804cb3d46cf8140fc623a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0bbe00d9bf7b798e_0

Filesize
2KB

MD5
f1fb5042638433bf62138cfefb828a22

SHA1
3b97eed823d012c6bbdf5d7bd54978d773498423

SHA256
ddfc13192b4b5eaee689d8846c6cab11b658992bad698276f723b353c6c28b7d

SHA512
d79d991bbbe554fa44d5e4bf967fe562cfef64e7518c476d67a25097cbdbdeacb08fce97af96ac6c69b77514b50a2f2dbac49395768ad39c3d304824661d43b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\15d2ba66b474cf52_0

Filesize
22KB

MD5
de63b84056bf255f722ded9a430b450c

SHA1
960a649030b019008e82ad01f1bb50f07ee9e474

SHA256
5938882620f368c0d532ce8273229ea4cb9d9767c7a87136185991df09d2879d

SHA512
64a982dd0114d4650ea1a9e30c1929bc06dcbcd5540d566f877ece8fe00e9653f3a40f7f7a9e60bd3c6dc391ecd4a29745c80916f9dd29733a4bf21a71e6dfa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1a914eb5fc51fb84_0

Filesize
5KB

MD5
919b4dc57c12618a4313f1303e231689

SHA1
7e8bde58cae3a84f3f5174f4491c7c54cde91196

SHA256
2270937279982d9e3bbbbea6f2558001f682ca3b6c73a464c73fe5666cd7f44c

SHA512
367336c3f98a1868be9335fe43dd41fac479ff530d58f70c5c15648c57244927f76df59e1217430f0ca0e28a5e5370c706ea3d3b0e71776fb16f2c1b5fca6f0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\242d87fe25e8b258_0

Filesize
2KB

MD5
608a9af6946b09bf1a00b256d45370d8

SHA1
aa2af3e4cd83d26fa4bce810e8514ff446ca4a90

SHA256
f8eb77115ce0be15d7f9a0874a8e9397042bd20463f06bf10cc8f7547973db77

SHA512
1d6cd47440059c9e2336de32d5a1dbf43dbeca17677173bf878a732a46b282b92e2ab695067f307aa2901e87f00e5345e753b849331d0f4af3b6dca473934679

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0

Filesize
1KB

MD5
556213d56cb083c18af92588d28402c5

SHA1
8b8cd2cedc260812930f8fe1ec5bb1a887615053

SHA256
2de224f693e4c1870d68ed64b6e3ae76c6710c318f3f62374306ad9a5471d347

SHA512
7a58e096e6693f4859ecbe85996c198378481e3e187719a17022b197d3b389b72558198b9cd059a5a159da96a4157e8f8cdcc07cc64e075e8cf7cec2b31641af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2692617678c042d9_0

Filesize
3KB

MD5
9549593ec53c567ea5d927999f541849

SHA1
92e966f24a841f9ea9777dcd32927a768ec54be4

SHA256
38e53a15eed7e17370b066e2d72a75f7f593770b353542666b3643787311706d

SHA512
c975623a52f15b2d0876f380cfef4eb04052e3fd605f2419087253ef416bf6e1b9c12f790709f6afb9fd7252d304b873db3bc4a75eed20632ee897e260ed3114

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2f4680e8f8f8a14f_0

Filesize
9KB

MD5
cbe76509492fe26b4d0986b1997b1739

SHA1
f49456269f9b4581610973748130ce6f61e65316

SHA256
c0e8296dbcdf6875bb106d571b5cfea742428e49b5844bc0d0677e5500d20fb7

SHA512
b5d56d55e350155d77836950550026aa788f37227ee17a488de6f75dd0e030c21cb571c48c196ce214a80ab78cf8b83fd068b62c52d8ffe433c1a039cdf2a58b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\37afe38eb817b647_0

Filesize
27KB

MD5
5d1e82f8149d144799d32c70b252155a

SHA1
17f813337df2c1156760b349cc1faa55f78b6045

SHA256
7290b69484225e6e66bfb384daab68cd60300ceb392d44a8e480101531b71850

SHA512
fd8d010a13b2ac8a557c564aff0c43f1480028ecfeddfd1512e580c3ac0451e05015bb7c420d1d0d0a1ae551d5803b2022446c4312c4cfe8e47ffabc3584bf8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3a4259a0181983ba_0

Filesize
6KB

MD5
cec0524dc0fc0295e0a9677e53d4ea19

SHA1
51a72b25a1cc45f7450a62344985f3173776dc72

SHA256
88fbc472f1868c6db5bdd8fe514352fc82b7195d3e606a7c5b464a7272646031

SHA512
d9cf7340be81f8856adf528cd9d2e0e7e671c41761598decbef15d0d2597127f72db68b19fd6e3b3e6d3e2ea955dc04fdfa8ddc9f4915bc5195546d39854a899

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

Filesize
1KB

MD5
d9b9671d58f7b8e03ffa6de29d5b76f8

SHA1
fb2dcf79b9bc04f46781a8f31ecf1ec38ae1b187

SHA256
c56185dab69c30743f42e3859cd515ce1287dbac1366bca5dad0ea1b5f472aaf

SHA512
a922f1e59ad4aba2b749f6c094d50d3d3a1a2710c566bf2c277c3da0ddbe33c79c9c88db54f5d49d4b1eeb299821ccd83ee0b09460245e322d15a7f8462f3638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\49f654861166b28d_0

Filesize
3KB

MD5
038c7e3b66d61734bbf2f97ac69cd2df

SHA1
b3a3c3be8a9dbd98ffdacf7dbc6cc24dd5c39e31

SHA256
ae4d6e1d54aca6e723e8893c4dfb3fd2265820468d4b2dd9ec5c83794580138c

SHA512
012feecdb05d6563083d59a287a997057bb233718e7857f29174071e923d8fc3118334453b82a3a37943fe6ba4c8f6811aefdde73bf83fecf45af0fc03e25e17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4e9b18b0f66a7183_0

Filesize
1KB

MD5
fd5c38071bc99a9ea0039cdc1ce0efe5

SHA1
ce6ff01a9da25546e22876f734d36feb90c562ec

SHA256
2c957677785a621bee3c14394ef0d0a8d1fea0f617075c6f8b0e93d71389f581

SHA512
69e9ce186111e7ab456db1f05ee6a0d710b344136e31724897e09b8c6677efeeb1dc44541646304f0a1d57a1b13cefc258000821cd4134147102a98f1eaeb277

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4ff4b179c1c05fed_0

Filesize
1KB

MD5
0b437418aedc49a6ada2c4dd71c9bb7e

SHA1
4e31d6b51ed908eea2aaf85c3514b4b26f70f995

SHA256
04ddb991b9a7b68c50702a7e0aafe9692e269ad8049844d5d922f225d082aa96

SHA512
69ac5a037cc87afb04de61e46005c14c3f5d259b45a75708095dd298917a649d41547f6eecec7b6c6bcf347388cf8f4cb382a817dba6af17535b3d69e79997be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ac5abc87e80789_0

Filesize
2KB

MD5
dca781e217b8811d1f55bbdbac478418

SHA1
fad0d360cbd238ccd923a0bcb19c4f9ad1edee0a

SHA256
3cbcad6edaca53277f12a5ec908fd7d1e65152d850af0340f886529122137739

SHA512
9d1072cbb7b64eb9253597cebe5ebc0fbf1177143601618d2dda2099a143da92ef1a9d5b5152e08fd8ae27e5eb28a2c013b64676a761322749523a38c8d7aafc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5dd1e579c9681f95_0

Filesize
2KB

MD5
151fc638c7baacad6d999eb279494861

SHA1
d5d3ace4ac109c50365293c11cd48ae442d4d31e

SHA256
b6fafdf02f8524593e03d40d038b4bb4694ea983190c0a59fa0115f0453e7840

SHA512
bc23e8fe549b0bc790e113ab28e34198fc24bdbe34de6a6c7ff1ba6dfe601e09ceaa25f66086751526ec1f5f8787e99d9b8a359602aec26d005fa2ce6070e811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\61a0b4d20ae0e222_0

Filesize
4KB

MD5
25bab0c324abbf04b6cedebd264a434f

SHA1
d8bd080f02810d26126247712b59bb869942fc88

SHA256
9e0a1af7b1db1a59e40f64f0499383ee22de862df9fc22817960c1d0f3c3a69b

SHA512
72a02adebf2b97fa9406a9dafeb636487e5c38e5f3b953da9dea63234d97fd9d0bb29dedaaeb9c5a4f44d7b2d12d31c690b6799a4c067d441057b06a570eae6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\624c9bd517fc9c91_0

