dharma | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

19/03/2025, 11:12

250319-na9xssvzdy 10

19/03/2025, 11:09

250319-m9fybsyry7 8

Analysis

max time kernel
892s
max time network
900s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
19/03/2025, 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

dharma discovery persistence ransomware

Malware Config

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Dharma family
dharma

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe	CoronaVirus.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe"	CoronaVirus.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CoronaVirus.exe	CoronaVirus.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1115554892\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1115554892\shoppingfre.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_699667669\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_699667669\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1115554892\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1115554892\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1115554892\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_918383064\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1663101190\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1663101190\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1115554892\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1115554892\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1115554892\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_918383064\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1663101190\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1115554892\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1115554892\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1115554892\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1115554892\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1115554892\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_918383064\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_918383064\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_918383064\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_699667669\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133868563814754390"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3920535620-1286624088-2946613906-1000\{31AFA974-B503-456E-AE98-02E4F79C94EA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
4636	CoronaVirus.exe
4636	CoronaVirus.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 4024	2372	msedge.exe	78
PID 2372 wrote to memory of 4024	2372	msedge.exe	78
PID 2372 wrote to memory of 1580	2372	msedge.exe	79
PID 2372 wrote to memory of 1580	2372	msedge.exe	79
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 5640	2372	msedge.exe	80
PID 2372 wrote to memory of 4380	2372	msedge.exe	81
PID 2372 wrote to memory of 4380	2372	msedge.exe	81
PID 2372 wrote to memory of 4380	2372	msedge.exe	81
PID 2372 wrote to memory of 4380	2372	msedge.exe	81
PID 2372 wrote to memory of 4380	2372	msedge.exe	81
PID 2372 wrote to memory of 4380	2372	msedge.exe	81
PID 2372 wrote to memory of 4380	2372	msedge.exe	81
PID 2372 wrote to memory of 4380	2372	msedge.exe	81
PID 2372 wrote to memory of 4380	2372	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x250,0x7ffa98d4f208,0x7ffa98d4f214,0x7ffa98d4f220
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1840,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:11
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2240,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2476,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:13
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3460,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3472,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4932,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5100,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5188,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5620,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5848,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
  2⤵
  PID:1980
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5860,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5860,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5976,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5924,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5912,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5504,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6308,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5696,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2132,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5744,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5528,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:14
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5748,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6488,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:14
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=568,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5612,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:14
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6464,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
  2⤵
  - NTFS ADS
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4720,i,13844472135193557386,15625016700016044874,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:5356

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4916

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2020

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CoronaVirus.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\CoronaVirus.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4636
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:3132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
509e630f2aea0919b6158790ecedff06

SHA1
ba9a6adff6f624a938f6ac99ece90fdeadcb47e7

SHA256
067308f8a68703d3069336cb4231478addc400f1b5cbb95a5948e87d9dc4f78b

SHA512
1cb2680d3b8ddef287547c26f32be407feae3346a8664288de38fe6157fb4aeceb72f780fd21522417298e1639b721b96846d381da34a5eb1f3695e8e6ef7264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000007.log

Filesize
21KB

MD5
1eb910098d5de1c1494f89709b624093

SHA1
ec07247c87e174e84990ae277e1b058bceba104a

SHA256
3573b9c95cb3f08f6f47ac57524ac5baa591ba732ded57e34c5bfb7df8ae66b2

SHA512
915d9a0c95ac1f00d60a5db1e937aa4d045771dd8e50cb5091c68df96011393a5dfeec4c846fb870df9a75d6cb3fddc771ff5ce3e11fd4d5f07fdcc2244b4cd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
334B

MD5
055f17eebc40490e75d6810b83d39ac7

SHA1
70a7e1af2453e4cc9b2619e2cc6d6ca6ed0ff472

SHA256
1baf40c38ed4fba52cfdb856d63987e0f9d09e17a221363521faed353f185a52

SHA512
8ceaa9e1a0c41fc227d04164d4cb00a425a62507eea7e43b29e4bf3dbc33e414fd58567eefd9990bc0dffb633e4008f8c7ef38938677e99f918c4549ad654f27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
331B

