badrabbit | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

04/03/2025, 22:58

250304-2xstpaszes 10

04/03/2025, 22:56

250304-2wycsaszdv 8

Analysis

max time kernel
630s
max time network
628s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
04/03/2025, 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

badrabbit dharma troldesh credential_access defense_evasion discovery execution impact persistence phishing ransomware spyware stealer trojan

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Badrabbit family
badrabbit
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Dharma family
dharma
Troldesh family
troldesh
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (674) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Blocklisted process makes network request 3 IoCs

flow	pid	Process
853	6332	rundll32.exe
889	6332	rundll32.exe
920	6332	rundll32.exe

Disables Task Manager via registry modification
defense_evasion

Downloads MZ/PE file 6 IoCs

flow	pid	Process
334	2336	msedge.exe
34	2336	msedge.exe
34	2336	msedge.exe
34	2336	msedge.exe
34	2336	msedge.exe
662	2336	msedge.exe

A potential corporate email address has been identified in the URL: [email protected]
phishing
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	CoronaVirus.exe

Executes dropped EXE 26 IoCs

pid	Process
2968	AdwereCleaner.exe
3132	6AdwCleaner.exe
7112	iExplore.exe
6168	iExplore64.exe
4860	BadRabbit.exe
472	75C9.tmp
4600	BadRabbit.exe
6368	$uckyLocker.exe
6240	$uckyLocker.exe
2304	CoronaVirus.exe
29960	CoronaVirus.exe
11784	msedge.exe
33520	msedge.exe
8532	msedge.exe
30868	msedge.exe
9844	msedge.exe
34316	NoMoreRansom (1).exe
24352	msedge.exe
23792	msedge.exe
19892	msedge.exe
18288	msedge.exe
24788	msedge.exe
7064	msedge.exe
26520	msedge.exe
27452	msedge.exe
31548	msedge.exe

Loads dropped DLL 16 IoCs

pid	Process
6332	rundll32.exe
2912	rundll32.exe
11784	msedge.exe
33520	msedge.exe
8532	msedge.exe
30868	msedge.exe
9844	msedge.exe
23792	msedge.exe
24352	msedge.exe
19892	msedge.exe
18288	msedge.exe
24788	msedge.exe
7064	msedge.exe
26520	msedge.exe
27452	msedge.exe
31548	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	NoMoreRansom (1).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Windows\CurrentVersion\Run\AdwCleaner = "\"C:\\Users\\Admin\\AppData\\Local\\6AdwCleaner.exe\" -auto"	6AdwCleaner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe"	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	CoronaVirus.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3449935180-2903586757-2462874082-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3449935180-2903586757-2462874082-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
34	raw.githubusercontent.com
291	camo.githubusercontent.com
662	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\CoronaVirus.exe	CoronaVirus.exe
File created	C:\Windows\System32\Info.hta	CoronaVirus.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Control Panel\Desktop\Wallpaper = "0"	$uckyLocker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Control Panel\Desktop\Wallpaper = "0"	$uckyLocker.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarFirstRunLogo.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-black\FeedbackHubAppList.targetsize-24.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\ui-strings.js.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected].[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-cn\ui-strings.js.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Updater.api	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\CertOriginUntrusted.png	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART12.BDR.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\System.Xml.XmlDocument.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\KeywordSpotters\es-ES\Cortana.bin	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\FM20.CHM.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleBadgeLogo.scale-200.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.targetsize-256.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-disabled.svg	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\main-selector.css	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ppd.xrm-ms.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-16_altform-unplated.png	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\ui-strings.js.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\PREVIEW.GIF.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-commonjs\createTheme.js	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\selection-actions2x.png.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ja-jp\ui-strings.js.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libchorus_flanger_plugin.dll.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Linq.Resources.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\TipsAppList.scale-200_contrast-black.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-72_altform-unplated.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\DocumentCard\DocumentCardLogo.styles.js	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@fluentui\dom-utilities\lib\index.js	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\SetupMetrics\4692_13384298657373279_4692.pma	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\progress.gif.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Design.resources.dll	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\ui-strings.js.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationFramework.resources.dll.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_proxy\identity_helper.Sparse.Internal.msix.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\msedgeupdateres_sk.dll.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-16_contrast-black.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxSmallTile.scale-125.png	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationFramework.resources.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Xml.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\msipc.dll.mui.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\trdtv2r41.xsl.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-72_altform-unplated.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-il\ui-strings.js.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.manifest.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\Microsoft.PackageManagement.resources.dll.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\msdaorar.dll.mui	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WordCombinedFloatieModel.bin.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml.id-1A97326A.[[email protected]].ncov	CoronaVirus.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\75C9.tmp	rundll32.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 6 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\$uckyLocker.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\NoMoreRansom (1).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\AdwereCleaner.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\iExplore.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\BadRabbit.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$uckyLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$uckyLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoMoreRansom (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdwereCleaner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iExplore.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x001b00000002af53-263.dat	nsis_installer_1
behavioral1/files/0x001b00000002af53-263.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
26568	vssadmin.exe
10496	vssadmin.exe