Filesize
1KB

MD5
16a94208bfe4adf2c3d2973a10835d4a

SHA1
047ac43f494c2a755529b9ea4fc0ffb490dede91

SHA256
5e3aeac09ea35df4e0fe325e0c295023ccd47a8e1a5ba0bf3cfd3863630c2842

SHA512
0b017c7b11c9ce340bf7f2a40b2c2375b3ba8889f18dc37243de9d78521c6792961c846ea8d7a93a462feaad5585a31371ce90fddd78caa4e2144a123b49c61e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\635e64b37935c888_0

Filesize
1KB

MD5
6fe2d17771355bc583f1357b419f5a99

SHA1
0e005e620edbf92a7ee504aad96a2ceeb6437df2

SHA256
3a6c61a64640037a69d38e98c201b91ff34aef4d0ae5a1b37ad1bfc465f0077d

SHA512
a55ef59dbce330f9fdbc0dad6a7ecf71dfd87eebe5dae05e82591ccfab78900650cd5f881a022756a07d7a85b81e9a5556ba1f084348de57e4f8fd5a5653f754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6aa9a2943612cce1_0

Filesize
2KB

MD5
5bcf7fe61fc3737e3c044970a643fc87

SHA1
f710ee23a89fd9f9384aa536ddd6cef32512be67

SHA256
d8feee3f92cab595431df01958a490dc386a41e47d4b74e9e309507e06f2e994

SHA512
340500af0caaa1ec9eb29d7270d52f2a8593b60e00f10e852600ff5940124acbac4e5e6d720dfd469e13a24bdf1e98436f3c4debcdcbd790c6289cd007bc6c92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6b1c3d6d62495ca9_0

Filesize
2KB

MD5
d5de8d00765b394340dea6bb36c59d1b

SHA1
a51bef6fddeb322819f6dfbe1e3b0ee36d6dfb83

SHA256
30920ad56605aed0bbc9c475753c6bdb8116e6c490f972ba7caa667fa334d12b

SHA512
314caa0633c716983da09e0406100237b448144e15bb830ffab5f73d9f4acfaaad6ef8911b7d0f3288732cbaeb2ca88049668c8014685fcd61edf99096ca6b81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6c9edac4556610cd_0

Filesize
75KB

MD5
f441975a3b91bc519d056b8acc7dfbca

SHA1
d31b4e82041b5d4736c9797925cfaa0ba601b647

SHA256
247f0f2e0a8e31152074089599fc732ae9b4719563fc5fa206764ab654ac1aa5

SHA512
20e8670b17e4580fc0b17ddee4bc004a1569d3de08725dcfa867af36524e8e6f388da457eee3f6b9715d4c36ab89cc7195f9af385568de0df47f53e30c8c2a64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6db290dce274a012_0

Filesize
4KB

MD5
e15ff6d6c764387239b43d06051e9194

SHA1
fac8485e2d05dda5d18064a84b0ffeadd0f89620

SHA256
03b376edb1afc0bd99b11921a1ad0b8f2c173c49be7cf4f7925f115978a306c2

SHA512
b5f6232a478760e1a6f91af71b95416e5bd63a76c9721166ce4ae2ece828dbe7c950f337567f69e72977534509b7177baff4b23767170955e5f6fe2e4ad6fc78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\71d68e68ea4089fe_0

Filesize
5KB

MD5
72e4f1259d0c2c8e46076512860b0591

SHA1
9f8a72eae8d94fb9b2652b16b0102f3c35d425f1

SHA256
f8e176c2c591c7a59da0dfa20a48ec585d7e2ae429280b1a10060dd544df6b30

SHA512
08439a16c857c39e1de0628af985bb1c7fdb8a320afed37f58947eb2b185ffafe8ca993d11e09f5291fa571b80c24a5ffd3c0128c885af50a9cbf797f309ad40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\766094f4b47e839c_0

Filesize
9KB

MD5
48d30313f3924fe9a9882d4e1e697e25

SHA1
8bbfda4a92e5a8641a590e9dbd9bba24be25bea6

SHA256
8aab0b22960e2a3670b418c7a8786cc8fafa0b6fb881c23356743583ae67481a

SHA512
2440f975c2683221306b8ded8cdb3f38b5bf4ca50af24861d84ec2f6bc36b6ac903e30c3fe7dbd20f61d9bd36e02f7bf149ab70fc944c9967d7faa5cf66ac673

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\78bc646c0524ce58_0

Filesize
2KB

MD5
59fb9c204e4423154516c9c9a6c6ca4b

SHA1
443774615e64802e2d63917a73dd45636dc59768

SHA256
51335128134d5e6c400715c62796fbe18a34f1e63670ad88f2b19f52799ae112

SHA512
06547161e726b5114de594a88c3e1c1c8b1b49392234ee783e1bd76544e153d1ca27146a2d3dbdebe6d3e4c279a3010056c5422ac2bfa04ae59986e757d84096

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7cf9843337c39c04_0

Filesize
1KB

MD5
f007c944ea0de548fd12ad8d3eae20aa

SHA1
b41413c927fcbe9853e8fcc42b0bc07bca6075b5

SHA256
addf836b24f30110ede21c7eafded3018075596537eb56bc7ff847a379e381dd

SHA512
184b41c4c512a029b12b8b964e5354eda5429a02801ddbbaebe12b6475ba8f6c79037782abed966489dad8f65a5c7d11c73b6d22b7fdbc0c1e5b887f0ffcc1a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\82af833e9b5cc26e_0

Filesize
2KB

MD5
a648ab823820ecb88ab3cc33f7d740b7

SHA1
59ab4ec76dd39abda53b65aa2dd71d894e59a771

SHA256
688d390cb87c24c040442ba503a0272849c2855418cc7c473e5b46063d10f38f

SHA512
6ed092bda2cfaa4b5e6f8f7839b947c27baca9f68845c75c78a0ffdccf892ab4ad1ec75af5ccbcc61b6ae89b664f18cacb5b8be86698bbc1641b83ab1feb3774

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\86b9cbd77d05d034_0

Filesize
6KB

MD5
c8ace5faacdbbd58a99d3c64281802ed

SHA1
8e035e2ab15688fec9f04a09e6a927beaa623c65

SHA256
fe6080d1a34b3c192f59f719e54773391499cf331c70e0f8ebedd0388de0bc40

SHA512
ed68a86f42e205f62e59e7853b81911a70f94bbe0ad44390d0339be9a58a6e22782edfdcd759c8de33264ec7b0c5df0911a91db0ef4791b24516df4bada5dddc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8e5987d08f7b6e11_0

Filesize
1KB

MD5
415bee393a90310cbf86595628f48928

SHA1
350caa29af42e540867bf2f244023c649a559360

SHA256
e2a8a3b482ac7a86e49c048e5c06a2744a0ece70f9893022bbc8c70a70fc3632

SHA512
4a83f9936b5db446ff9082eac28033b3de4b78bd96d418428d3fa82a2c3c1273d03e500ef305dd315a9ef7d45584a9cec08e55a079a3ea68919a9a7b886eae77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\90d7d7591a1b39bb_0

Filesize
262B

MD5
276f52189cb0a54912b529e202281fd6

SHA1
c2995a8fb4ff636a34d28c08c2dd08116a71a007

SHA256
d2db84aa60d1024560d0d9e6074b1536bfff566c5694119bba064c84013ffafc

SHA512
8d064a062a7a3d93a554a4847a8de20f82c9c89bf8772db826fe0109535ade72c950d7fa118d6eda262682f6c299d3bdbb4fa717f92757766eaace89b13c6fe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9455c12bba24e157_0

Filesize
294B

MD5
bd26da15ad42d491ae4a2f78a91a094c

SHA1
679cac19cdff143cdd78f08b9a3b0fe1e73eedaf

SHA256
9c6a2c0b7b0fb42d3748d419be61ff7ea13b8078e60c9f52b0f27765126a12e3

SHA512
858ddf2154c1ce09ad037ff1ca648e10c13dc38d3027d969358fae3690b79fc28b4a81546d962984ea804b121f742bb8abe07faa9c3c419d4d42ab6a356edd56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\96bc766215a93e35_0

Filesize
1KB

MD5
8581d61feff00e5cdf375102e6320c0f

SHA1
76458224c188c2857722ae1937ab466112f39723

SHA256
24511b5e5f233671f5bd62e8fd454d8c4d54021ec1b9b49b89b085a6c1aeb50c

SHA512
32c227c66dc7a32260e9652680cb9f473bf7ad5d93115d06d10ec8e42762a35549d5ee825b8471daf86ef6bbf78ed2b7e0a0fa911894d7d24e986f54fd23ac49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9dbb949d27873cbc_0

