dharma | hxxps://anydesk[.]com

Analysis

max time kernel
225s
max time network
237s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
16/01/2025, 13:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://anydesk.com

Score

10^/10

dharma defense_evasion discovery execution impact persistence ransomware

Malware Config

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Dharma family
dharma
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Downloads MZ/PE file

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe	CoronaVirus.exe

Executes dropped EXE 1 IoCs

pid	Process
2332	CoronaVirus.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe"	CoronaVirus.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2253712635-4068079004-3870069674-1000\desktop.ini	CoronaVirus.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2253712635-4068079004-3870069674-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\desktop.ini	CoronaVirus.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
201	raw.githubusercontent.com
208	raw.githubusercontent.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	whatismyipaddress.com
102	whatismyipaddress.com
103	whatismyipaddress.com
104	whatismyipaddress.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CoronaVirus.exe	CoronaVirus.exe

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	103	https://whatismyipaddress.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=902e9c3a0f6e6346	55

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll	CoronaVirus.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msadox.dll	CoronaVirus.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\BackupSend.mhtml.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msxactps.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	CoronaVirus.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\adcjavas.inc	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	CoronaVirus.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msdasql.dll	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.runtimeconfig.json	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt.id-AEE941E4.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll	CoronaVirus.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
8740	vssadmin.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 611159.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
3744	msedge.exe
3744	msedge.exe
1696	identity_helper.exe
1696	identity_helper.exe
1580	msedge.exe
1580	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
5084	msedge.exe
5084	msedge.exe
2332	CoronaVirus.exe
2332	CoronaVirus.exe
2332	CoronaVirus.exe
2332	CoronaVirus.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 36 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3520	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3520	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 4260	3744	msedge.exe	77
PID 3744 wrote to memory of 4260	3744	msedge.exe	77
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4488	3744	msedge.exe	78
PID 3744 wrote to memory of 4996	3744	msedge.exe	79
PID 3744 wrote to memory of 4996	3744	msedge.exe	79
PID 3744 wrote to memory of 2712	3744	msedge.exe	80
PID 3744 wrote to memory of 2712	3744	msedge.exe	80
PID 3744 wrote to memory of 2712	3744	msedge.exe	80
PID 3744 wrote to memory of 2712	3744	msedge.exe	80
PID 3744 wrote to memory of 2712	3744	msedge.exe	80
PID 3744 wrote to memory of 2712	3744	msedge.exe	80
PID 3744 wrote to memory of 2712	3744	msedge.exe	80
PID 3744 wrote to memory of 2712	3744	msedge.exe	80
PID 3744 wrote to memory of 2712	3744	msedge.exe	80
PID 3744 wrote to memory of 2712	3744	msedge.exe	80
PID 3744 wrote to memory of 2712	3744	msedge.exe	80
PID 3744 wrote to memory of 2712	3744	msedge.exe	80
PID 3744 wrote to memory of 2712	3744	msedge.exe	80
PID 3744 wrote to memory of 2712	3744	msedge.exe	80
PID 3744 wrote to memory of 2712	3744	msedge.exe	80
PID 3744 wrote to memory of 2712	3744	msedge.exe	80
PID 3744 wrote to memory of 2712	3744	msedge.exe	80
PID 3744 wrote to memory of 2712	3744	msedge.exe	80
PID 3744 wrote to memory of 2712	3744	msedge.exe	80
PID 3744 wrote to memory of 2712	3744	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://anydesk.com
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe9a0d3cb8,0x7ffe9a0d3cc8,0x7ffe9a0d3cd8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1824 /prefetch:2
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2460 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2460 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1644 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1944 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,13604399026444258876,11560126759546729554,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7220 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5084
- C:\Users\Admin\Downloads\CoronaVirus.exe
  "C:\Users\Admin\Downloads\CoronaVirus.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2332
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:1444
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:20088
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:8740
- C:\Users\Admin\Downloads\CoronaVirus.exe
  "C:\Users\Admin\Downloads\CoronaVirus.exe"
  2⤵
  PID:24388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1196