MD5
b5f702159e08696d4c86639b97874713

SHA1
8918aa0c0c656654f2d83a35b79ddd1ad60c6209

SHA256
75a7eab58c850d643283f6cb1143af68241279eb6a451400bf82b6f5a30759b2

SHA512
a4b1887383ce5423f5624f678c5b83005302fbb859dca1326d8840e70aeca9bcba1d85ed6b78b77c54030bf24372f4dc47440ea09b6f37af901b9207330c61ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
334B

MD5
841e50aa3d0b7937f2f684450027ce03

SHA1
456b3a39e938248df49b70aad6fd548315db7101

SHA256
23090bd3402fba861f521e68e7dca77513df7c3c78aa2f1a6d021f49bd5f5f63

SHA512
2d54c4d1e203dda51b4a6a3954c7c8cb20e86ecbde7c2c7436eed1843033f9bb90bc8ce15836e4ed2a2848dd9d8f68d995809f9b22a52eea54459c6618197ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
93078efc6136807d15b7b1a1371e1d08

SHA1
c0f2be40cf87b0dd5329600c7697cb323da8a1be

SHA256
1b259b925bc611d5bd863646d91639390fb4b3acb2de7c9633328da380f27c27

SHA512
4d7b333aa28d2307471b6a72022fb8792f15c0d79ccc828d1f1182355a1f84fdecf0dde5e3693bf787e50a076a2caaac4f45c8033704678b65249f00a8ea6ef3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57fbb5.TMP

Filesize
3KB

MD5
7a3113e88d5cb92ba793e4f69bd8f19e

SHA1
17f83b285b68a1ed035c2370282b2ea0869992d0

SHA256
98a76e1c1701d5d5c7b4238278aafb2a789943fc0b979cf2004bb6f0d155ce6b

SHA512
95c33c105e6eb5ee055a55647d87910fe6ef6e9f7146ab9b3f4c2ce165eb1e3db289766827c818a9ab4e2427dfb54c777b38e250e4f8dcc84e9fe0cd7328403a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\1eaeacd9-160f-44ad-b893-be9832071b83.tmp

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
931a54d131ea0c0bcab8d76a29cea18e

SHA1
362d2248733382524057e6cf6bb0a9e53b5ff276

SHA256
65cd9ab15a5926e89fe1188304e95aa26110262375876c79ff4830422d66f544

SHA512
49d3354c0e71322aeddf35afb42222092c5f4ec458dec3fc9f8692593e2263f0b32f1a0aa24296f96824b611a7c183a44c377fff97a79efc8f955547b5bd0279

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
5ba88119a2aac0770742a7a9c4aafaee

SHA1
36022f129465adc539d567a37931e480d1faa296

SHA256
e2b79e486ee66f2fc99a5707493d729d0b5e4c2e0a0db68318e71cb64862f438

SHA512
66d0eb89f42b38f43cdcab6aaaaa85a5d11d9a859021376f6a5323f545f2c67a2d024123962a376b317581cb3be741917d0e6e8904adbe8d5cbf80107f261572

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
81de77212507bd93428ed92c8b3f3138

SHA1
d7b1ce7fe6908d521547973d0ed0a0db9eed1bb9

SHA256
d30e08860642e76288398f53cd1d91a8e036db95d8187aa54bf26b55a6c1c678

SHA512
4c3baecfc706e32f2cce8a1e9238596fef5239c98fd86993eee936b1010bb75dbf3f9195d16e068b14e3951ab57800eba8cda7cc072dec1ba961d5dc2094c7a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
2f79fcddfac8eafbb5b26a510e67636c