Filesize
2KB

MD5
62791a59742985c4b704f12a0dc73f96

SHA1
2d1d28fbc479bfd825de7379c3d7b29bb7e9c52c

SHA256
58d99c234b0ab126629f3c8349cacdc6cf17bd72331713b454c78c7091395349

SHA512
600d1f9bdb19c68c10c08db678d4f6ce0fdb475529e16ad508cd6d46bc0350316e530584a430bc44d5c133b45921bb7135dc4dbb4d5bb0a13fafa10be1adefd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9f608f61e011c420_0

Filesize
3KB

MD5
4fd003c3d2951a96ca9f717437f06cd1

SHA1
9be7c320de053855d0a5762a364a0bdef00f49c3

SHA256
e9726996d4eec4eec9062606f05cba24b2e124f481d79afb855501c4c38b7e80

SHA512
2b0d5ff45b33e04f219b0d5dab7bc945fd07abe50ce9c9866133056f118d80b907cf326aecaa88d39985e235f1dc0476a5afc06a5e24d5b332c245d8b7592789

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a28b766f2e67bd61_0

Filesize
11KB

MD5
cb8de9dbc4130531adb2c164bfc56084

SHA1
de8f7db9dcdb66cf85696900167a31dff3d8af62

SHA256
90d30a6c1defa7146b8b3fcb6167af3a5f667d09bba5cb4de77603ea218baac3

SHA512
fab0df516181142ba537412c95ee2421b4e16bbe9b68f1612112900e383fe10c4a2a5581e94922ad515b32ac17783099951a87ee969d5dee5abd4a65a469246e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a85538a6bdbff076_0

Filesize
175KB

MD5
48a706595bbbc82959609089ea24ebb4

SHA1
cd5683b983ccf6db7254aebbf374296b55f4ac9c

SHA256
76d42ac435decb1cbb6bebd388c181444b17eb503080f0c07a13a9a569a8cf2b

SHA512
e8aa1b01b5757f98199a4c9be5778c9ac99eed2c735feee4510b9fb8971b5da5c389fd5a85026438816bb5094caea7ce88d7c98764d08ac1ad4ed9ffbf478d5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ab38c7b2c8042af4_0

Filesize
14KB

MD5
02b1453574b227a45e01909bfae395d8

SHA1
732c16a629f5bbd38ce5cc9f5230d7a59d468d0e

SHA256
ded8feab5f5b28adec8416b26db4bf373fd75aaada99f9d38b8feb2e37a20ce3

SHA512
d7fb0eeb02841b8f23fa2b64f01962c437bc0bb4e7b9f56c6e0e54dfcec64a94c77839b693d7b8f81f9ea6d9a6956cb4d4bc5bbe52c56dc01cb2b655b1dd5684

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be6d12311ce2b399_0

Filesize
1KB

MD5
abea8893b08684a15642e01a351c44e4

SHA1
e6645ef9fe846bf5ca0343e6af182ea6ac0a8034

SHA256
f1ca45db950158dad046cd50ef29799bc10d1a7fe759fff0813e22916bbf075b

SHA512
91e4d268ac6ef84e6e8831431d776400809bc605f36f37bd6df54a5583e38b97b8b37fb42d8f948ac86d3fed940a3d11a277f1f5958ff2a2a323448e48a8052a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c211c9dc68f4bf01_0

Filesize
2KB

MD5
cd6c87c705ee8e8ae9432657132f5f4e

SHA1
5f4298be63536f017627ea7cdfff56d49497e9dd

SHA256
453f19700864e57885576d2eab2e61259f0cda3dede6e11dddf811ddfe3e3e7e

SHA512
dd31127057a79348b9575086ef187135cfe37331cf5f4ab9bfb328104bae33931189ad8bcbfa2a17684208643a8913bddffaa98d7b542cb7a94fe33658bfcb36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cd9a47d844308cbb_0

Filesize
6KB

MD5
155352f59412f7dd8dad5ed7ded89b3c

SHA1
b1daf35d860cd22986a554351015b819937c6cc1

SHA256
d16351949af650c04bcdf2f02ce798ca1f76d265d4cda75caf28747f5eb1ab01

SHA512
8aab57a7a4b923db78305dc1c33cbe89184f5176014012ae607ce214a99b4d739bee8a94cc7682050d73cc6ad99785a9e41335badf5bbda3ebfa4c564ce049e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d45aae6d8d9c9ff2_0

Filesize
2KB

MD5
0f4c0b2782be0d60a6d2169ffe1bca7f

SHA1
88a9829227ff9d0e747a829759cabaa608da488a

SHA256
3fad535d8bbcb5d629d4739ad3ce89209645744e50da26bea82092514c585cc0

SHA512
d0fc5b141cb91abc0ca1713c45078d8ad5bebba0544aea37f9ccf0bc3ac0ff85a436037a2d6ca3329079abda70b66bd700632b91fff7c7e94a16ca0136946d27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d79e0a2891fc014a_0

Filesize
262B

MD5
5b4e7804b2e86d5e09a17f0d1c5bbd8d

SHA1
4bab15d50148993611169984fbc1ab596e942400

SHA256
e8f216bb32572ab77c132b0fe6838a5c4a706749950d52b90f746f334f52c3be

SHA512
a4986a021230f2a12835e135f71241045f22ce5461fdeecc7b2cc3abc8ecfa9cd5f749c985970d03a68ddaa5d1a15eb40bc5992b527b8dd68449254317d0794e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e146fd968644d345_0

Filesize
6KB

MD5
c1c906f9861645ca8cb5225106535206

SHA1
efc63e11d154add04badfc1b62d924c64fcaf652

SHA256
602fe0ef9ba0e8c6b255ef49c3ab5177c055870322741ad0e104dfe8b19f2234

SHA512
7fa1562484b2eb1c0e3919d7bca3fb6d3fd678ccb3210701b5dd0c2cc8d69c9b6544a15818c138144a338a7c70dd60f1cadd43a275e2a5599ed962cb63df76b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9c7e700cc3e33cf_0

Filesize
47KB

MD5
20fae6d6b1aa10a28dbb19185e4c620c

SHA1
e6357e49bec10b4ce2b54c98fc2be8a1a35554d3

SHA256
b607da213b62fdb58f06c95a52f232524c9761552ff1d2112a6e2c0dc9acc044

SHA512
73d69a3a1b957204bed48472003505e8c00b808dd27ea1758d3363b1854fee8f785c7acfd92368613ac903d73129b0c4bedf55bc4fe9474b290b48e337dbe3bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2076e2a98754e97_0

Filesize
2KB

MD5
8e8523b465b8d10bed9f7e31f67e876e

SHA1
65d9e1ccbd426e743464054bd987a6b8900a4973

SHA256
6ccbc5b7bf7c890a8a04c0be34333f34e35948292dd4fb2f4758cd29288c1641

SHA512
3268026e900a67b9738f3cfbab24f72e173a90a30e4db4a8aff1ecdf58483e66b8fdb8ad91e60677d70a9069d1efc077210b304559e8be85373fad9c56a373e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2e4bbad99a372cc_0

Filesize
2KB

MD5
d8cb064e58c834dd4aa1f860093b2546

SHA1
c77ff3522f956f91163c3432247752a20b008704

SHA256
04e0f610f2f9aaa1b09d6b8b1fd815966a1572a53d21a0b8cb123627634c3e91

SHA512
bcac7c09e8d1b65f192fc39e24e516e3316fc6fe9318072e3e6650ac5ea6d2457aa617c84e9e0e81fc98009d18fc7f9e49029d7b514ea3a04a640f7346bd9aef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f8ff5dd92e743233_0

Filesize
198KB

MD5
1ffd4bd7537a19c99022a2583f08039a

SHA1
3aeda13a7ceb174db0588293e7139f2d5949dd36

SHA256
6691f49949f9d3a27d6655678ff0997cd3300602bff6e946b44217724f2d8076

SHA512
36f3a74431bf747c5b3cdaabfc77e359f2e15937859eb4564dcef840a62ba94d57e366e28cb34109ab62d2f512d20eafe6ff27e921bab55214bb4b87fde8116e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fbd11ea5cda006cc_0

Filesize
26KB

MD5
751359c2c4b0013450a007f5ed29cf16

SHA1
70cdfc797ff7d47d7ddd24f16852658af7336dc9

SHA256
3502661ae7c1a3407b2f62ef1d05bc47ad85fc9cb18bb89740542eefe4285b71

SHA512
90127c1d9c55acf106883ac9881a8dca504cb877ba415bb999084cf4e63a4bf4e2c8c740984630e8c8107ddcd57c61058b6aa189c27bdab7e24cb8edbe69d807

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e3fc4df55030dd184745e3f8448188d8