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004D4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe86c3cc40,0x7ffe86c3cc4c,0x7ffe86c3cc58
  2⤵
  PID:10636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-AEE941E4.[[email protected]].ncov

Filesize
2.7MB

MD5
a783bd6014bdc92c372c8d270a824f35

SHA1
a64a0344403fbeca93fb8304ac2bb5607f759e0b

SHA256
1550b5bfea8bdc806d6f75258cc26fdf00f2761a6b8fc1033e717561922679b0

SHA512
ff38755ec4d4374ccee92369522197852c5f5acc0008f971e4462ccd2d1bdd97bf5665f91a86398fe7a78f5802bf27041e2a7ef6f7e21441ca1a5802537c73b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
98bb667fc7d700c6b6144094a975d080

SHA1
ea1dfb79b1db7e3973a14a32085445fc21531386

SHA256
ff23a8c24c462246355cd95d7be8ec577adfa213f5394990f7312090cbc08224

SHA512
473c734953eff7ed5e371c5b6db90e4ddebd0c0ddc67da0b4196dd7bc61c683908dc2b0fc90b324190377e8ad52c67e35b2d5752ea0744f77f18ad77df34a8ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1544690d41d950f9c1358068301cfb5

SHA1
ae3ff81363fcbe33c419e49cabef61fb6837bffa

SHA256
53d69c9cc3c8aaf2c8b58ea6a2aa47c49c9ec11167dd9414cd9f4192f9978724

SHA512
1e4f1fe2877f4f947d33490e65898752488e48de34d61e197e4448127d6b1926888de80b62349d5a88b96140eed0a5b952ef4dd7ca318689f76e12630c9029da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9314124f4f0ad9f845a0d7906fd8dfd8

SHA1
0d4f67fb1a11453551514f230941bdd7ef95693c

SHA256
cbd58fa358e4b1851c3da2d279023c29eba66fb4d438c6e87e7ce5169ffb910e

SHA512
87b9060ca4942974bd8f95b8998df7b2702a3f4aba88c53b2e3423a532a75407070368f813a5bbc0251864b4eae47e015274a839999514386d23c8a526d05d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003d

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000043

Filesize
47KB

MD5
0d89f546ebdd5c3eaa275ff1f898174a

SHA1
339ab928a1a5699b3b0c74087baa3ea08ecd59f5

SHA256
939eb90252495d3af66d9ec34c799a5f1b0fc10422a150cf57fc0cd302865a3e

SHA512
26edc1659325b1c5cf6e3f3cd9a38cd696f67c4a7c2d91a5839e8dcbb64c4f8e9ce3222e0f69d860d088c4be01b69da676bdc4517de141f8b551774909c30690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000044

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000046

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000049

Filesize
26KB

MD5
5dea626a3a08cc0f2676427e427eb467

SHA1
ad21ac31d0bbdee76eb909484277421630ea2dbd

SHA256
b19581c0e86b74b904a2b3a418040957a12e9b5ae6a8de07787d8bb0e4324ed6

SHA512
118016178abe2c714636232edc1e289a37442cc12914b5e067396803aa321ceaec3bcfd4684def47a95274bb0efd72ca6b2d7bc27bb93467984b84bc57931fcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004d

Filesize
20KB

MD5
9fa1d3f7af5bcfd56f11740a34493830

SHA1
8f9d54966becaf8258ee12f4a46a11c4a5bb85f4

SHA256
06825f5f6446574d85f5b01a90c29e40b79b0b060df38c68fef5e32ba49fc398

SHA512
ee35646f3326aea20eae0180cadcf27ee20a67fb87924e4331ae432c851e4c74b71490f004cc970a3b7a502a0400f501caf81f7773127da920db38a583e9fafc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005b