SHA1
fe5eec5b182a86a072e08e53dfd1106bbd645b40

SHA256
c49f600beb13a2b1251f5ae6512610aa66aacafc2c72f9e151504e0837c8b1d3

SHA512
a15d25a984f2750b8cb252fa1fe5ca98b4c51f00825fae6d65a38c8506c676804cdcce531361ce5e0e29f3b4162f858610780a17b0d7176e8b69b47107779bc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
412KB

MD5
3db42af938a9533859e3d625122ce885

SHA1
544c046495b5045c95bcf8d9df0ac7f2803705e4

SHA256
bbfb778b50f68f51b12d0d117249b4a97858f510917e5adcc135adf44d225e23

SHA512
1497b1b02436153471a4425fee1891b428438e3f894bd98de99b64194b0b5e1bdd0a68351b874c2fd70e183d4d23dd8d7adc0e036fc478e07769ec631e0faed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
411KB

MD5
f60eeab71d31bff5f5e47f4565f0272a

SHA1
12243156b970151ea7df925fadc2dfb4104ba18c

SHA256
ddbb5a326d211d80ca3b61bed7a62903eb13bbad9619df688aba3b3c2e67f2ea

SHA512
ecaeb1fcbbaa2cccb1b2b5f39f3e15895fa1ef46736df258ce404c012b312c5688f18f663e7583700fa8f9f571323f63ff89d83c6dc7978a5862019e6c700868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
418e947a7082b4641950bc61e425cfb9

SHA1
4b17b82819ab8cd28ae08f9fc433ebaceb0ccd20

SHA256
8c7c4c63a13d1be84b5a9dd9ac6a7ae6f0ff9382af78ae93d1830ede96448ba4

SHA512
9220aa71f4b0876c79abd04c476edd4be3b4dc72669e4028883f4c13fa06a161a115f3a31d4b50e407586ec52959adfc8ce68f8d562b9e665d59ae26f93cd474

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0fc5b3b-1c80-48cb-a8d2-b43051a74a70\index-dir\the-real-index

Filesize
2KB

MD5
7bf9854b91d1e310dc475540d53c0cae

SHA1
486fab5f1de223bd168fc95d025012c5120317a0

SHA256
8cf8af6483b921a4b0e5b346e6a8eaa7f85c9e538613b3a0728bcb21e3494301

SHA512
9f9d7a9ec82b6217ccfadddccade90ba2c8d27c48baf3ed8f8a4c351169e07753e229ea66426b1a8016cd711a6e13e474c171252df9317b6b4e531d7054504f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0fc5b3b-1c80-48cb-a8d2-b43051a74a70\index-dir\the-real-index~RFe5c3ddb.TMP

Filesize
2KB

MD5
ba0d01196bf78dbb4ea1c039022d0722

SHA1
0bdbb6dada83141462e7013af0abb8694feae01e

SHA256
05397f2384d3865d890de904b3063180a7042a2694f219ef66198e14f960b6d6

SHA512
67822e8bad322c5263efcf143296f9cd0edd0e79350f8a57a49321cea0998dc4a9bf04a2cb4acc90324554bcd06e57d257502069cab5a71a2d755fb8dad27a5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
253B

MD5
6de192ed117887fbfc540af28601f982

SHA1
0818e3593085642e3c20aeae2bbb54125b7a04aa

SHA256
52be783028ede9243a408d5e9fff2d844c9e2d66ae95e3b11c928c42f28cba38

SHA512
81576a5f561029b84b681cfcd33f9c2bce52e1ac2f67ed16aa08447e30ed96d4aaee26f3c015f35ff833a62ba5bba64817bfec215ca1d79ae734a6ef436d67dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
a94f70cf5e9db993b6aa2fac5865154c

SHA1
f2b0982e25ca0c94320995b84dfa17804f67f5c1

SHA256
5017c400f467a06ea3fc17b44eeb22d6c69b75a2bcdfd06020ea7a79b5a17080

SHA512
82ee7b2fd168efcc1b141e09cc9f7b044fb1bbaf436f82d4a531a46b67d75d28fab4fa596b3e41550fcd626b25b32c3182697ca231f985e1021bd4245120b0ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log