SHA1
86b17e287db0085e4915a76237d382167564b4b4

SHA256
dd5b307583963aa75e7ed507791dd6ca13cdc53beef221f9ada7bccc8ebf2109

SHA512
3427159594592cfeed7b44c6ae964d2bbf91827b18268471ca51eb5931d82a2366de4a652697be1b090969acf88fac6a8ec26892566d7a3af1f9667dc70f5854

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
04886199306f24da9d8b084c76dfa921

SHA1
5898d8a1275dbf2e7b919170acdd61e12405fe8f

SHA256
c2cd8565103bab8b18585295cd84881dd23b1d04ada79eb42a732b6a39682e1f

SHA512
907e12eddd5d596d87f7633fc03c90604a5f5edbe18a45f003512bcb30db40c157a8058edf339751f54bcbee32793ad0bb866c1d7b41ec51c297b187654c9f1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
3d107546f00c8b906bea607ae2dd35e3

SHA1
bebd3a12f7654ad98dc9d85311ebc993c03b0d43

SHA256
0587784256abc31e8f9b39afd1bb902e28ed7d4e3199f64fe0e5a13f0b6c1618

SHA512
3f1b657a765b1f2044da7307e1481f707b7065a38ea03dd752e716572638cf02c7973b76a15d000a1efbb0571d4315e3d9ebed538b2a56e104e0487e62720392

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2627cff02783b9f2f2c6fb04b2efbe54

SHA1
89959802f36b22e9c604b9484d8d0aff510279b6

SHA256
c6c6b9ad5a3419342f2d0999feac2514626dfa65238efd2290d30751a8e9d9a1

SHA512
e81127a3e8a820dbfa6ffdb4fde4f8ff36cc92ed4166378d150a78404351ad62dcf82aacfc63a2afd26fa99582491bab27f6e66eb94f042476a96fb39906baf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ba885f2ff772b993ad37bca6f6997a08

SHA1
bf14c686346a7243821a69fdad8c32c133f77cd0

SHA256
950ff8704756cd8278fa12b476840e108713bc7b6d841501190f7f76dc1ed8ad

SHA512
2eaf5ff8500286c8b4721324ebc201a57649cf457f9d9adf5ff95b7bd064faa7f13e4ea37ee3f39a6ddc4e6babf705bf130580bbc06132debc1f38eacd7c7086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
98b723c144b9d982882981255320669f

SHA1
d9f4d5a27c1b1955790a9091333e46d08b47cc81

SHA256
76df64ad04a42f01ed94b71ed5b6bc0dcd81bc08b9903cf201048a02794484f1

SHA512
d517234d5bb5fdc01b7fac411213b2e99ac09f8cc044822687e87baf5e9b5be1f9f13e9be866a666687f81d4d627146ba36c4a1f3ab2376238a945b19481c4ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
5b6af8a908382e1100144794970b397d

SHA1
79ba02131541b2746f20b7f60436bfecd14b4b43

SHA256
b3b68b7ef5762187d0dc2bbdd578ea226e80ba51fcf5606cca7aeb2ebcecd75d

SHA512
6eaf7eeb76a0ba729dc75410f71f8ebbe15e462cd2e59f42e457a5ba93de9bd345cef4be7fa7fc3d571ae028e8d42eeb073b419064780ec2d8b20300f6d8fa9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57955a.TMP

Filesize
48B

MD5
8aceb59075eaa80deab47ed7eb738b05

SHA1
77e8fb3e1573bab421fed1c89063a8de608aa4d8

SHA256
e641abc3429ec1aca55b0e6a87785afdbd4dfc0fe083404ab79be35c52f6eef5

SHA512
6dc348b32416e67dcb51f6b8d5b0cc324173650964f663b13022a26faa3b839e98172a2173a4472b3ca80e473934b9117d821691deff3d89d1e92082df9534b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
db3e5a55a9035473d1a789b27d1f3859

SHA1
e705a858020e9e0ca386e62501b442b76644296f

SHA256
86c11405eb724c904b3d8190004e8fe14bf3e852c59fe143b275aa3c1e328c9b

SHA512
937b46c970c82b2a88c61215375a396c58f1bdcb36c7c5147add3d672b16919ff0735c6e612b09815004b3ff79be4d343508137546e8b67d5e85ae26d0b6b29e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
279B

MD5
a0d6a466c87e1f9f295f16fa15b63c14

SHA1
66409cc12a5467c445a26fd0687dce5708ac7cbf

SHA256
5da94fb6b6e5700a2a39143b16a1608acca901fbe6855a2059e1d81ac8293258

SHA512
30079fd4032b1fba94da07debb2f3c201d9c7383f344841ed045a7dbb47b9433fba649ae953a9c22cf6050a4e1f4e65546e8730b4d845f7a20eb93e1b1697273

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\index

Filesize
256KB

MD5
8b351ce13b51b13fcd34b709bf1c0b3b

SHA1
93889cf3e98c3333bfd34ecae98c2290bcc123ca

SHA256
645382bbc769134ea7b6045fe4c9142a78531ac1d4d4a17d42c495e2ca1c1c36

SHA512
120b7506ad264135721d90973b609cea9fa1dfe57cad09692fdcb80b8b57a15efba981ed984416d64c78b0161c1284704a43138ee154e9e689982d1bd632ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
ec6cdb193d62ddf406a4984977c97ad3

SHA1
1c37cff5e30cf731a88ca89345ff1013edcc8f88

SHA256
0519737954d9fd5326ac5ee75037343734d058b36846a56eed6adecd3693de1a

SHA512
500850f760ff76caa14498bb177fde299eb35769b3ec5e30a66487b38d22f617bd9b8c58f3f42e6fb6b5896247a4335c357f3d58c64de7c3dba2789278992a2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
1KB

MD5
70e0ecb172b76fb676bc5bb0028309d8

SHA1
f52f71766dcfc0a7e8708185508c6d33e07e55a8

SHA256
0ca551c03df4e73d13afd78cc7e9a3b4a7472a84a5c5cbfd3b4541970b0edf5e

SHA512
27c2a13f94db7cf3d872fe167fc91b0ec137c34145f6ee466920d6ff4a8950abc7240108b08431a040085a7d9ab57dfdd7c9f1697d83c43a16446e8e17aadca5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Filesize
28KB

MD5
65b7a0b3a0f8b51f8af05e2ac00d402d

SHA1
b54082497d9d134bd0cd6118de73217263d06187

SHA256
d0912bca220f4a11f6d3fa7229a8059fc09c7ecc04449b78486660e7de3ede4e

SHA512
b0f820e11e844fb23b3d51951f929057f7faa6082a7da8683ccebfb341c3686f7ff29c9719e785229a1ce7da8545a81a03c04d4a5fe1019b87be0580d104e91d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
293B

MD5
6e81490362fcd6a043215e88d940411b

SHA1
7bebfb79d1f6d47b85d471d8ad733e4dd3d5d121

SHA256
364cf5d92412f61ed4e7d60f492d628a7b5e5d6946fae74cc94e34c44d04ef13

SHA512
70b549a9511984bdc70d0cd4c3b6ee0a45a1c8f796bd68dc726179f482b623e5e94ce580e4e25c13da16ed496a55531a5e2258b30ac78c40c00e3fe85e425b80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
aed9b8206dbfd68b4413c9dce43cc945

SHA1
efcbb9413aa636f5cc43d6680e2fdd3f258c9545

SHA256
bba6f38bb64c8bd101f7c5f216459ada9cffb3c159cf8ba093b2c38236c73a3a

SHA512
c906619a89e1f55a365e9fcd9f8546d72de5b9d7df4aa71ff98d5bc86927ad536ca61076b0c961a9534b829878f4711d8710d4784bbefdcc47d1a7601d5e3a17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f50591993b28fde9d2100cff30ad1a39

SHA1
c9736dba221b559a55f1beb5c12df9c569522ad0

SHA256
925454942262fa241debaba10a5ae9f43e6d980bbdb7fa7d77ccce6450060847

SHA512
ac331867d3fa669ca791386e7d3c2f7ef76942cc3cfbf5fe171bace2cfe859b9bf5e8f49b9416a5e59ba8c6f1dea0cdc48f0905b88a1898785e16d3678e77afa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
84c82f8384cdcf44f524c2d933f3fe9e

SHA1
3d41d034e41ed063a93d8ad96b4110d70fbf0f0e

SHA256
7f2fc8ff695cf3352fde3e2c98a51aa03337153b4e37888e0f07233588593fd9

SHA512
4b1c13f4071bf0b46515951f24e1542aefb09a1aa407096a927f7a48a1f5c963a400eda295953d7bc1d2c24a8908b2820a9efbd7972216e0ca6a88522e145e94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
177bcef03ab3477204e6ff63aed3bb3f