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005e

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000067

Filesize
79KB

MD5
fb92173b3e870cce08e4a2fcd1565b43

SHA1
239cbae716faf8bef2caf858d9cb239a1ca25ddb

SHA256
7018fe402b1ddb00a5e3bff0d0808023d3c7443c211cdb0a9606eba423a8a12e

SHA512
7c6f093bea666e281e6d78e41b7b0230343664b393ba1af7c2a97d42b24c1514b9ef3581f7a8cc508cd5a63bf520e985858c7e5d7f9580e389e2d88a787e2531

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000069

Filesize
134KB

MD5
cba8d1658ecec84a7149b3042c08e180

SHA1
8ff773b8bbd3d37c3c2a6d638c124bb35f950106

SHA256
d461a97cec265ad4fa7b153ed9f61de40c1e563ed586d24b54a6f3da24e0db84

SHA512
1316c54a558c33d571d547e16765a9685293ea4a2c0f0f9ea6e3a6e36b23040a2086ed04fd35c332516afc70a34f3b7c6bdc5b55b413cabb42dd98ac17524289

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006c

Filesize
43KB

MD5
3e62e7ce82d1727d41a251d07c15b92d

SHA1
bdf11e48353017d902ecd5e5b8a3b8e652c91440

SHA256
5110817fb07ac516e0582e4003a7096dda70d98d9eac60eac35d7b31e27c0f25

SHA512
8a2a5aaa3fe39a4fc47ed338ab278d685e78dcb0605b47a3a719e77df072f91a2807ff162c9d6fa9fd019fabcb8f83e3fe287f29925b309742fc0d3b476f7eda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000071

Filesize
16KB

MD5
d29585871601b4333e5e5964a9910dda

SHA1
53b0bea6f770a0bdcfc38a75d3d811e627de9c98

SHA256
7bc183a5f36b1a2ef1908526b30dee3ecf77d24018145048eb1efc067d304805

SHA512
3ca4be7c7838e7ab780fb6bc94266a6c0221ea659cad354e3553af6cc792eac0d239989818a632fc645469e68d37cfd619355670fb0e778f36a2fe67a52bd0c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000072

Filesize
67KB

MD5
22c04a443316a8f19693fe1cf72a57c7

SHA1
79ebd5427d791f4b85759c520dbb17eafaa089d8

SHA256
4bed01f2abeab6a751a08ee43d8499ffef3aa8a42c4c41b082fc4047968f10f9

SHA512
1acaa0bd5c5e56569f634fdbb39214b3217423f5935dea8d1abc408efa5cdd730d1ed4e02cddebb4590753cb852ff2be46793223429777960e83d378907efd1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000073

Filesize
33KB

MD5
478288618e61a65b98e111983ff3b807

SHA1
a7a436ffb790580c268547e764c7b67aed1ec0e1

SHA256
4d0dd8bcaa91704cf5fad96706141ef8e38f2f31f4011b6baee286ebbd97fb71

SHA512
fc09b4b14a8e4b114705b6b348e28efba84595a9855b83489012aa1e0f8ed41ea6f26eae697555b3faa1b459013e7282e1925826a4aa8e62b0c9f6f00fb58e99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000074

Filesize
155KB

MD5
d49abb990421fc54f807d208636afa82

SHA1
dd89dad898189bab3968d0aaab099d6be0690b88

SHA256
ecf0873b4e5f03f88b4c5d8d71b06e7dcc581b60e63004178885ee1d3f6a5430

SHA512
b13919e6d9983545449fb0ac6d99e98fa4b89c6f8969f9342438c366bd0a670eed4f89b7280c4f557c72329a3c49f662addb2a010df7cfd807c02b776d0b9a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000076

Filesize
118KB

MD5
1cf3a9feb94274473ead701aec93131f

SHA1
f48b82a562dbcd0e8fc6993705879902f844ba6e

SHA256
06ab15430dc578f765ef289c95362784847067f48906c951ffe5d7cf9848e66e

SHA512
01d35026e6bf485a4e90a9a97f29be66f20fb63ad9f8a4f7e1e5e249e5fcec8ee774df3d03332e3314231b33ac8c0f2b02a59da47474ee1282b6b3065b1efdd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000077