NTFS ADS 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 918493.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\BadRabbit.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 302771.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\AdwereCleaner.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\iExplore.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\$uckyLocker.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\NoMoreRansom (1).exe:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1848	schtasks.exe
6408	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
2104	msedge.exe
2104	msedge.exe
1096	msedge.exe
1096	msedge.exe
1416	identity_helper.exe
1416	identity_helper.exe
4084	msedge.exe
4084	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
6772	msedge.exe
6772	msedge.exe
6168	iExplore64.exe
6168	iExplore64.exe
6168	iExplore64.exe
6168	iExplore64.exe
2508	msedge.exe
2508	msedge.exe
6332	rundll32.exe
6332	rundll32.exe
6332	rundll32.exe
6332	rundll32.exe
472	75C9.tmp
472	75C9.tmp
472	75C9.tmp
472	75C9.tmp
472	75C9.tmp
472	75C9.tmp
472	75C9.tmp
2912	rundll32.exe
2912	rundll32.exe
580	msedge.exe
580	msedge.exe
2876	msedge.exe
2876	msedge.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe
2304	CoronaVirus.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 63 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	3132	6AdwCleaner.exe
Token: SeDebugPrivilege	7112	iExplore.exe
Token: SeDebugPrivilege	6168	iExplore64.exe
Token: SeShutdownPrivilege	6332	rundll32.exe
Token: SeDebugPrivilege	6332	rundll32.exe
Token: SeTcbPrivilege	6332	rundll32.exe
Token: SeDebugPrivilege	472	75C9.tmp
Token: SeShutdownPrivilege	2912	rundll32.exe
Token: SeDebugPrivilege	2912	rundll32.exe
Token: SeTcbPrivilege	2912	rundll32.exe
Token: SeBackupPrivilege	11472	vssvc.exe
Token: SeRestorePrivilege	11472	vssvc.exe
Token: SeAuditPrivilege	11472	vssvc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3132	6AdwCleaner.exe
3132	6AdwCleaner.exe
7112	iExplore.exe
6168	iExplore64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 3688	2104	msedge.exe	81
PID 2104 wrote to memory of 3688	2104	msedge.exe	81
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2244	2104	msedge.exe	82
PID 2104 wrote to memory of 2336	2104	msedge.exe	83
PID 2104 wrote to memory of 2336	2104	msedge.exe	83
PID 2104 wrote to memory of 1508	2104	msedge.exe	84
PID 2104 wrote to memory of 1508	2104	msedge.exe	84
PID 2104 wrote to memory of 1508	2104	msedge.exe	84
PID 2104 wrote to memory of 1508	2104	msedge.exe	84
PID 2104 wrote to memory of 1508	2104	msedge.exe	84
PID 2104 wrote to memory of 1508	2104	msedge.exe	84
PID 2104 wrote to memory of 1508	2104	msedge.exe	84
PID 2104 wrote to memory of 1508	2104	msedge.exe	84
PID 2104 wrote to memory of 1508	2104	msedge.exe	84
PID 2104 wrote to memory of 1508	2104	msedge.exe	84
PID 2104 wrote to memory of 1508	2104	msedge.exe	84
PID 2104 wrote to memory of 1508	2104	msedge.exe	84
PID 2104 wrote to memory of 1508	2104	msedge.exe	84
PID 2104 wrote to memory of 1508	2104	msedge.exe	84
PID 2104 wrote to memory of 1508	2104	msedge.exe	84
PID 2104 wrote to memory of 1508	2104	msedge.exe	84
PID 2104 wrote to memory of 1508	2104	msedge.exe	84
PID 2104 wrote to memory of 1508	2104	msedge.exe	84
PID 2104 wrote to memory of 1508	2104	msedge.exe	84
PID 2104 wrote to memory of 1508	2104	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9be4e3cb8,0x7ff9be4e3cc8,0x7ff9be4e3cd8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4084
- C:\Users\Admin\Downloads\AdwereCleaner.exe
  "C:\Users\Admin\Downloads\AdwereCleaner.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2968
- - C:\Users\Admin\AppData\Local\6AdwCleaner.exe
    "C:\Users\Admin\AppData\Local\6AdwCleaner.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2144 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7188 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1892 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7428 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7832 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7976 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8016 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8272 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8276 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8604 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8764 /prefetch:1
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8752 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8624 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9036 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9284 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9152 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9424 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9688 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9744 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9712 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10120 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9680 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9708 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10412 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11024 /prefetch:1
  2⤵
  PID:200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9440 /prefetch:1
  2⤵
  PID:6488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:6640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8360 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:6772
- C:\Users\Admin\Downloads\iExplore.exe
  "C:\Users\Admin\Downloads\iExplore.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:7112
- - C:\Users\Admin\Downloads\iExplore64.exe
    C:\Users\Admin\Downloads\iExplore.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:6168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7400 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8000 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10784 /prefetch:1
  2⤵
  PID:7052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=11628 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=11468 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2508
- C:\Users\Admin\Downloads\BadRabbit.exe
  "C:\Users\Admin\Downloads\BadRabbit.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4860
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6332
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:1496
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /F /TN rhaegal
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4104
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 2347756878 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6220
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 2347756878 && exit"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1848
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 23:20:00
      4⤵
      System Location Discovery: System Language Discovery
      PID:4136
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 23:20:00
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:6408
  - - C:\Windows\75C9.tmp
      "C:\Windows\75C9.tmp" \\.\pipe\{313C5114-A5E0-434C-8EEB-9C71983F219B}
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11736 /prefetch:1
  2⤵
  PID:6916
- C:\Users\Admin\Downloads\BadRabbit.exe
  "C:\Users\Admin\Downloads\BadRabbit.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4600
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11556 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3472 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9704 /prefetch:8
  2⤵
  PID:6752
- C:\Users\Admin\Downloads\$uckyLocker.exe
  "C:\Users\Admin\Downloads\$uckyLocker.exe"
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  PID:6368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2456 /prefetch:1
  2⤵
  PID:6196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=11580 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=11528 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2876
- C:\Users\Admin\Downloads\CoronaVirus.exe
  "C:\Users\Admin\Downloads\CoronaVirus.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2304
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:5884
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:20160
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:10496
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:22420
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:28284
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:26568
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:10316
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:11972
- C:\Users\Admin\Downloads\CoronaVirus.exe
  "C:\Users\Admin\Downloads\CoronaVirus.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:29960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11504 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:11784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10020 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:33520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9448 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:8532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=11492 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:30868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3856 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:9844
- C:\Users\Admin\Downloads\NoMoreRansom (1).exe
  "C:\Users\Admin\Downloads\NoMoreRansom (1).exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:34316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10952 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:24352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10872 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:23792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11844 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:19892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7628 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:18288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:24788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12156 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:7064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11704 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:26520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:27452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,138653312402033348,8452132126784429838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11488 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:31548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3728

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x000000000000048C 0x0000000000000484
1⤵
PID:2052

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\e954b68d44fd445789d21383d4675aea /t 568 /p 3132
1⤵
PID:2476

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6260

C:\Users\Admin\Downloads\$uckyLocker.exe
"C:\Users\Admin\Downloads\$uckyLocker.exe"
1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
PID:6240

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:11472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.dll.id-1A97326A.[[email protected]].ncov

Filesize
2.6MB

MD5
2a41597d170ab84bd880e24e24dd0a61

SHA1
19512ec53988309836248459d56429823e3205f6

SHA256
2a35304b8b19f700a532399890fc147c62c018f0bf9f0cc3035a0c5143eb09a1

SHA512
c67f8760713cf437fe77b5be9ec642ebff266619acbb10adaf6f900c8d5b65d2c194d800a53232b806263d670532e4763e5eed3409e56699ca8dc31e1ee3ab0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F356F4D07FE8C483E769E4586569404

Filesize
62KB

MD5
a8b323887e99547df9aecf0a7aeb46e8

SHA1
72c02f299e6ea927e093720ac3f4ce517ac31067

SHA256
5a7ea98e9f125ddeb7aec448589cb2d8ed280f7e0cf332b4c1921bd26363ce8f

SHA512
10b1afa56a8c10b9f0d5eb33b96136c4a60ba6f2f8024f6f3e1bb644c832103ba1d90755c4366336102148cde5241a4edf201616314dd171b5661c4ceebe87c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F

Filesize
1KB

MD5
0676b97f99f1f53344a388b04657131e

SHA1
302c5495e37cbed678abc08cb2703188945ddf1f

SHA256
9655899a00ae355e673ce9d65cc73f6430655a0e0f8f2203b30d15e6db5780fd

SHA512
643550f4b3815d4228f175f83e68da0a26e928f59cf21906c3450470ff5cdf879736860bff5464a0600e900f7c1a84be54100728a0570c86a31bd32f31312161

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F4D9C889B7AEBCF4E1A2DAABC5C3628A_77D782D611E65A2A81EA974847CB0C84

Filesize
509B

MD5
664d44b314ce5a6a01d8348076b1347b

SHA1
990cbda9806a8d3dd2efe2e497984de8a48e843f

SHA256
b977f6865af42330d6c6c84d66726a67508ff976c815c7e0f2ee0a3155778717

SHA512
80d43ee3749ee3b0fe800b052daf1d598fd23ce93e527c4f1a86730cd38b5562b3653026023fe030257188c02a54c2cfe1e8ba3874a45fcec7a127ffd2561660

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F356F4D07FE8C483E769E4586569404