SHA1
60e00825105c4b0b001afc45c68f45cbacebfc26

SHA256
fade83129f92e6aa6197e2fcd6d175c1bc79a204fad3fb24b7ac159c382c5406

SHA512
03aade4cd6e3ee9525f40ac6d4c3a76bf774e7eb1bae31a61569aabe2a3719f2cdfc2362420316e4e9d7cc5e87b743e6ed5a130e2dfd9f243c14d460181bec33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c8d9509da1ac4722fea7ee42d568bdf8

SHA1
47ed2c2259a0f89b97677f90e2933925151b71ee

SHA256
a5fc560170ad2bf8f442d91ad9a490be233c8bf4cb5e040766c47ff0f1e44147

SHA512
7b5716449bb2e1a26ef8ffb4e3ce3641d8843027a6773d6a4bc8837916331efc6ec8f40ccb6737e9affe5c637fcb71c4caa2383b8afad827f896c027c0e3c5db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ee2ec71095f7e0926ec73475f756cfa2

SHA1
3e9b8ae4cc83999270a2cb2fe472aa48521af929

SHA256
d52e1f04072e3cec721a8910e832405d90d0766bf4998be286d9a0dbf5a16469

SHA512
f067cd829b0445fb223a6da7f6f498d44b00c981edba1e6fe187fc09e30a0ae4adaa5754d33127a1bd0a7a6126f88ecedb3498b625a7fe9ee58e6d849d177ea7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1216282ec3d3927f0367393097f094c1

SHA1
6cd0fe6006ed20d6ef2c8f1271e6e2dda2f1f4f0

SHA256
1ffa7731469707c5fdf88888b315c66f4702d5396931e9c73e11ba14726b97f1

SHA512
2dc95318096dd0e90e6a2daa7520458c51f3fe4c61a43a52cd0da62616bb50c31bc2c4be45b75638335c4a91c43b26a08556d2ff17b0d580c4f2ee1f809f849e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
589a63ac190c6dd69d12d88028859b3f

SHA1
4ffb0f93b13fda34b90df3e338c34eb19ec5d4f1

SHA256
54908652e5e3f9d263f95af195481d723e6f2e3174feda6cadeef1e551b1aaf1

SHA512
41fb010e46f4e4b210745828e8caf6a0a6bd2a45b60f63dc2daa2f1a0bddefbe9b52050ccbbbdf6bff0e7ae5b9259ee400623e3d53e6869400065066cb14299d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cb3e3dc7d8e0e6535c8ef529d94c029b

SHA1
f2fdddb5c4394f30813e586692ae7c35f1b0306f

SHA256
b066f8ad8617ffd996d9f5fa1648a20c7cb4b3422385f5ebf004fc73f0dde5d8

SHA512
e6da1f5c0c5231a39966622aa1319726c23f396a88d84b609c45acf217f64c37fdd1ec71ef68d50574e848e5e9e4127221d29b915de339ef04637f5b8f94892c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2c00633a6269bc4150180aa860105c05

SHA1
de7b196b3e3abd8e36c01b7b55a611133abd2948

SHA256
1fa8336845df923f593a834998dc0498e7285d2dc8a2e44bbcf2607932440be0

SHA512
37a61f43e980ff543d12a396372c50edd5739412d4e275ae03374903b9da730c9b2279937bdecdcb0e65f769c6abd5c8f6af545f4cca0ad770fe446aaf8e5319

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c9dfba4112382d9d591d1f8ce312e20

SHA1
2b564ddd59c581b4ae6e5bb759d538ad20861450

SHA256
09e570bec5a9ba2a9d7dc84fc104092da80ed07526f9e8785a5667f1a586bbf7

SHA512
0d78236332477f6562496d3f195529fb003ef14262555f688c802d90e1bd62b265751f22242800cc45b8ea94518fac01579e54bf7610eb7d4304acfca4212913

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
70a64cb861e327f07dd0ed5db840c1b2

SHA1
4d23b4d00a86f1e3ae1c1000b58a00858b528caf

SHA256
0561db99eb2b89663ab75b525cd7f53feccbae9fc356d18eb6f4e66b8d253bae

SHA512
8e0c6c1596172f85ff70e740e04a83db78d096a0d201ee7012c1312608bd2d2e8677c13af9fc54db8e3349738d83c2e926507e552e349724b258ec9cee3760b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d295e13230820487275d5f56b181b871

SHA1
235b701ae6b86bcb80eafc2c845ac2b499bd07bf

SHA256
98b6e09b15e5fe1bdf1dceb548c7933f4daefbceb7801e02318938d3a73b2722

SHA512
8364ef4b1c909e4be80090c633b9592cb927dceab476ff44d97712cb1d87c54ed6712da4940032d174a95a4a8cafea76c10647d1a22853b62516c9aa68d3e04e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c63d3b20f04e7d8acde1eaab3a93f13a

SHA1
a5470def8069451d60b75b6d00356ecebfce1d5a

SHA256
25f0e4e5a939c3aa25a549b5128a4ea40f21c5ff5936b989537917a8c65046eb

SHA512
0852cf35e08288b7a7a83084c71bae64719ba2f9a5a466291dbf4e60279924583ff34b6e929eaec5de18913374415f95580881e952241364bc04f507c3f61d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
214c85c5700385b591fce4f4f75452a4

SHA1
e0ccf976694716ebb3830c48f7b5c31e84247b42

SHA256
773248470f76bb9a2f230be91f21e1b193ec7512c94da16258bdd471a16555d6

SHA512
50439fb90ed75e284a83a78307e767b5ddbd64f6ae6cffd3fa7c52c5f884c13513af37db405e07dd75a265b4089fd96783f6d0e3388662f6acd112a4e673c7fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7663920b99c00bc9127c660746a6d61c

SHA1
ae006acbd4ed24d7365b5faf4ffe7e3243010798

SHA256
0562d1bbc36bb6328ad05213e20dbce03caf0b32fda145d01958fd3862079b4e

SHA512
549494e38fec3586c08985c991b7ca7babb37fb51f09fd127975159e01dbcb125917235695ac12d502c25e9f6061e1b2f4f4e97787ff51b0f06dc37334175bd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
65a8aa67f5fa2ef4056f38e9bedc71ce

SHA1
fddde29c0158bb6011fe9a815ede11be01aad6ca

SHA256
d3e66ffb4895f28cfbefc242f277b6e8696f2560a71e4e764fd1c977683d62c5

SHA512
c1f5c0db7fd789c8f5b227bfb3c80d3ed0844a2346f3d7494a4266157bd1392dcf9424594755877f2a82159055e3e8d30e91e506c77dd9a13d669293d616cd3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
20e92cbd6898ecffac35e3ef0bca9b8a

SHA1
bd6b76fb1ee73bbb8f087c377d239db2cdeeee2a

SHA256
403fc516dc7f3dbca8043235c205df9dac16957197e90f0f308eb9d6b3c9616a

SHA512
e78010f68cd9ebec58fcc8a8b63e87a772587b903839790898b2a4251c3bf3bd02011fa914050180b3368823d513eaee72f2f37c7da719c2df5aa28f169f6fc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
732e345f5affbb2a84f4c3a986175f17

SHA1
55565b876d8e621cab6033b2450bcfb94ab57bd3

SHA256
a875ad57cb5d7bf1050377ba342f18947fd6bf769d4ffcf96681f4ce405983a2

SHA512
96bf0bc225b93aa49556bc41e139872e0f1ee3e32ebbecda809188009ff221352f335c1bb1a533fd71eb5562c9ecf1f69eabb541fcd0d1e388cb019b294cec0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
85454a7b053623b77ce73742cb75b3de

SHA1
faf3f61d2cdb170cd51f577323fdf3bf69a29a0b

SHA256
620c87a40aee35d3a7e81751c73c96b45a2a1f02882f7fd8cfdb5973ced127fd

SHA512
1aa55b84ae67f4f18bb9c3bbbdb0c54fdd95c69d03993dfd04a85724e22d66741462683f04a8f71de040f489fea8fff4e74fc50f00fae603a9a98ac2c539b464

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4c6a044d397c6093a920bb8b81457ac4

SHA1
e378c4287480b9fbdec71175072840febc29419f

SHA256
9f73d2e6cc65fcdf0eb23a984061321bb2e8de89eaa7429706b67691d6095e3e

SHA512
1de8e2b42871ce2b77de25377d36b06ed8b6e77d50cb1f70235bee4393482d86e0540ac1b461225d28d0a51b71ba2382bbc4db2b2c09d5ad81f5a0b5d1e994f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
684576049001903ed96d829aa4bde895