Filesize
165KB

MD5
eca6ea0421018fa5e6833c043cb19b9e

SHA1
e366f50a3c9ac89e5eb96230d7cbcd3f618c9b39

SHA256
9611f797758d8cf61bda3827953cdb5ad4039ce7567de17919231ea668194ab8

SHA512
99e0c769834657db3963937e2f52eae4f1cf5d420aae124ccec30a2dcd574cac4397bbc24f2c23725af32a7558a034cab0afb90d63d92f4b01aebd36114062eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007d

Filesize
215KB

MD5
d474ec7f8d58a66420b6daa0893a4874

SHA1
4314642571493ba983748556d0e76ec6704da211

SHA256
553a19b6f44f125d9594c02231e4217e9d74d92b7065dc996d92f1e53f6bcb69

SHA512
344062d1be40db095abb7392b047b16f33ea3043158690cf66a2fa554aa2db79c4aa68de1308f1eddf6b9140b9ac5de70aad960b4e8e8b91f105213c4aace348

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007e

Filesize
41KB

MD5
3bc2b6052ff1b9feff010ae9d919c002

SHA1
dd7da7b896641e71dca655640357522f8112c078

SHA256
483a3494759a05772019e091d3d8e5dc429d098c30007d430639926c3ffa16e5

SHA512
0b1632b73fd87e8e634922b730f83b7950e9a39697a46a3429f0bebb3f1ebd14c815a4651ee8f663a437d00ecbeb6ddaa47b2fcad719777edf1b1de8a7cad0f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
0352cd7c82f135bc4b675b6043c9176c

SHA1
ab83fb28f2d6b05164489f57dda8d91be050d857

SHA256
4895bedac9b8cbf5a6adbb760fec783000ae41a2492057e7ee164837ff7e1447

SHA512
ddcc8016f4263ae4d594822d84384b48ca7191ac0f7e56edb837cb06e3e9de06aba944cdb6b648991b0ef2e1e9be5849cf0e75dec689cefc02b76394d2c66580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
33bb39e7dffd5e5d5dbca254c0e416d2

SHA1
9c28fa36937c1441f5dd06d937ef4d4604e5ee0b

SHA256
74bde032d31b5d0718367ce06a9266dc02c433fdddc0d85ec18439a22595d269

SHA512
79316057ede7619f5a5eeee3235281a3c5c6d83642aeba38d1613863d2a585634570094cc50039cc47bf29f0f51335b1b548e165bb35148060d075f541b17332

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
63436efabe21e674032e9a71325f4dd4

SHA1
5d0369b11819629d70cce130d62b778333cee7b3

SHA256
eec2a72c225cfe2c63f3dbea59899364345341783f9cb2cf961eda41f989f2be

SHA512
87a79b8cb5c3142783a9ca35288d5c3065dc9d1397b69dc67b73a6b451455e1d66077102768409f7d420cfe646066343fff80b069ecde6f7fcb1735f5c7f3e61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
ba4470bd783b5018e71716b10dcd07df

SHA1
1a4e3df0d3504dd4999a14dd79df45e034e5a6ef

SHA256
e8af2cb77853364551f2fed8b7a1bf34ad18863621593c68a8e4203425ffe20c

SHA512
bb4d710b89ac800b180c3a5ecabc53e93f29069d749177d2b241c4e24f1257b62814343c6349ceaa53d2c5f646fda347c9db295fd23045bb598df54202507a9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
2afe68e79a3755526579676af32ad3d7

SHA1
0e436b0175c69f78e1662e496e5f19836b2163a8

SHA256
a6885dcb04d03da79033dd96024f52863118cdf72963454f6776d88b03d431c9

SHA512
ee7e5e27061fd2a178915ea43b0fb8bc923ba93d95dee47b8c55d383dac7a7080e695c5d12d0e3b507ba4c2f9d8e64e38f64c875ab47c02872f9e2a39a4a8028

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ba9a4673618362a1fbb5d6ffac7f05d7