Filesize
300B

MD5
344fc0488984a0aba8cfe53ff6c3a771

SHA1
a6e6d720afd83f5e9eb7addbdf8dd826d06893e0

SHA256
b5d14a79b81e7fb147dfaafaeb6781b6ff27f1b8cec85eb5fe4a5fe3dc2ef4ce

SHA512
9d95301c1dcae521fa01c719c959159ed3edfddaefa6c4a2d415a7b0f9700c79615a46562f92bb4fec52833d0df6699e7145d0c8323eae765ad3819f40ee805e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0

Filesize
398B

MD5
f406c6b3d720c4c10723f7573f8f0968

SHA1
8bf9cac51393cf543c476e441ff300382c781dcf

SHA256
fcb62b9ac9c627d39e921245dcc620e9fd7b452fdf97c4f703f883ba28ec157b

SHA512
ac64d78c994af6996657617ab30dbaa9f866ac27587d88230c10a304a7829abf3c9035d4c33495f0d7a888ffaa068940a7bf60417e41c8ad36fb2fd80c3da8f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F

Filesize
500B

MD5
35b0bf962d201494392280a7131eca6b

SHA1
bc4f0e88f335f19369aaba222989dc75c2162ecd

SHA256
4755bbaba43f8896c2ab7d057e0c5bb78eeb675b256bd5b63853191ef56dbe2a

SHA512
dcf44a060e294637f91fbe475ebcae33819216079689fbbae81ed8b9b579fb80f3459afee846b3ed96b76cc53f18f31449aeee0874806445d7ff043a7be4a4b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F4D9C889B7AEBCF4E1A2DAABC5C3628A_77D782D611E65A2A81EA974847CB0C84

Filesize
486B

MD5
5a45d40b4f08ae031f697fbe0c0b282c

SHA1
bb6b336ba696c1e54115143bc50eaf4a984f62b4

SHA256
59f153b2e66ec53da641018265a91721e5bfa8d29bd33446f4334a993b0fa0ea

SHA512
b380496dd236fc4623a82c232e0039f68fbb9aae4008480a5de4b83442b4d26b5a6d439acb01b7410e204b01432d141657f4f2dc8aa960c7d5c9b5a7ee299f32

Download Submit
C:\Users\Admin\AppData\Local\6AdwCleaner.exe

Filesize
168KB

MD5
87e4959fefec297ebbf42de79b5c88f6

SHA1
eba50d6b266b527025cd624003799bdda9a6bc86

SHA256
4f0033e811fe2497b38f0d45df958829d01933ebe7d331079eefc8e38fbeaa61

SHA512
232fedec0180e85560a226870a244a22f54ca130ed6d6dc95dc02a1ff85f17da396925c9ff27d522067a30ee3e74a38adff375d8752161ee629df14f39cf6ba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
25d7facb86265ce3e89835dd7b566491

SHA1
4db1197fadadd7742986efdc2ca76f89cef96942

SHA256
3d225a00da389fde7674a7eeb98e8572be2879252290ac00faa3a80ea671073f

SHA512
cbfc02ffc441edc20c72b35d20b15178a2173e2a1c54e3736f7ba6d058e1ac7a5c1b15798bf5b91ed3a8197430f0fe84aa3d75a8aba61b4f4dd85c1b3fe68bbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ab6627d6da0724908361604b2b351b7

SHA1
d6e7960616dd38cd05633face9bb0bdd061e3211

SHA256
88a373cea6d7ad2daaee9168a0519f8a23ab9ec9cbceab97df4c8d39fe1544d0

SHA512
59903d7dd6da68cb4378eceb6e356d5861514b8365da747da4cd05615ec7c7a51c810cbac6a7a00256db1aeedad80ef71b6ff06bae61e1884e620cc4a45a2d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
21KB

MD5
1930bf2d057af4d2d7c6556ee866cd81

SHA1
92425d90d77efe4fb2152dfa6e0928c915c3addc

SHA256
d67a7783eb75bca4e06722752196f4df2a8fca5e33ab4130026c504c892af961

SHA512
027c0de20bbd3adfe51d7195570a1c3e07796c4fda5c9d8e512a421f7830037aab0bc4e60003e32f17487a5bc03d1d50b635c6b47138e767b79e9ae3e3373b76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
19KB

MD5
b6fd63dc9b0b7bb57078c64540c2cce7

SHA1
fc570316f56f0054fe6e03113b3f7dcdbe09b700

SHA256
505c89a8474e5c087791bafc97185a73f086919df7c2e6d26987ecc2e3540467

SHA512
281d00d1c8dc8da66e873524f711998c52bf986f0c38bcd6dd65663d197cae2c8743528509b48072acefa6eac6276f2e548686cc66333b38b5a58eda07c0c1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
18KB

MD5
3909482722eea0ae1cdaa4b73f1d340c

SHA1
055bcf546e498e48fdd46757e6084a53ff85f137

SHA256
4380985a02a553bd98d8011300e420244b302a588e87226add6538d442eae17a

SHA512
e53874a0ad485f3f8042dd15c2627e5ef933baea7b4f835d89d3c6dda360bcdc95ad3cadf8d98b090b6f4f4fc42bb25ed6668eb9d126a207415e1588f77db691

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
101KB

MD5
9ca646dda047c35c2bb1842e2c067f71

SHA1
be6596d1e8e07da4cf604eaf4ebf10652d7c364d

SHA256
76820f111b6f49135e2f6f7f0eca4b70ddd1a2e685aee2c9abdd788a8f821d30

SHA512
e7be52d4ebbe2ece8bc1fcb5165e48447c84e024aa6f8e9f37edf83713ad635fffbf151a20b6c4fc72dd1b704416aa3fa4814e880aa0dde7808d39fc8360c3bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
109KB

MD5
78dd56029d26eb41b3a7c661800abc7c

SHA1
1c09cb811dcffdfce0f6863e4e183be67f0c5f40

SHA256
5e46f77d0dc2410a27f86433bc37878fdd4bb2e1831d7e19e229d02901104cd5

SHA512
eaa53a7d3eba55607a6128f9043a7238d85edf1dae63eb8f2cf8754743ebf5673cee8295e493b40e859086a82148c7f51a81ddb8fb818226cb000aeee48f8280

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
16KB

MD5
6a6995505b4d4aae99cf6884c1686705

SHA1
638e0aac161eb55f04147c8517d083ed306f5f71

SHA256
77db5e9514916c5be4f838810ffb9c65a53968c28afd858e5bf62333248c9044

SHA512
37332f3092bd6683707c056242ce676aeee9702136bb1c5678cf44827ca3a0a039eb554b75b5796894969635d9d32b2987e7f85ef0cadf72e199af7b4d7101bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
51KB

MD5
03683edaaa5811246151eecb42f28d61

SHA1
601194afd82ea08f836dc898c5acbe1c5a9599ab

SHA256
56c1e375a5ac543e08a197cc17e733c475527f0ff69057643e739b1110123162

SHA512
a12fca40bec2f4672d7d2d3e2ae2273cddb03fb283fd7330bd493dbee27adf08e8f1cd4562a6229191e4e13469d80aa829aad7a8aada30270dac45fb8d8a07b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
29KB