SHA1
b743ac29721717cc83ee05df6b55edc267fe3660

SHA256
1bc8f0c0fcf5b9fbb9f6b507bb602f87ec29f1b45eb2435fe83c4b5db0e644a7

SHA512
54270368a161c54c6113a728fa3856dd75ece61554a79fe75960e023657f4b26da83fb3ae48909d5de7661477cff642b41f170ba01e7dbd3b05df21ba6319260

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
6338e51cf2d1cb4bfea21c7d81cb3dc3

SHA1
0049d2863f309423d889fed141ef1f146246ac82

SHA256
2636a794e74289532973b8f1f9c62a0009520dad49951c956dceba846835e0ac

SHA512
ffcbb8f086de4ca9b51f2a86ff75f283afd9a08ba7fdfc16b119f4b80e452579fed0c7d5eb02cda11e6d7c6762ca8d5a1e542e90e106020f530d755933fb3ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0419f7d73589e87c8c57e77b2d9eb577

SHA1
eecf0babf3c1c90703dfda16a0e4f42a86c5814d

SHA256
d3a046e9874981fdadf508aff13c213a252311f64acc23d466671e9682cf6acc

SHA512
4aed1697a75206e4fa9dae364287a7212ba635f9b5c2be61fb173b954f7bc39c5fd21b3ae85fc4845460685a15a7bfc7cf3c80b26cf9228df2f35e82626bf8ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
99B

MD5
ba92e5bbca79ea378c3376187ae43eae

SHA1
f0947098577f6d0fe07422acbe3d71510289e2fc

SHA256
ccf4c13cd2433fe8a7add616c7d8e6b384cf441e4d948de5c6fc73e9315c619f

SHA512
aa1d8b7eb9add6c5ed5635295f501f950914affc3fa9aa1ee58167ed110f99a1760b05e4efb779df8e432eab1b2a0fc9cf9d67a05b2d5432ff8f82c620a38a62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
281B

MD5
234b083b54bc51b007aac48431e36ca7

SHA1
44669b933d4cfb264910d110915c3ee5edf18694

SHA256
1776b842d3c3487b9d92b11eea5d38597cdc133ed921254ce33d4cb348a5478e

SHA512
5ac30e08c29ae44d30cea5ce54aff7c13c60d12a6d86752b609a4be766b64bbab453bd7775b01328fc5362205d9bcd75290a18e0ecb4e41ec6e5c67c5f81459a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13381346623660373

Filesize
1KB

MD5
f3767c691cfe3fd7258eaff100ba0071

SHA1
1ade33f0965a6dd9a05490abb7a1f4b99eb3c774

SHA256
bbca99711a73e5a6dce1b5a361a1433652225a9b804756200a17cc8f3f787f8c

SHA512
a9a30f77690257371353c959cc198b727904ec88e4b116cc09a41ed457a84cf136cb6281b69106aa524f41c62180eef787511c0c7ee73c6f117016dc202489f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
85c1bd493dfdb148bdc2d2488f77a109

SHA1
6166ca65790530903b2a07b6c609d081c2b2d1b3

SHA256
8f6a160fb9bc54036941efc05d3fe8c26e11627c35b78166d540fa236132eb5e

SHA512
dc16d6eb9d4dcab887f771fd5ad00755ef38d6d6baed37f4ed914d463531118db050e649043c351bdbe75d837d04f7dec770b5d75461173b02a3aaf9d1cc9f4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
8a90f580ac75bbdd9055645b5fc5d991

SHA1
36d29778ba84fe8562045eb7dab428e85256662a

SHA256
a2914e367891d98dad8dcf638b0994c95834291d19719cbc813ce996e112ea0e

SHA512
40aa49fda556b2590bcf8b31d99983b98fd26413edcdb544c48e32277f6c69b3d7a3dd1e00c81e8896000f07efc46e917e87a2998ad26c93c662d3d7e5be4761

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Filesize
20KB

MD5
f44dc73f9788d3313e3e25140002587c

SHA1
5aec4edc356bc673cba64ff31148b934a41d44c4

SHA256
2002c1e5693dd638d840bb9fb04d765482d06ba3106623ce90f6e8e42067a983

SHA512
e556e3c32c0bc142b08e5c479bf31b6101c9200896dd7fcd74fdd39b2daeac8f6dc9ba4f09f3c6715998015af7317211082d9c811e5f9e32493c9ecd888875d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
82b393364a6796dca28f0e922b39f56f

SHA1
84e5bc314bc976819d9b59bf7094c017b07eedcb

SHA256
a8dca6dbe3f04a8275976ed13c118fb5a561baa84c7978e8dc0ef89d4d24e14a

SHA512
db07de4b8d87a7c5fe387f744076aaec0d0eb8f8211f8600bd397f7571d131a6f148b28f94b8baf2b640d215dac4acee319291b5ea763ddb5546e71efd8e250b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cae3de3ad03e754d6e7a7308d6bbb15f

SHA1
f01a16868a35ebbd83278276afdc13d9a9a48b34

SHA256
807439f70194029d323e599008d745484f039865728d0afdaee4c83e3bc30bd5

SHA512
7072fd3f8ac4e6cbaefdb9b9081736edee261b5b5e6041eaff606c002642aeb581de9e41afa15c9e346342f4d5cbc8a3f3c021bc044ac1e6df47b6289bd83f2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
a70d0d938b65e98eedd0ff4d097ccfb2

SHA1
e29d11900b501e3da9e2a702c5ba030dfd133f32

SHA256
e0d00f4f513aa6ff4d93686f15ae82c171ace8dca9504e2174dbf6fd01a59c9a

SHA512
a6fd3d1e1b47ef3932d02ab34bd9c5ba247ee2d08af772c19a025afdfe0526d7843d0ccf28ade168328bec835e0cdcd2909e53199cbbe5277b02df787c23fb18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b3bce4bf47416f4483dcc8f00d879f89

SHA1
45c98de5b7087b989e97e63fcf612016aa41d561

SHA256
e1d0639ae8c984bbe6c248300dc8032c1f702270078f192bfae41085016897b3

SHA512
2e69e7c4cc1d603de70ce160c1ddb253d1f86ab7b0630589c674d6647ac5d41a794294e4c7863ff75b8bcc1aebf4e582b8e79643e6552c32e28bc9c5fc9fdae5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
0a4e21251c12b74bbce50aee457f9a82

SHA1
d4108a6684f5291f7c99cdb21a8d7b4d1dac83ed

SHA256
744725f4b4eff74deb12283115f6f428e45f473523df4cfc69920668105a4fd7

SHA512
51112aae6b3ffe13b0d13cfa11c58287266777f53d76937533c84930633340eb4777c23c35dcc98a15cd4ea5341e49370444b6c77f6df2160b151804510518a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
43ed6852cb735f7a486eb4359501ec84

SHA1
ab095c3cc98a75f38b0de88d10f7d7563c1c83f6

SHA256
7ea7d5131fd27ead074304b7818e677a578c3f173ae1dd420cd02c893b3b40db

SHA512
d60f6965bae91c7b76fa75800bf1410f37d48593366a2f6403c789143da85ecda881cae8609baad273511fd077096ea458fcfa755399b9afcce03eccb046ef4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe594ec2.TMP

Filesize
538B

MD5
37ae2968847502a30a68852605632b44

SHA1
972d7d05a2bdb24803d0c383c2b6f53b4a42cef7

SHA256
1a6476618b3ec82bf1a03b015111cff66374533949cff613f6bc2522567e0db9

SHA512
3eff7222e716a1131df4d3f7178372131cc6691212f0ac9226364fd41db04495783681ef9584bc8540e14f00b4be863b997fec64613e20c9b117b12c262b027d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
04f8160fa5d01aac1545a2bc8c6bf689

SHA1
9a38b31cd71ab9f450bf356e6912ed4da95a6548

SHA256
45e63d996220ac45c51e05c6f2e715f7cb8285dfb0aac84a96a7a20ee098ea52

SHA512
66f0e52eb486a733d693e7b8c449f452bed242bc1ae0e51366319806de046f1da5b07a50d1a9dd954392fe22adee0dba02be01b086c3bd5db03b53a745bf808e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e94ef366-5433-47cd-9a3e-b17389c918db.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ff8a993c-e40a-452b-92db-d3a410b00902.tmp

Filesize
2KB

MD5
9f1fb6bd17921192f19241927cb8a23a

SHA1
0596b0e55f1d534e23525be60942c4b3d1cfd7aa

SHA256
742eb3a9990a0358a641ec66b2d31aeeb81da633c7d8673129477f3a44d05707

SHA512
a36e62bc42e3eadb5039530e9f284e614b8ff45ddd004c7010dcd1c5c5c8830ef69e3ffebe0aa9c58f7bfa2dd3add5ae26e744c2cd7b845494034654c4ee18f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
c951007b0bc09f50f097d04fb36b8ad7