SHA1
757289ced1de912c3b7098da6f541e771797cdf7

SHA256
42a09036ac16b88e9880678026c386df78714c5b41cc36e3267ce0af874bc482

SHA512
a1b19f66e9e4596a4cf7eaf7f8088a88af47020097244ee40502ac2711325928673213a0df03bf5792fdefda36d63181139762cb30273b67c41a81faaad7c646

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
779ddc9127e8ba5a67849af778607210

SHA1
1497c5669753d800a9bcb902a7765326128f3704

SHA256
51ccb736ca373744aab27fd2d0b749b563445d772b045aeb84dd416f57404ffb

SHA512
a6d1e9797bdb6ffcabbd2cc665492bf1d9bb9a0e31b1df8bd2101b6eb4b71db3883985bbc1074846bf3701d4271bb472016d2981114f0507a87b8d0f9ce3e7ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
4009dfe26016598f658303c956387878

SHA1
0c60bbe0646e171e82050c9e239faf35cbc32bfe

SHA256
d18c768b47c2741bfd4271e1518460154a5866c62820ce84ccf4edaef958fc90

SHA512
587c93e510aa26a1909d6be9dd8505e609ae26d2524d418708f7dbe817e0af4d62a54295ec4f090955f8f415b0357800882e394722e068b4fb799d43f76ee4b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
08b1463a985cefe20af58b2a758c0555

SHA1
8590264982225e45d62cf32e624a56c48f1afb33

SHA256
c2c95226bac1bb08dbc9064a322ff7a34440a5fc7eed1b1ea97a31cf026d583d

SHA512
3d411375892a85eed7994a408dabfb28a0cbaa1bc21aabeb05e59764fb4a812e1b5bdb4e932fa09041c2d92325d11462df4a516652be924d82ba986a2ad670a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
bb45ae3bc60ec4cd066860afdf1d8c03

SHA1
601ccc70c9b092d3cc6e8a71f6f382591d832425

SHA256
dc4556f78a2b8eb2865dbba5ea53bb7c69509f1650ff99e52326ac009af16081

SHA512
b2d9eedfb7eedee8994944050d7ed86fb8ff5a9a9b04d24f43cc38f7a079dcf4f9a65bafe169a756e2959ff48bad409f16f04b1a90cfec80a5d0ce08d055f2b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
487becf57c82b4434d885514019c31c4

SHA1
00f3ef879e6cf4da57ad91d97761b379c2ddbefa

SHA256
05455d5cad25b85bba4561edca9f2f482b7562763a1879359d07f68de7150bfa

SHA512
14b7e283d4ff8df77bdb61bffd64a0d3b2944ddfda80e08f5536dfb3ddc871c5d9b727d3c295e35c99605afda03d195943f90a51df860afef55c354c29317e96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a070bf5fc50c109d7f83e4ee6a61b560

SHA1
a4b5a3aaed6f37600393622c9fc7769cf99657ad

SHA256
0082798b30e2ce038e7d22cb5ede1598f8575f8f1efed3647461314513926ab0

SHA512
d26b3fc2b1db7159d03995343bea6cb7fc971d3df290805b0530fbced18757aadc71a2bee12dd6d87476cc5654f0d0ab8486a1e7134af6485b1649054c7aab55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
b432f2abf16916dd234c7402e2fadb95

SHA1
1384144bb3be0c5e4ee1ddca3803c7d6f86f5d6b

SHA256
9dc05b8f8a453aac1fe4f45fd9ba30d4bef3bb042b23926f8fecfaea5e704c86

SHA512
bd46d293c7c92b5a861e4a5db5f47e3839860f5c056880706272f6765757fc61f69332b5e40b88f99f528e476d2f29d42aa86402f9a6010bb817bc8d2b494f5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
e3efa43f3ac2c1be7e3ee620c2e458b0

SHA1
f3e06285dcf6676553b51dca8912a50237c8a6b0

SHA256
9494a71a10b07926228780f5549e973951304249ebcbbf2464b2f50acbbaffb2

SHA512
4162053ea93994f8474d48787e4b0b2c1f39ec27e2e1cedff94e7280ec53d3fc6e8dc5e82ba6dbb13840ef548320a5cd92e45cebd5480fca5a20431966f223af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
01636e9efce99976d2c66054d80b2b48