MD5
79ffcf947dd8385536d2cfcdd8fcce04

SHA1
a9a43ccbbb01d15a39fac57fa05290835d81468a

SHA256
ffc11b830ad653e7a9d4257c7cd7a8056db5e7d7e89439b8fd67d1207b1729bf

SHA512
3dc82ecb2abc8c567434666a9162cc188de669927c3dada6392d8bd97d5e746f1ed350e1a02ec016ee2b1dc8a9cc5c71c553f2ef1293d6793800c276560859a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
125KB

MD5
a4828854b45aa02f582253fdb6528d40

SHA1
8014d465f07eb509e3fbf55039e25104b36b9cee

SHA256
b9034ee695c0003abf004bb277f33de0f6774f3e58caa7b68b06a31273f7646d

SHA512
d2e201f82a003d4f213e8387223aa638b893e735ca796bb51fa544d7691a2b35b3c2c1bbe3b1aeb5dc4fb0ac356a1b3303288d3f624dd0dbbb8b13fbac98ce12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
32KB

MD5
4e9483f55ec23787c608fbf55bfd64c2

SHA1
110906ffa560b9c570ffd55abeecd399160c3807

SHA256
b541700cd096f7ce4fa0a5f70714ae4c7e7b59ba08ea8b514b2351d1a0ec62bf

SHA512
895a323b5eb7b49a4e4e0503917c8195b1f83cd1561cc58c1a1eb374662affbe65081a917cd80509d941bebfda39c8e4cd52794b2a332a4e1d041abfe6cece85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
159KB

MD5
5553dde5124c8aa027998a6fb35d7007

SHA1
ab03460fceae42ab2c9a4c34df5caaf047642217

SHA256
da838f3d7c0d4a9f822e34ab3e12b33facb3df9a466193a8539bbb94963650fc

SHA512
1212c070f31b4934e4893257e07b1febc38b6ffc5abd84d57a28a0913369cdf7e4902e93da22c4dd553ae2e8f710485249cf09ccc273e0df5992977de95f7835

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000059

Filesize
62KB

MD5
022b25708e11ee781f8ba58697c9a134

SHA1
8ce2e1690491fbd3a07696fd55666c2ad6300322

SHA256
fcf8adcd7503ab0bbc1efb75432802c3a1854e67ad20bd83b9c4dac5934050b8

SHA512
651776c099c37ca0d1e7468fb8f25da631fb87a9ebea29d8a53279b984140a1977d54b9c282dc026d09775cf30879761af83cb94484b58d069edb9cbe085961b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005a

Filesize
31KB

MD5
e997979733c0c7fafe4251d7679ed8a2

SHA1
72694fbcf563352d1eb7ecd0cbf529b61da9b547

SHA256
765302a9be1402d967aa723eb5c1af44c5d9bb13859ce4ee9192899d7b70a607

SHA512
e9d6007d780d5565407a48028e29ca5b1a814bdb329303f0cf17a386aeb42a89d00fdf0c502cd06122cd7ac9d16e54d967a4dd0c6020b44258c99d2eeb2f83b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005d

Filesize
39KB

MD5
9a01b69183a9604ab3a439e388b30501

SHA1
8ed1d59003d0dbe6360481017b44665153665fbe

SHA256
20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2

SHA512
0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000082

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000083

Filesize
67KB

MD5
cc63ec5f8962041727f3a20d6a278329

SHA1
6cbeee84f8f648f6c2484e8934b189ba76eaeb81

SHA256
89a4d1b2e007ac49fc9677d797266268cd031f99aa0766ca2450bff84ac227d1

SHA512
107cf3499a6cf9cdcbfa3ef4c6b4f2cda2472be116f8efa51ff403c624e8001d254be52de7834b2a6ab9f4bcc1a3b19adc0bba8c496e505abbca371ef6c8f877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000084

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000085

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00008c

Filesize
38KB

MD5
adf2df4a8072227a229a3f8cf81dc9df

SHA1
48b588df27e0a83fa3c56d97d68700170a58bd36

SHA256
2fd56ac4d62fec83843c83054e5548834a19001c077cdb224901237f2e2c0e4c

SHA512
d18ffc9a41157ea96014a503640b3a2a3931f578293e88cc05aa61c8223221d948c05637875d8e3ee5847b6a99341ea22b6a1aee67c170e27bde5e154cf1b9ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00008e

Filesize
37KB

MD5
a565ccff6135e8e99abe4ad671f4d3d6

SHA1
f79a78a29fbcc81bfae7ce0a46004af6ed392225

SHA256
a17516d251532620c2fd884c19b136eb3f5510d1bf8b5f51e1b3a90930eb1a63

SHA512
e1768c90e74c37425abc324b1901471636ac011d7d1a6dc8e56098d2284c7bf463143116bb95389f591917b68f8375cfb1ce61ba3c1de36a5794051e89a692d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00008f

Filesize
21KB

MD5
8e01662903be9168b6c368070e422741

SHA1
52d65becbc262c5599e90c3b50d5a0d0ce5de848

SHA256
ed502facbeb0931f103750cd14ac1eeef4d255ae7e84d95579f710a0564e017a

SHA512
42b810c5f1264f7f7937e4301ebd69d3fd05cd8a6f87883b054df28e7430966c033bab6eaee261a09fb8908d724ca2ff79ca10d9a51bd67bd26814f68bcbdb76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000091

Filesize
18KB

MD5
8bd66dfc42a1353c5e996cd88dc1501f

SHA1
dc779a25ab37913f3198eb6f8c4d89e2a05635a6

SHA256
ef8772f5b2cf54057e1cfb7cb2e61f09cbd20db5ee307133caf517831a5df839

SHA512
203a46b2d09da788614b86480d81769011c7d42e833fa33a19e99c86a987a3bd8755b89906b9fd0497a80a5cf27f1c5e795a66fe3d1c4a921667ec745ccf22f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000097

Filesize
16KB

MD5
58795165fd616e7533d2fee408040605

SHA1
577e9fb5de2152fec8f871064351a45c5333f10e

SHA256
e6f9e1b930326284938dc4e85d6fdb37e394f98e269405b9d0caa96b214de26e

SHA512
b97d15c2c5ceee748a724f60568438edf1e9d1d3857e5ca233921ec92686295a3f48d2c908ff5572f970b7203ea386cf30c69afe9b5e2f10825879cd0d06f5f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
5KB

MD5
a5e9d5ab68c8895cacb6aa7da81f45e2

SHA1
0fd03faa05152ff4e4a210f20b349162066e2449

SHA256
6762d9c0ff44d4f4cd48afaaffc3325b5dd4f74d51e5efe6d176a6efffd6adaa

SHA512
ea9e800c549605d16fb7d10b775297f7b34b263e0082d5defdcf225f2d239e7ed0d723b1fe88d614c121402185feaa2953ee5974abacef6c8a1b693ab302ae9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
5KB

MD5
a884d0d910f8db75d96b2da954052045

SHA1
dc3f92abcea9a0c2a9d976e2b86afe2a688186e4

SHA256
10d934e89f9a29dcc4f15263a934159c251b30dd01882b9c511444c12dc79593

SHA512
f18d3b8d4d4ac8b9010ef18f2374069762d72f044d62182e48a31c2140914f7aa069a2423698d4854c31c84b5f520766af9e4f347af0183fd9954b842bb1b8e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e53a9d6026c451c669de15b88c84e208