SHA1
348eb713b9ca49947dceabe8703eb7af7952562c

SHA256
e40862ed00dd1c0bceb5ca0d59da6c866f796f448e884a399b6cfa84aa39966e

SHA512
aadd09fcbb8621c41ec7ffcdc816956194824a1fbf874ad17e4a058bf1d6a50cb09c892163a8ac96e0860634b4492f13c6304134999e538f18f01296d69e3b8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
279B

MD5
aaed2bb28eb120153d8194ae1df908b9

SHA1
2a02a0de64b03f2e663fc9a75f7380b2cd542e6d

SHA256
d516782412d49f80f616b57824a6e9968da166cff5a0d8d7d7b1bcd233b4cdae

SHA512
8f7f3e0a50c04444abedb56506a7a8c200251015ef1bccd9b18371da52263c818ee9596c61e070a2292376f3b5b7338219901ca119680759cd4a6b03b2a13e5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
160B

MD5
2e19a9040ed4a0c3ed82996607736b8f

SHA1
5a78ac2b74f385a12b019c420a681fd13e7b6013

SHA256
2eeb6d38d7aad1dc32e24d3ffd6438698c16a13efd1463d281c46b8af861a8ce

SHA512
86669994386b800888d4e3acb28ab36296594803824d78e095eb0c79642224f24aca5d2892596ac33b7a01b857367ed3a5e2c2fb3405f69a64eb8bf52c26753f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
297B

MD5
2614d5bbe00dd1255c27333bcc76d661

SHA1
a1c3a35540dc3b5fb8a158bb52f46cdc94bf8dc5

SHA256
fc205c01ba97b5631346978ac42b9bb4277c673eac04a0670dc54f3e9afa83ee

SHA512
320ae9bb2dd4d3a48d8dcfecd09ec67fb4c6e58c3e40a55774d8d664da60eb4649f4ca08fc70d192ab859f0f4fab1e6c1fa19ef537d64962b7e4baaef66d5254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
e7cfb6f36375ede89db669348999314e

SHA1
d1021189e805560dc85d6078437ccb54a23ae071

SHA256
066e04bfbc74a8a9988574febf810159fe561b163bd47186f78c64191140bae5

SHA512
75aeba058ceee5d83fae4c4c10bf5eeffd86ca9bc9f0b6a2b0d9e191a3e9937132b1fcdb7ecaf78f9c7dc6a9e1401eb694b848f14e90769448e91107b3401ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
ed345855d78bef2399bb6b99db3d6c9c

SHA1
8f8595fe377b7a6df3b3e2b6dcf77c85ffbbcb33

SHA256
7e6883356830e508c1b1fc332c37911972d652a99cd7b6a2e8988842bc337954

SHA512
d7d9d405a26081d060571da07a0514c075008423a21042ed4a427d14ed235bade23cbea3910dfbd799275e3c0f35f27ea9ac9d1a40b475c5fa75431201460476

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
b39fc7097ca8c694e95c6366279344e9

SHA1
53958ff682fddbec5b908f9e1da1be10f6dd96c6

SHA256
453a1ca115d2f803b14027aac3ed696326b42a617f5f924dc096b1bbebe1204b

SHA512
51e4b405622e90b72db90056a889efb9e3730d0858de6a1e6ce50b918728cfd6b78af5dc982c37d529b15369ffc98f38c3a4db50ed599a8b04ec9494acb9b980

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
08591542e4eceef3af924dc089f4a9fc

SHA1
824a4e1cad8cb66a64347bd31ae04e46094be4c9

SHA256
a96319ae348c1850d0ae537cb43740815f54e87d90263c65bd463e436b11ed9a

SHA512
3acbbb4f5c7c0eb8aefb61bfe38f2cb494a1b372ad70045b85d0cbb38e5e9ddcf230856de0be66c79ef647a04f464a5265047ecafc2950611ad63a95df63c22e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e4dd03cc5b9d0adcd33e789adb69a3e2

SHA1
ff2e5cb48cde52b90f0bc7be1c35d7cfc3086f15

SHA256
dc56d91f7c077b044e4476e404e4c4304fc46899a389ad8ac17208f587754534

SHA512
f91b1fe01f5348410498b92f6b0a3ce3379768211846cb05fc449bbeb9efc90b9eaa3f681cf505d555c029d217447ccb16f357a116417533b0cc244afcddfed4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0f0174177d934584e65a36f57d90d494

SHA1
565ae04d8f64ca15283dc18348334b51364ec4cb

SHA256
58d89fc30680ae5a048f8719254806229e7e8e6ace479dae53b31f009553ae6f

SHA512
1e7e94ccfad8cfe6dd82fbc7b813211e9630d748f1d69148071f5a8151f374208889f157913f87b54ce61fa45adefb79d7052a663adb40d08be79c0f9e3991d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
66082e510a58809a497b29e73725a090

SHA1
0e2366466828a1d7bb66cec3a38690e355fc1830

SHA256
abf81a3831af9adfb2bc9e040e51b1fcc6bd54b54337733d231fe1e59a7341ac

SHA512
9c1867ee2d822e74caf71e370354277202de199adcb9e45f8417ccb281618ecc0fabdeb5aae0e2285ec3a21438de75942cf48b53fb85952b397d68f8df46d98e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
fb2a4df7dcd0f4f941792ac5b9fe9cc9

SHA1
69724759ffc12e9fb23756ed612bf89b5117f8ce

SHA256
27002e5800381e684e868e5a96435292a5f3bed83e62ac343cf3e69e35470358

SHA512
61ea8d8bdca91cedb9231f8ce27835ccde6a32d34ffba40d24664fd58bddf82525fad7ab960ebf21cf617b15910e92ccf0a35badc3c10a27dd419b88743e35b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d5ca3fa3a9d1c7db6ff44c883e81ebc0

SHA1
99fa02234c0676cecb362a780e8203d25b3c05ad

SHA256
67dbecf8ea12312be3f84e65ede74d46bf59dfd5eb83046c7b43659f93f2a2e0

SHA512
850e67f25be47bb9748edccbee031dbee2b95b2acd96ba08b9fe96b9a25f021773969e9e94beaa4eb3e7a1378a4cbe4691b36f8c064e8a3ecb30d76f0c4ef765

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings

Filesize
81B

MD5
f222079e71469c4d129b335b7c91355e

SHA1
0056c3003874efef229a5875742559c8c59887dc

SHA256
e713c1b13a849d759ebaa6256773f4f1d6dfc0c6a4247edaa726e0206ecacb00

SHA512
e5a49275e056b6628709cf6509a5f33f8d1d1e93125eaa6ec1c7f51be589fd3d8ea7a59b9639db586d76a994ad3dc452c7826e4ac0c8c689dd67ff90e33f0b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

Filesize
126KB

MD5
6698422bea0359f6d385a4d059c47301

SHA1
b1107d1f8cc1ef600531ed87cea1c41b7be474f6

SHA256
2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

SHA512
d0cdb3fa21e03f950dbe732832e0939a4c57edc3b82adb7a556ebd3a81d219431a440357654dfea94d415ba00fd7dcbd76f49287d85978d12c224cbfa8c1ad8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris

Filesize
40B

MD5
6a3a60a3f78299444aacaa89710a64b6

SHA1
2a052bf5cf54f980475085eef459d94c3ce5ef55

SHA256
61597278d681774efd8eb92f5836eb6362975a74cef807ce548e50a7ec38e11f

SHA512
c5d0419869a43d712b29a5a11dc590690b5876d1d95c1f1380c2f773ca0cb07b173474ee16fe66a6af633b04cc84e58924a62f00dcc171b2656d554864bf57a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris_638343870221005468

Filesize
57B

MD5
3a05eaea94307f8c57bac69c3df64e59

SHA1
9b852b902b72b9d5f7b9158e306e1a2c5f6112c8

SHA256
a8ef112df7dad4b09aaa48c3e53272a2eec139e86590fd80e2b7cbd23d14c09e

SHA512
6080aef2339031fafdcfb00d3179285e09b707a846fd2ea03921467df5930b3f9c629d37400d625a8571b900bc46021047770bac238f6bac544b48fb3d522fb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic

Filesize
29B

MD5
52e2839549e67ce774547c9f07740500

SHA1
b172e16d7756483df0ca0a8d4f7640dd5d557201

SHA256
f81b7b9ce24f5a2b94182e817037b5f1089dc764bc7e55a9b0a6227a7e121f32

SHA512
d80e7351e4d83463255c002d3fdce7e5274177c24c4c728d7b7932d0be3ebcfeb68e1e65697ed5e162e1b423bb8cdfa0864981c4b466d6ad8b5e724d84b4203b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic_638004170464094982