SHA1
2cdfc07cc5ba8113f09aea3a2e68ec04cdc691b2

SHA256
140e5167d7af443a739955fc9cc5871c8e2d05ac0d660b1c6162d5d2a2559cd2

SHA512
017ba2dad29ccecba67fef9f0aaa1cfcb0509917c9818505f2e577702d682e99d1d4a4e1b874dea9cc28debac2fe07c5b0bb781f94385a0e589c5309be3d0b17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f4d50a1efd36d10f7b82f56d0c9f4a35

SHA1
853d3ce7a9d092df64f566f55e2fc2826ba16b48

SHA256
0a94f7b8da5fef2918e70d5978e99b8b2e2c2c6a2a968f6e565fc501c0b3ba54

SHA512
ecfb859bd3551336f1d2c55eebfc82aec0bcdaa3e89071d8e4919212120c4be838e82b76e1acafd40779234b0a298e7beba713f843f83634fb76e42dc837b86a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
41c0f32edc2459181be3e21084333b51

SHA1
c0d35c7aaf935ff1c6ea453e798b57b3bb3374b8

SHA256
07c0cbeae90d30c0d4bf5ee762afeff9b79e9d92cd160b2b9affe71baaabdf02

SHA512
f0a329d3d52d0ff6ef852e949cea7ac56f989e2f7ec866316ea15151f4bcb45793b38cdab23ee0cc0ca1e07fd2efaf6e3d992b75ee65e8be0be2cb5bc46a544b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
c188cd8d0eba4de2e33fc0c756259128

SHA1
c04480f91b4c46f20c4aaab76d752a1d0305f66f

SHA256
16f1ef4d8a8d0195ce4d20917f21961cf09db2fde8e6ec0811d133ed5ff90243

SHA512
0fab774e2b26ff1d3067ed7f11efc665cdf8c2e9b010d91a19570be816dcd20cf2e4caffdbc2a93945d6ff047215b1c2f5822c1eb0897d84199a4b34adfd451d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\ae689a2144e9e24bc49282f4757ca91c0bf7f5f1\index.txt

Filesize
86B

MD5
21e04e81196d09582f9b88fdab109f29

SHA1
bc0bf18ca3b6430127220db9e7db2c1840968a7b

SHA256
6b5af1d2976ca38069275ae22ae8db023c4880d007dfbf06f4a490a22024eb46

SHA512
bc34369006b307f3c1867aae2b81038d4493bdb7e9002cd34a86c07df39e42591ac87f47a9ee249d47b4391e2c28e27d8500c09cdf66963194019b03f6ac9ee9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\ae689a2144e9e24bc49282f4757ca91c0bf7f5f1\index.txt

Filesize
79B

MD5
1895bfa7f3582553efe886c7c6103399

SHA1
dece2e8fb82333b2505d72e9de727c6b82ebec70

SHA256
7d17798388f3015b456472feb77e572357f9d962f028499ae046ad10af22fd34

SHA512
c1b400b5c0059243354278efa6c44769a969271f773a16bd08bff512237252be364b0e2b88010cdc88e556310990a654ef18558028fc8f49536a8ce626860cc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
3357a80886580761b255936d758a8961

SHA1
436f84decf399ef273af97c88511d6b331927f43

SHA256
007290a03793f4760f07998433624fdcfde2c3964406eb5744d41ec349bcc358

SHA512
e128f6226d28ab92287b377e04fef93a5a1a758ba5ebfe0466d7b21218539ced2038191559720c818cc6a1becca654645c2d98ad0fd912c1458b7d9210fc9d8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57dac0.TMP