SHA1
029af1316c0137584c199265bdc188422fef0a9e

SHA256
164419e05878b692fb4d61e3b46b7fc0f79050df2e5b6f0907dcef37a33fcc43

SHA512
5ed12925c51bff57daf4c881af3f57074a1b4f61b8ad450a421f98b525b283a470296bdecf39f90d8276fc7bfb9150eaced40effe1382df4ff465c49012300c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
4b31f31ec84f203eb72cec2ef24a71ea

SHA1
9bf11a573bb5c2ed26887cd5180fcfbb5ec6c628

SHA256
c10e55ffb439f90823ff136db46212bb28bd23113910c5883111209eaa90d0b9

SHA512
c815864c9330fccf1a5d277bfe1a23b79686332cf676a6627bf892d3fead5c3f9638cff314ee747f6863638ac9b5db89c834df2ddf1307150d4d44eb09bb913a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
1218ee763640abb6ed2d82a6e7228504

SHA1
96dc31e9ff0a1e3dbe5f7531f87145c66fccf645

SHA256
7adca80fa93472b94ce3e8d0ba4c47948d71a52c945d3c109a3bcedacd3066b0

SHA512
cb0e5aa76ecee2617940a7ecd16086b6cc995126f5fa28eb3a15cec363f77c33778515f1c60c46ea9de2142dbc664984e984c058d0a7a042d5dbef80b0338443

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
83a861a21abd581098e74743b30f5b35

SHA1
cb9c4f8388937dcae4093663877d318b59e70472

SHA256
22330c8c8239086e33ebce28f9aaead335104220d8f1b2139145d0eaa8afbaac

SHA512
3e8936aa043a2628923e9e80021b6716c92f961aede481ff341870100a4a369fa806293742a8c341d4960c1e19f4fdaa7aea6c0ba664610246a320340ca4189e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe60eef8.TMP

Filesize
5KB

MD5
efd1a5267b77347863adff31aaaec605

SHA1
2438a9f1ce2d8a4a1a762777cdb8b3fad0e44c99

SHA256
fb8a50a0269c55c3ab94ff269f0470e30d214d47bb643de49ef7e44c772a8f35

SHA512
9ae35fa864f5800ab3c5a0173424c4ca24c61dae1db0c70f83f8d8af761b45cd058383ac3908c560b32637f6533e8f8945edd247c1fbf87c76c9146745ceda71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
15KB

MD5
9a23f7ceffec71e2dd854e5229e4c3ef

SHA1
68045392a26fd3411735e204d03ab2b91d48ee0d

SHA256
cead3c16e266b237bc16c938d1a0f43edf4d0a560481e2339527c69011a4add0

SHA512
e9d4c627f2e8863dec612a8b351b4c4bbf7e5b7406409485ef2f4c19de4aa66962a1308b94e42904fe006d6447e84d293c5411eb742dfc327670753d23b029e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
15KB

MD5
37d61053c943e245bf9c546159d6b087

SHA1
63292167db19e75e89bc983b1fcc508e1e01dc6f

SHA256
8b291b0ec92645d0da227cd0a27fa5ea9b0332d7d0f8c0c590592bb07a33a410

SHA512
0f428ca45ac6fa351b1eb9b01683d8b03700138c8268e60c8c99d6d45ba638a336089bcfc714eca89504c56084aecfc915abdd8886acfe794ab4c8bc45d4ba0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
0a8a7c3dafeb4ad3d8cb846fc95b8f1c

SHA1
69e2b994e6882e1e783410dae53181984050fa13

SHA256
a88495f2c1c26c6c1d5690a29289467c8bb8a94bf6f4801d2c14da1456773f90

SHA512
2e59b4cd4cf6f86537aae4ae88e56e21abcff5070c5c1d1d2105a8e863523c80740438cc36b2b57672bc7bb7fb9387896135afcce534edfd4697fecf61031a5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
b8fd896b742845f0dc17455258156c74

SHA1
24b59515d8d1d15154ecc661fd64d3b045f68276

SHA256
8c8cb5ec87955528d5543d0337a766187676be4bd5b74f5b6d9f8e19cd88f6b1

SHA512
8c84bc97d185926253bdc5be5811a8262feebbf1036663861da43922348abfd5a0dde9a87e9c728ec52911e37e00a5d06ae48ef4192f41b9e54bfe09150f7fb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f8936f96ca75fa51d7f2e60255beab4d

SHA1
133d844980494f7c4f3412ed71e6afe62d31a07a

SHA256
211ee6d2b3d459303daa699d72a907982d368077f0217c8a98a7b1bdab9cb0f0

SHA512
71b91992ecc76da492b127ba7e54690904b019ad5bf0efa50e7848968443e9bf7272c1aaafb0a09fcfcfc08b476bee4b7ecc36c849e08bf3ffb1b5dfdf87ebb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
530e3f7a863e2d526a7b80516c5f1d0b

SHA1
1f839f9408bdb7f7cf5170840806c5ba2071740e

SHA256
72a330c30274abeadb8f8eb779913973391b5a98ae6c58f308983ccc3fcf10f7

SHA512
da17192603f71a82df86fd4bbe7e97322071c3f31c28947cea4ef266421b76f31e9995e3c821c874241eee801ef8b04a6d69d1dd652e9f984cd9414100e5bbde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
67348199554684eda63c31ca2edb06a9

SHA1
c3b387ec6ddf59e908083310445ee23a86c857f1

SHA256
46cf7d13cc81a13fdd5a6c8379e5e0b7f81e0e5f08605edddcfa898d457c1484

SHA512
b7815146a855c05060f4005eb0410e0c6434a8cf7e3ba7d361f323cd75ad6b06cc41118b4ec9e03232de6c2209f870799e69be86d9b9128f1c82a5dc38e1d630

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
adb58164f7a98f93e2485e423ecffb9b

SHA1
19e978ad6fb8ad845c7bee7807144849090d689a

SHA256
b5bf0938d41e1fa639300ded9392da021d44cedce5a507a385d7a5f449b1bb59

SHA512
4dcb2b7f35b00643e517743a501e59edb3514072e1048acbfecc87793ffc08d0dc9e02f80fa4122dfd86a26d209fac81cc0516040be04db8b7ff1755aac56be1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
b52e28a4810e2624782a3351c66c94aa

SHA1
e3ed3488c410eab32c43c9e119f72cd4fec9b2a0

SHA256
8479ad2c773e5921358d8bb2c73040e41250407ac160eee3a72e34baeebeb95d

SHA512
2e67133ec27562ac97d3d238bf68265cf1a381ae55c511dd611833a15d4e9c7bc028d8a048238e192d891917f41c2f15b1d0935769dba13a79c06140c53ff410

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
a7cd7d2d83ee10b0e5b9bd4ff1f6aebf

SHA1
fbca17d0ef5d56d692c4d0f1e815c41837c071e9

SHA256
86c2921ed51ef4667e09e5dbd46f434dcb4d96368f02964a6e560b38eafd1b7e

SHA512
273b92f5ad06cd8dbae2df811ed4e01b1fad748322af3539736e8f5082815deba3441425cd8ba8c42efe8741c1eeff7ae76bbadb6117899439fca66d54d1ec07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
77c7ef4efbeade00b5234d6cb2310d43