Filesize
450KB

MD5
e9c502db957cdb977e7f5745b34c32e6

SHA1
dbd72b0d3f46fa35a9fe2527c25271aec08e3933

SHA256
5a6b49358772db0b5c682575f02e8630083568542b984d6d00727740506569d4

SHA512
b846e682427cf144a440619258f5aa5c94caee7612127a60e4bd3c712f8ff614da232d9a488e27fc2b0d53fd6acf05409958aea3b21ea2c1127821bd8e87a5ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
17fe8b17cb747f25f21ca8dbbcce6144

SHA1
1952436a7fb037c4c3b51b6c3f13202550e4b871

SHA256
dba2785203d7eb7b636c1f096adb65f7c97b6b86405b458f3d62b0bdb7f6d940

SHA512
1c2b89709c2db656f39b0d03f30e8c87409f9be9beafd840b719fc4bb3fa0f80659613d4fecfeca69f47751a79fb12ed89c65d9b76b5ee028f5ac5fe02b24266

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Filesize
2KB

MD5
fcc1777a08930c01a7201be93671fb13

SHA1
3ffbfcc6a23c9119e352b4449002d6d1afd08918

SHA256
05495f8cd05b040b083b48637e47b1a0dce6783e8758b1db01e1b1e027bae309

SHA512
c0240f418e658862f23cb248ca683c0a648fced0647f7a07ad061b3af53dd0d0e96a7815318f7a95c0a5a3068ae6b807b3dc75d0fc39f2c8ba7e2a9ca7c93c58

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
7bde16ca8a0d74bc69193376b9f0788b

SHA1
bc7d1221f2b940ddc0a8a88fab70bd3f5a1a7c21

SHA256
37217e73507447194b2a5bddc74462b9624b7ad7bcb36a8da89ab66de3aadc8c

SHA512
d61b1e7a2dc9353858a5803e7b5bbc9cfd1b81522ec06a51ec2a5b1171ffa5b4b9cee49b514d25c6a88df473accbd7ca15e970f3a3d5343171638a8c731ae29d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
80e6510240761d6c6980e20f73ba79fd

SHA1
d995f009a9bc17bd1fd3e9593a287544f5f445d3

SHA256
f3b3bdb86dbecb218ce753be06130cde7246a088009d32cef5867b0d9e74e70f

SHA512
3add15a7a88749130c23d9482e7649fc33954baaa3c0daa7d70dc244694330480d526cb15f7797e2a78e9fbe5877f8bb9e007412280ccaf229703af238b982b5

Download Submit
C:\Users\Admin\Downloads\05c9efb7-8185-43ee-a13f-906b86ffa1f9.tmp

Filesize
7KB

MD5
273603b22d0a98ff7499917fb0b90c77

SHA1
c1880ec864996a755527fc3f947270c0373d4d4e

SHA256
25d0c66948eb09c20435435dc78296ed6b15a4ede6e64db9a3bd2afa8a043b3b

SHA512
fbc2b46ad52dc86a06dbb8b98fa5bd7f47b6e3eee36ccd562bcf4a62b2e419280a30ff5de69dca565da007243b437e2316e0720efcf71745da74d61e47c34b03

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\EVER\SearchHost.exe

Filesize
1.6MB

MD5
8add121fa398ebf83e8b5db8f17b45e0

SHA1
c8107e5c5e20349a39d32f424668139a36e6cfd0

SHA256
35c4a6c1474eb870eec901cef823cc4931919a4e963c432ce9efbb30c2d8a413

SHA512
8f81c4552ff561eea9802e5319adcd6c7e5bdd1dc4c91e56fda6bdc9b7e8167b222500a0aee5cf27b0345d1c19ac9fa95ae4fd58d4c359a5232bcf86f03d2273

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\Shadow.bat

Filesize
28B

MD5
df8394082a4e5b362bdcb17390f6676d

SHA1
5750248ff490ceec03d17ee9811ac70176f46614

SHA256
da3f155cfb98ce0add29a31162d23da7596da44ba2391389517fe1a2790da878

SHA512
8ce519dc5c2dd0bbb9f7f48bedf01362c56467800ac0029c8011ee5d9d19e3b3f2eff322e7306acf693e2edb9cf75caaf7b85eb8b2b6c3101ff7e1644950303d

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\bboudqdceutqxn.sys

Filesize
674KB

MD5
b2233d1efb0b7a897ea477a66cd08227

SHA1
835a198a11c9d106fc6aabe26b9b3e59f6ec68fd

SHA256
5fd17e3b8827b5bb515343bc4066be0814f6466fb4294501becac284a378c0da

SHA512
6ca61854db877d767ce587ac3d7526cda8254d937a159fd985e0475d062d07ae83e7ff4f9f42c7e1e1cad5e1f408f6849866aa4e9e48b29d80510e5c695cee37

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\mssql.exe

Filesize
10.2MB

MD5
f6a3d38aa0ae08c3294d6ed26266693f

SHA1
9ced15d08ffddb01db3912d8af14fb6cc91773f2

SHA256
c522e0b5332cac67cde8fc84080db3b8f2e0fe85f178d788e38b35bbe4d464ad

SHA512
814b1130a078dcb6ec59dbfe657724e36aa3db64ed9b2f93d8559b6a50e512365c8596240174141d6977b5ddcf7f281add7886c456dc7463c97f432507e73515

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\mssql2.exe

Filesize
6.7MB

MD5
f7d94750703f0c1ddd1edd36f6d0371d

SHA1
cc9b95e5952e1c870f7be55d3c77020e56c34b57

SHA256
659e441cadd42399fc286b92bbc456ff2e9ecb24984c0586acf83d73c772b45d

SHA512
af0ced00dc6eeaf6fb3336d9b3abcc199fb42561b8ce24ff2e6199966ad539bc2387ba83a4838301594e50e36844796e96c30a9aa9ad5f03cf06860f3f44e0fa

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\nc123.exe

Filesize
125KB

MD5
597de376b1f80c06d501415dd973dcec

SHA1
629c9649ced38fd815124221b80c9d9c59a85e74

SHA256
f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446

SHA512
072565912208e97cc691e1a102e32fd6c243b5a3f8047a159e97aabbe302bddc36f3c52cecde3b506151bc89e0f3b5acf6552a82d83dac6e0180c873d36d3f6b

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\ac\systembackup.bat

Filesize
1KB

MD5
b4b2f1a6c7a905781be7d877487fc665

SHA1
7ee27672d89940e96bcb7616560a4bef8d8af76c

SHA256
6246b0045ca11da483e38317421317dc22462a8d81e500dee909a5269c086b5f

SHA512
f883cea56a9ac5dcb838802753770494ce7b1de9d7da6a49b878d534810f9c87170f04e0b8b516ae19b9492f40635a72b3e8a4533d39312383c520abe00c5ae6

Download Submit
memory/404-1885-0x0000000000BB0000-0x0000000000BD5000-memory.dmp

Filesize
148KB

Download
memory/896-2020-0x0000000000400000-0x0000000000B02000-memory.dmp

Filesize
7.0MB

Download
memory/896-10656-0x0000000000400000-0x0000000000B02000-memory.dmp

Filesize
7.0MB

Download
memory/896-27529-0x0000000000400000-0x0000000000B02000-memory.dmp

Filesize
7.0MB

Download
memory/896-27530-0x0000000000400000-0x0000000000B02000-memory.dmp

Filesize
7.0MB

Download
memory/1208-1879-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1208-27515-0x0000000000440000-0x000000000044E000-memory.dmp

Filesize
56KB

Download
memory/1208-26402-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1468-1881-0x0000000000E20000-0x0000000000E45000-memory.dmp

Filesize
148KB

Download
memory/1468-1886-0x0000000000E20000-0x0000000000E45000-memory.dmp

Filesize
148KB

Download
memory/3704-1205-0x00007FF75ED80000-0x00007FF75ED90000-memory.dmp

Filesize
64KB

Download
memory/3704-1207-0x00007FF75ED80000-0x00007FF75ED90000-memory.dmp

Filesize
64KB

Download
memory/3704-1208-0x00007FF75ED80000-0x00007FF75ED90000-memory.dmp

Filesize
64KB

Download
memory/3704-1206-0x00007FF75ED80000-0x00007FF75ED90000-memory.dmp

Filesize
64KB

Download
memory/3908-27527-0x0000000140000000-0x0000000140ACB000-memory.dmp

Filesize
10.8MB

Download
memory/3908-10655-0x0000000140000000-0x0000000140ACB000-memory.dmp

Filesize
10.8MB

Download
memory/3908-27525-0x0000000140000000-0x0000000140ACB000-memory.dmp

Filesize
10.8MB

Download
memory/4504-1880-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/4504-10590-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/4504-2059-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download