Filesize
48B

MD5
069b40411e94c1979257f5e203816b39

SHA1
a32d31d8ba76887f34ba1ae9347fce7ed753f608

SHA256
5b7c33f0d3c7c4e7c5be312decad40ad1b31297b209d825aee406c1f3a4ff3ef

SHA512
90576eb957766cf97ac2069d499f95b45c3caa7015fa230155b454c3cdb3939a2b390cc1c47b640d250d46b07477af5bb86b5736c81ad0d23e2a5cd2effb8241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
442f16fda9091a1624020ba6cc199036

SHA1
24e001d7da1ab457c7e782b8886f7b0668bad471

SHA256
c5f3b89a56da25a7e9b7bdc5650de81dc5c2aab92f6bf2ac1c9e66250465a5cd

SHA512
82aa6a8e828b3949c52bc00048211dd9cf1e919e726f440fff84e69a4575184045c73eb4503277addcc6054ae200d55eb19747ae882bd3fb692f7788c012d5bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
57bc79daece6cfad701fd66ec0ac7a51

SHA1
2a22ae522ac63911bbe80f8fa4afff6eed0de10b

SHA256
3ab5cb9b2b2b9aa4dd8938e7c605cab3ece60085f4834ddc272993a9be8c3d8e

SHA512
89752d76e28616d8926792a6c9a3f273001f81f71754b00a114646840df2668695f5b3f0c5a5f7fc00087b93a3fc72e57ad97cd4f80105a0891d3a27856071da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
662784ba04ba64e4c2fe3507053a6b68

SHA1
fda4dcbaa1893ee6fc4b96a1ee05a571aed6f460

SHA256
3161d4f7b43abd0a7719bc921be0da5e77521464e0bddedf226035827a9c8e44

SHA512
47be64447b3de1059a5e0f2d6676c989c549dd45148ce448b3bde399a7109610c4080d5603c3537f1e3915d735f766c3a0cd0acbde115286e4804ee05b906097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
69ab035d0e748a29292ac86451254916

SHA1
19b458eac8a1565c4809963255cc9c520b2df0af

SHA256
59f194a7a539df37cf5b213e5d77c9cecdd5077b4d1af47674b7412a6ed0c205

SHA512
1fb3f0ad2c4c4c577b1ac0b122eccabf906515eb473faab8222a5901247cb8462a3de5b54573aac04905f2b69d038b22fcf2005c686ed5fe8b1291a43678e194

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
4175f976210dd7884e4528ba987719b8

SHA1
032b39b8489d7299c216292a5bdc5cff95a30fdd

SHA256
e33d9043230d0165648cb597c3bde8b0e65d10f8352fab038b8bb3e339a5bb1e

SHA512
ebc67ad20214aff7590141354b4d2f7c1188cb2fc1f1d8ffc207dfa6b7d6f57c2374cfe2abbbc445fa71e88ff00f5a3e99b0d3da40fd75e86701dce4953c46a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ff0b0d549a695513c00710d62ce4b4a7

SHA1
991641724644b3fa1223e39158f96ae5a2974691

SHA256
aecc42f8217f018e949f5f7b796d971d87f8f35872d22b9dcdab7452ad9a6b02

SHA512
b61c6a3b1fbc4bfe6cd6f14b795a47a20012ac0d605a145388b7c0ca0a1d473420a3f07b5fca2b9db33c242970f5b5d35c2acf13effbe4c6e109f2b0e62dcbfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
eef3e37fa90452f9f04a4e460a8132fe

SHA1
22920bea4dcf61c890a583ad5482ea4a996dec4e

SHA256
98600b8eed35e96d55c4616fbc72d01ce2ee3309ee7cc8b45161776cadcefff9

SHA512
f3ca2320000be3a398c4006cfb0a9c4aa79a6af9e3ab3e191899dd748ef93117aef70ba216487d42b7290e00d3d018c19180e417bc6cad031338412f9c9bc0b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c2962f99870920accc9f28f7f896f849

SHA1
d041a7e88f4ca68ad525a6364ecb5b2179af6b5b

SHA256
c2b3fff426557860c13f0e451e4922c3d63e0d7b1ef75e046c8eb7c4d1b6785e

SHA512
050d1a7145767a982103224d923c8b7b0e60f125f41b5edfbb12dcd7ed7632a6c1f5f4b589ca6c00efa305daf72b3ee3330b4ef4417047c1c1d2340a153ae402