SHA1
3de2126ad0828dfda003ed7f27cb297a937b8d17

SHA256
49ab830bdc7eb114237c41dc52acbec3d4ae84dd148d57cdc2ad33558a3da610

SHA512
2a3e6b6fd459fcbeb94b1211ec6f830954536ea36cca25fdbdb57402fd48679c5eda7c06ccce3a6604917a53cb8a972cab557cb4bbb4a910612d7d56244d0ad8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
c2ed41fabf0a35f8cd5ad9ed995b4d35

SHA1
53a1dae3bdf262ce1468d29c3113d28d09734936

SHA256
ac36f6997c43aa697b50daa5f79410ca101981c5ce2bd571ce3f47ebd2d076f8

SHA512
3c623c52f8460540cfca2e9582e399180ebb5b9e13686d6f8941dbae148221284413f45b043a4fd4274d68707d425bf734b9dbf91dbbd1f21a6b4e47611647e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
9a88d95b0f56a08395d20c1f4c4b499c

SHA1
6e1a4598bda7e01c311245334a84c2ef0f2adc4e

SHA256
03697cb3b6713e69647afff53c9d6f9ef7d6474c37d5221745546849e92e5b13

SHA512
90565315e9e2bb768792644193b10184f4345c934e0e2e1218338592f87a380c4e6f4ea62be870cd9dd7f4d54a55c6db886e80c10f64f7033a339eb369ee91d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
b6e459d5f7af872adca44a10bb37df60

SHA1
ee16a4086cd55606f396ec35a4bf66bef424cdbb

SHA256
63dea3c30a6c726075c6d0cd2bb626b7ceb703267ea7affc4046d0eb306e8a7a

SHA512
03d5dec38787d78a0f3a28f4be6373f6c7670bf51e1546c419520ebb3e8193bfa4e1ee813cf9883361cead64d27e954bc343a302f71f843a204275817d3f5422

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
5755ed711b3a96cf67394df5cb5fb86a

SHA1
bbdf6edf9d9d682da99b130c9f9653b3bee74782

SHA256
9dad37049c1b941267dac35e0ed54e2d0ba159fd434968ce17ab95b623af1854

SHA512
68caa52268654cc9820abf3c2f249659b07224750a8efa24ec838ac4636c65d42b5fcdedd8c2c9a4b0a65787ac6221724bb6ac042eacba8b7c82e3830365e198

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
5b1efa170724168f3d6b0f74719db8aa

SHA1
fae13e0e6647125679ee88e92b71a5b1e37f284d

SHA256
43fb4dfdd340164c6873582b05f6a92d001ff741231eda335fd0e63360b5491f

SHA512
c2a28c7f28552dc742383b0389b3652d8c801b8a0b9a3803057551ebed3e3d0f8993d371ca02e1fd9f9f8c9f85a8b760188a8022a02eea0654f0ff05a021f959

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
38d6c4e3a9424546b7befdcbf1814368

SHA1
80789f75a94312a29d2e8d55051714b4b9fed44d

SHA256
209967f54ee6f509d52c8aeb3c0140953ba530232b40ffca2a902041da42b34f

SHA512
a12b3dbba1815d9efe1c5e02b5b58f0f7238cdcc511221fc16b3a071f74cf37d76b8f7df7062aad8577150ab151e5c11bdc6799af1bc1ef93aeb307f9f52222f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
bac003f8a0e30eb129550c56401bcfc4

SHA1
b739b2c55a6206cf8ff0b4c94b48b110187ca3dd

SHA256
d715792c5ca97d961e2f946937b87b0ac3047f0a3c0a9703b880979c54ec3546

SHA512
46fa8cf685911883a07341fdba8b5cab8f6474783b6ce2cdf328c3fbd54a23b13fd995987a5c4e755a8823440726cc74aa5cd503bf43f96c67046cfb3b196846

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
673c5be35a55e09dd770c5f5d1d87096

SHA1
1cc21accec7c89012cae6bb5ed1e18f8702ca567

SHA256
1e56d7d7ecbbc4c00d20fa48e1ddaa603df58da1721697c00e8a50ad49fc6de4

SHA512
a7eebb5fb9ded21fcca30f70ede884fe0e3fcd0e4069f882266494dc131ce44755d0b706d4b8825e3bff94bf46d7a1d3ab1b6ac92576ab159fdf374b5dbdf475

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1f51b688e12bb3e8ab73d4c3ff442ae3

SHA1
7cd54ae1ddf0638e72f63c9eaf909a8a075c5c11

SHA256
6bac3649a14a9d5fd737c018c5b5c71b4b66891b9bacf15db77ff9dab865684d

SHA512
bff99be1e7adf8473dd3d8382c3793df2a65de5114ada3e1e351f671f11ef9536489b34e64079b2b899e93cf1f363f140150a983412d25f9dc6f1421f64ae573

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
70761f7d8b143989e75f3c7f215d675f

SHA1
851c10994d4d39ef5301e95cc299490bf0058a87

SHA256
888e7b7ffd41b3f6fd7bef34bfb34c46a77818b9573b04ef55a2a0b012f60b99

SHA512
b76d0da95ea7f81b05efa83d5f7eee5638d1675a83e4b64ba1dc05bb1724e9b2347c059cb84bdc2eb0dcac5bfe7388f17797434e68ba76929976f0e855cbfb44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
d490391cbda3cc30eba43516aeda46c5

SHA1
9b320564b13c3e7b2bba0f39c844a31105d25abd

SHA256
3a2fd3a2665135fde7c04477160cf02cb36992e5d7e9bbde6f0ab9f507a9b35f

SHA512
22da1c3ef31645b99fc8892c2fc28dbadc1fce4e58bb4780d1e29538e875fdbe628d5a5304800edc86e3dd7f1dd2e6ed7dce22eca84a9883353694b61eb8d57b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
5fe86e691d99a6a56f0f6e107e39e4a7

SHA1
8b28f64262f48c0e9758835d77f015bd0782feb1

SHA256
c5f9d86f2b63629071d11911fb7134252853cabb9630a69b385612a812313f48

SHA512
e1b9dfa72b0ba9156ab6a82ffdc40b9b20da1a46b8e4b55a4ddc4765ca2cf48136b4489249bd8e3a516020f61ccfd610995db80e3531d2ba9ca04b4f0fe64488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
d4856b275b4eaff0fb67473f7a2f0bd0

SHA1
36564574a5ad1ce94ba998fc3420383bd113deea

SHA256
b700cfc8afdf7b3406636dfad8597ff364f39c5cf7f7c17f736e4d0e6d5ada6a

SHA512
a2126b0613ec0d158d4b7295b144ff7f5718e2e4a54c03fbf36390503771becb441f17f2ffd40b2d8cb942fd6cc8f09ba9a34569f412176b43785bfb9b160aea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
252b5db15e932de7b164eb889df983a0

SHA1
cd60aba51fcb2ffce3ca653916cf592dd88cb197

SHA256
6dc3b66caa0641e6582f17c330d961842a17744f5c05216e8a4ac9854ca5bd42

SHA512
10c666f14f27d4a61e4f8de35941618001ce160680b05bbd15dc1e65edf694110c980354c7d1f28427bc9c8f21b553376bdc7e82916f073c24df672387c57a47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
688f5cbf8a2036b470cf8588f77015d4

SHA1
5d19e3b5b8fd47edd117eced876f6d90fdd33ccd

SHA256
2adaed7aa80511d0c0e2e6df68f6854c03612fa806a65d5f11fdad807b1cdc4e

SHA512
9b744c3c295042f71533aba7263cd416bfa916ccda10c5904c12b765b103a71440827f9bcbff556a1d189310da23fd8b7c75bc9c78b775173d909eec8f6b1966

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
c203cc5ca54e77fb374d5d0eaf0847a9

SHA1
6d3cf5179ff87630eb9199aa86704249d5d1119e

SHA256
e209a133fa0324c7d30759d78aec28e0986a433351ed3a153870522b6fc02a9e

SHA512
6e432dbdc9e4ceb7e13ba020edcabca4d6aca6e3d2a671c988a6037e729530fededea429049411e758ca1602971b9f566fe763e9ebd40fb71bd68214e2d35150

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
0e7d7a1113e4a4bf03f1c6409f544de7

SHA1
b52db5af7f456ca578e34b5ba173886d9ab8e3df

SHA256
350c3af6246ff2d49187a3b789025c035e4e730bd0aece7906855105081af264

SHA512
fe86d8a1d7b879914602f6e109b553cd3d595f8c1a6a12dd945866a8664f1f3474f5880a0d2972cb7f47c75e882f1fe7118856ec604c365e3b6d2a297ab4d97d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
b1942d66bc7d5f112f5340b784ad0a1e

SHA1
5a98131ac3129bc994f75ba92e18a8d91ff90c8b

SHA256
a3e0f3ae8336df04e9e11922662acb0b665326d15159aa845e5a27123a988940

SHA512
53934bc629df6cb21b2bff6d45fe961d925762bf991bb2dc2ecfaa81ef45596cdadaf4315ffe37fead4d280b808eff5bf3454e5fb5acdda6bcc172a0bf2b350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5790899ebc8d5068151343fd0db2c5d1

SHA1
8644fae7f57a6b738eb0b3997997036fb6462d8c

SHA256
97769d0e7d6a81be54dd94fe8b357b8d7c8f09ed6863593c79346abae41081b7

SHA512
c11dd54e2a884e25eaa8c569c2c173cc353678f8f294eebfa5b902a90ab2d0625ffc0cdbf6aa951a1fac218b840faae8a60cf7fdc3123055d0f7283ac440f264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
50afd86897062a9df3667d8f50176377

SHA1
f525b8a819b226a5c44b12fa49f74416e3cd06bd

SHA256
1461610349d39c3e1aef5770f3922a7ff21ea1a79fecad5373ccc7591a3ea71a

SHA512
f3918b8a0416aaf974f42076c9e34c7dfe45ae83b2dfcc0a6c14621f615971a05cd6a8c4583678e22e658f2922e034b4ed7f3386c2a7d87284df41b7dfb2a51d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
107e06210cc809057cf41063fb230acf

SHA1
8ea6c60ce1185bcfd77ad98a2dcc78cc7f9f53b0

SHA256
7beaeb009a450f6254117761b2fa47777a3eaa9c3ebd23c6c1964f0463c03d03

SHA512
544caba9c215cfc1b4c0ac19eac615f78d47b4e0862e22fcab9bcc3558b01e88ac2d191b1deb3b1dda2c90b39194fa61161157bc991f8b0d64b9f84f3cea84e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
a1ececb15e06a1feba51c214b97d9f28

SHA1
fbc968b933153ea599da5b42b0ef18a740a698c7

SHA256
ce5629ebe8de7faa1e33bdef8cdbafb7afd2d9729a3189ede8a69956ab86070b

SHA512
afa19abe10eb8570bf8c35fd6ca7af8571e94b7371f8ed7833b4334ef0aae2f78fa90e4cdc1bb20c159a8ee230f0301a3484a1f063941fad03a172eb786259ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5813d1.TMP

Filesize
874B

MD5
f9b45fd33f934b5c47d9b5ddb531ad2e

SHA1
f4e074bb181cb6f1680ce17d6838d123ed12f20b

SHA256
869786fa359c052e11c8e3b932a37a26dc0fa861678fb604621673de24ac44ef

SHA512
48518ebdd1582cfa9aabdd0248792d5ae81a417d6e6ba187389120c9053c47cc51bfa96cf7b2cc7e3f20bb83b40f8ae0cb4d12ad09411510271b4347ee382131

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5e9f2c.TMP

Filesize
6KB

MD5
7ef5fe7beeebaeffa8ba508b3d2dcbde

SHA1
ac023452b2ce482b30ce3439482f74d165a9c79b

SHA256
6af6cc295a6e03e82e42d0db2527459a8f6525e1687966dd44ac02e85f807c23

SHA512
4e55259867d4d0537929fba10e4f1b88ecbc0813fc813acf8db6988d447d217d26ebabdfdb9251d490ef5e7ae819f84ff7ac63a0a5d698649ef5eab4e5301f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b82e502b-166b-4540-9f88-7b35c03ea35f.tmp

Filesize
12KB

MD5
3b2c050d6428a19410da7e2f3c2b17f0

SHA1
e935614aa2280d63031215fbf56493b303a40675

SHA256
3e86fa50360c1f52384df85bb0fe6e77134b557fa1c9a757a982c27f4938fc3b

SHA512
5de3adada2215ee5af7d312684eb4d54f4d8033385972a6039929f39c5d0725b05ef9ce9fa05ce2c661a4f3d7a2e073988c30ae730fec8ab77380d1aff8806df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a86d2b8d7df3ab9f15d8f3efe05381dd

SHA1
a8714cae535bbe03ecf063245a7dadf340d1a66d

SHA256
3779ef266fd338fbb85aede48f41f54e87cfe022b41a079a0e4fbac0daea9173

SHA512
f63dc9d8994f9374f1e649b1ff305fe8bede99bfcbee437d55be1485d443ae46ccce7bc1021505bf8f601f32fae671425e2d435f2f772b427b053b383b536aa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
64164774c493382351f31028b61a4e78

SHA1
9f21eec42a2ad4db67dc2d75225e7899a0b5f5a7

SHA256
2e3e90f6f616e81a4284abca90c72ea35d4ca0838a3b0b658364bba2b4f0c06e

SHA512
1eb333f08e931af5673b53d8ed6b6d6429476e2839750a16eff2cdaacdf7c5cc00425a2b7e38207414f4799448fe1e09943f44c4e16cca88c3a9ea088ffb10f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2221b9bb2aff2e33ac5fd1383018c896

SHA1
a1224e0c5f04a4e3a25701b90dda83ade254dd06

SHA256
d3b86e2518e0fc85e2fa05ee8f231f85d45a5ff6527824d056a64ea9a50572cf

SHA512
853e66eeff129fb917ccd9c9090a3894757d1f53e7de8b1c1c59ad879ccfde443501ec1beb1056baf919303cedc6148288e0b438c07633fae28c3605e6a832b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0164363b247db733c63e72b226521a23

SHA1
f96bdd7dbcf36443ac49459f554cadfe4e53179b

SHA256
4b41d8664e72b4bcb4b19483fb029f314cf4d5f4fc65d4a590bde247ca899abd

SHA512
9ef27f85a147153d766f33bb1f70046363d921593cfb2adf12ea11565c091c519e2d2e7d249add170a98cfe15b2360b3f5e1a102b8fd09e2f2a38f79852a5834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f73ed454f40cf923ab151d4219b184eb