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
1cb4d4172f05d9e725b6241e519425fe

SHA1
0fb4d34fa06dc71ae9d37077ca98e4d0522ac718

SHA256
3a3bc1e5231cdfea388ef8dc628c68e0c6c7551c2743b7659c70c50d68a72fc5

SHA512
e18153578f9cf1ed4e08aec7f20c9bb34afc6ab29fd1ccb4b05fff52db6220a6c88d6f08bb770f2a273f2c9bcb90b14da9102cdee6b41522739505d0b7a76ccd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
340b5e1125814f6c7c987663dcfc7264

SHA1
31316f655a980ab66b4eb272aa2d24920d0f15a1

SHA256
b1f925651de3a9e235875d6393e569e4d91e233e05f2993818d39f723a56ad0a

SHA512
205f6d95cc891f1e878dadaa87740c6f430c00c2789922527fb63da7acba5a0c05f9b81e413b12ae157c8e6c1a3728099997b8c1f24cd384cfb888e1824bbdd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
a50294af4acda5db140255c29b8a735e

SHA1
a0c74c3b70237ede1ebbe7dd9312e9cb73243409

SHA256
b44c832aae09fb5cdd668234fbca35dc8db980eb91f1670bf7faff871916dc9e

SHA512
c132ee568bbd57f1d4ad39ea743efa0ba1e2110db56b97722ce512c605d1a8a207cd797b1bc136734aed7e81049f500a26eff45b7ec3748ffc0750dafa46c440

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
890af4f9d513d3122c9260a6a19fa214

SHA1
dd793b71434cbcd5e765498cd5fe039db5ab7029

SHA256
0624d093098cbdb544f5fee35fc31b6a287056a2f64e1eb7791ed00263a911d2

SHA512
b94cd5fb17e5c25ff1d230072e2542ac45f73e9f2c109b000dcd54a0d22236897b395cd1b053298d063cd635f7fd2e713058cc45b8afa254079b7e9c913a1f07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57db0e.TMP

Filesize
2KB

MD5
4e17d1e92b60231e39e6f162de0f257c

SHA1
bcfeac72477856c83e6abcdbcf1065df79ba871b

SHA256
b1418742d1103fbd255e557c34a57fddae2f6047bf786464437214c6e3bc1e36

SHA512
d4fa01d4c9418efc5c0724c51ee463773844f3e30194ab2f16c8cc148ffcc79e145c02cbe09a893ddc2cea5f1f8330afd3f03478532924b0b255223fedb85e5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1c4c9b70fa9399fca412fa44bbfdecd0

SHA1
29d70ebb5fc39d0643db05de45d14073d7e96231

SHA256
5078b69a339b613be13ad9d6ad92cd18caf58561da6ff883d699efb499f22371

SHA512
fd13dc02fefb94a618bd9b674aa3ebd41f8eb495a62369c576329b4c287c487526645091579122b45e425d6390686e314c739ef6a73046a123813cef1c47c746

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b467004ed866efc0bd318e4f0aeaf280

SHA1
a774a7ef5b9c1a08d4c6baf9ed98aff10f31c09c

SHA256
1065cc76be2cf5c345281f80a194364b7675855e0b2e54131c1f3ae82bd04355

SHA512
192b43c506ba3fd0f333a455747c0af9a59dad5b92a3f6bfa3e1bcbccddbf28e00b25f53ab29df44c46f1a09887e82c0bffec26af6bc004f0dc68ac80a49f158

Download Submit
C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 611159.crdownload

Filesize
1.0MB

MD5
055d1462f66a350d9886542d4d79bc2b

SHA1
f1086d2f667d807dbb1aa362a7a809ea119f2565

SHA256
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

SHA512
2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

Download Submit
memory/2332-1958-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/2332-1959-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/2332-6929-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/24388-7010-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download