SHA1
48cfbcbbfd4dd8b75dff91a655afb2b7d5cf11c8

SHA256
c3b3b37af88d14d6534ede8f4e234e98a65593a7bbf36e99616ac480bec7b01c

SHA512
fd431163fa4ef80d5ea832a520c0e33d9c0b9e7198ad829f94a206376386be85e6d60647fdc05d6a1cc8b08c1f2375a554cd3de696de7c64b0f3172d8663bc39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9d8950e496bf977b32ad43a51cfd413c

SHA1
33f4d8dc7f5d542d1e321582cf6ccc79a05e6467

SHA256
ff854b15ae1ccf0b9fe2fccfb808948c8083f9429c23213fc91c589ba2b5e0d8

SHA512
0c5c5cd1c85d82ba816193e4fe2fa286390dfa508c2511a67ab497fc82e5e7c18296d44d59777056dbb2bec1635351ab06f6d56e60cb83ea290d6804345d9849

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1f642b36a6d08309e6100922f4abb140

SHA1
b333520b556dcd2ab9b90eb2604a249a7b61bafe

SHA256
f9e9e6053dd91830d1ec9cd708023539f1d3ef55e7b1ec155b90c71df413807c

SHA512
5c75a6c87c474d1a167e4edf89cb6a7c4d13c47b91a63163047ec232dc1b289653b64ca04e917b29b33f7c4dd907c48215285555369e21b8c321f564479514b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
fe8698ef6466d2ec130b11f348f49262

SHA1
1dffc5198baec8234faf1ae87736a520687b37c6

SHA256
40632d60eab8c90256dd41de4520a8748b3e628a24e9ff0e6469fd6b4c55b519

SHA512
32347b081e72b1c3adc78b35e2184504c00984ad5cb16aac5a617b8d7a29939d3f9d7dea446b175719ac2f2c12c28a9326c488c7afd4799aa0e7c0a4d107daad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ce791f34363beab4242a99f96d189057

SHA1
27aff1dc8b4c4c1af683931c01ebcff5df868667

SHA256
ec97dd01fec43e2ba3f0d47b0433a91417b750a8224fdfef7d31f3a6b1ce1111

SHA512
f5fe41c61fef8764dfac5c92086c2440d70095cd79bcae98534684334ec48e248adf16f85232fbcfac7df5cab6af7f402447d2d45a1b46e789b25d3d41f01e18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ebeee77dbf7bbf1723bf33379e470ec6

SHA1
4011c40042d9f133fba00c9ade22bebd97b0d5e2

SHA256
c70dae96d5630276059c93a7a57e74e6539f6aa8456eedaf6d796481fd2e644a

SHA512
22424e34ac16e8e8625b1e99f4b1a10317958e292bdead1a5c40d00708f03cacb0e626e3c7982c7810a14a6c66207b0d24869d7e541d6706ff3ee676a8d104c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State~RFe5f71dd.TMP

Filesize
12KB

MD5
44bbf7f2972b5cc2f78581c9830176ad

SHA1
82cf2c6d0da693e6f8881e28f840687ed2a0f728

SHA256
52e6b6d21e6182e07625cab71c272382e01a3dc3632e8b724eff09b48c6c8c7c

SHA512
d5e425131d98f3b10ad572816849aa809c23e8cca76413525abe10e1f7e23b2d240e265fde64386894c3150815ca31283773066c4bfebe87d91452ad4ca40e9e

Download Submit
C:\Users\Admin\Downloads\AdwereCleaner.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 121311.crdownload

Filesize
414KB

MD5
c850f942ccf6e45230169cc4bd9eb5c8

SHA1
51c647e2b150e781bd1910cac4061a2cee1daf89

SHA256
86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f

SHA512
2b3890241b8c8690aab0aed347daa778aba20f29f76e8b79b02953b6252324317520b91ea60d3ef73e42ad403f7a6e0e3f2a057799f21ed447dae7096b2f47d9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 302771.crdownload

Filesize
190KB

MD5
248aadd395ffa7ffb1670392a9398454

SHA1
c53c140bbdeb556fca33bc7f9b2e44e9061ea3e5

SHA256
51290129cccca38c6e3b4444d0dfb8d848c8f3fc2e5291fc0d219fd642530adc

SHA512
582b917864903252731c3d0dff536d7b1e44541ee866dc20e0341cbee5450f2f0ff4d82e1eee75f770e4dad9d8b9270ab5664ffedfe21d1ad2bd7fe6bc42cf0e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 433744.crdownload

Filesize
1.0MB

MD5
055d1462f66a350d9886542d4d79bc2b

SHA1
f1086d2f667d807dbb1aa362a7a809ea119f2565

SHA256
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

SHA512
2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 487279.crdownload

Filesize
1.4MB

MD5
63210f8f1dde6c40a7f3643ccf0ff313

SHA1
57edd72391d710d71bead504d44389d0462ccec9

SHA256
2aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f

SHA512
87a89e8ab85be150a783a9f8d41797cfa12f86fdccb48f2180c0498bfd2b1040b730dee4665fe2c83b98d436453680226051b7f1532e1c0e0cda0cf702e80a11

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 918493.crdownload

Filesize
1.7MB

MD5
6d622dcc87edc9a7b10d35372ade816b

SHA1
47d98825b03c507b85dec02a2297e03ebc925f30

SHA256
d4ac5b3c525a5fd94019d80ff81b552e73b19b1bd0a554b9609cdd5e1b00955a

SHA512
ed06f872a7c66ffeeb8cb8f6fedca06ccabf623f9cd188c4c7105428e8d6521ef8da0bac0564e14d2da914d2846369a9c04577a8cf7fb80cb62831e5497f2a58

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 959072.crdownload

Filesize
431KB

MD5
fbbdc39af1139aebba4da004475e8839

SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0

SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

Download Submit
memory/2304-28318-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/2304-1759-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/2912-1489-0x0000000002CF0000-0x0000000002D58000-memory.dmp

Filesize
416KB

Download
memory/2912-1481-0x0000000002CF0000-0x0000000002D58000-memory.dmp

Filesize
416KB

Download
memory/3132-1153-0x00000000216B0000-0x0000000021E56000-memory.dmp

Filesize
7.6MB

Download
memory/3132-288-0x00000000009D0000-0x00000000009FE000-memory.dmp

Filesize
184KB

Download
memory/6332-1414-0x0000000000B90000-0x0000000000BF8000-memory.dmp

Filesize
416KB

Download
memory/6332-1422-0x0000000000B90000-0x0000000000BF8000-memory.dmp

Filesize
416KB

Download
memory/6332-1434-0x0000000000B90000-0x0000000000BF8000-memory.dmp

Filesize
416KB

Download
memory/6368-1562-0x00000000008F0000-0x000000000095E000-memory.dmp

Filesize
440KB

Download
memory/6368-1564-0x0000000005900000-0x0000000005EA6000-memory.dmp

Filesize
5.6MB

Download
memory/6368-1574-0x0000000005350000-0x00000000053E2000-memory.dmp

Filesize
584KB

Download
memory/6368-1575-0x00000000052C0000-0x00000000052CA000-memory.dmp

Filesize
40KB

Download
memory/29960-19377-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/29960-7944-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download