Filesize
2KB

MD5
9b240df1b8052d617b72061b165a9d61

SHA1
39887e73c31a7db59731b92f24ab7339d7d7db1a

SHA256
9c83a1823a95bfb6992a07829f451c5aff7ffbd6cffa781ea5415f18086515ed

SHA512
d5c64a0377dcf499a9ebdbb7b3aae3da99e3db3810a51c57d95e232193effa759b8b91f9526e042dd0be7a26a7292a903e7a79d8871d8d989484f52b98813028

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\55816c50-2818-47d8-9502-ce0f863704ba.tmp

Filesize
469B

MD5
7e75972dc273027e9dd36348a358cb6a

SHA1
591e6ac9feffaf83f3fdb7c4327afa53d03534cd

SHA256
1e8bb832f05962569c39e9bd81f3c29a3558f6d34c2d2451bd12a08e82b2c919

SHA512
5ba40a99232320253813450a782a4cae4e0932ec4e441132e7ec6fa801e5f33959f30b9d948390f91400cbbfa55e2fb6c45703eb10089c459aca84c04f8478d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
951592a798e0c818aa8028b1a9374e08

SHA1
eb939b1f5ae6b3f091e90805be7d6b66860b150c

SHA256
387e59b47dc0670b1e938087661260fe415a870f3dcd15d5224d6ac25b6c6b11

SHA512
18aba0156b89fee630414164861e8415d1753d7d6e4d2d57ac14c2eb4e65bfebadc5ee0be337271f4889d7b1597aa9b3761b4c4b7b0c523104079519c5da8496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
18KB

MD5
fdf0ea3741a9e14991cc1104e74e7d9b

SHA1
8fb4f04f3d052c6093f8ad695b80afa763728f54

SHA256
fb35735576dbdc5c1d69b62589e2b0bbb2197723c48c9e79a157c615bc5f257c

SHA512
12aba0d2aad6c2dcf78d0fd08f81c98232521162ffecd191df8f5ebff17314978fe34a6953a1bfe99a1abcd7dd6c2d19f165c2e522daa562a68bc180e95ba073

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
59ea453f8c4e443f909d3d16417b7677

SHA1
98587326bb4c0aab55c98070d5101a7895054909

SHA256
dc43206d876d0f63fc916477d7fb9fb2953d1d71e5e977f43b16154c7f0c20a9

SHA512
34472d537ddc373210d3511873cf7eec7eed17470db8b32cf11280cda67f9044a717efe68c04a69d2c80007feca791f69bc0f049bf0fe7f1ac04721ebcab86e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
0f1dbab20cdf92cd53b0b85f7618ba1e

SHA1
dc60e6092ef64626d8cea59b67bbe75f9195aae3

SHA256
66c66edbbe654acfa72386ddc6edc9232af420b8f964a52d54c35e0025cab1a3

SHA512
de2c64282802cebd468fe62e8e809eed72506f352d961ef39edfcb5607f27ea82e1070453d8d7d04b02297fb4f7331849fb8bd72bdf60f7696843517b57145ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
4972c2ff135b08a8a195ba9d83a9db66

SHA1
03b77be22a2483e3e4c8ca57048ecbcf4bb685e4

SHA256
6e9b60e39b8f2fd3a7a81b92c1426cd13c1e6ffa9e39cdef223e13d43dbc332f

SHA512
c5be1dc66395d1f64735f6591b7fe05076d88752b679044854dd123e60141c0e42f5963fcec16104177a3a972ed2f855845eea48f0616576445565261e171032

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
da7a2dd582633f48c3307b4051f278c7

SHA1
177cf5edf15427128e481d2044e10b3dda718daa

SHA256
f8e3a128f81c4c9f5fba325222709a25b15f5efec73e9120cdf3fdac3952cbb7

SHA512
a303ade5d51d40eb1d4a039b93341428de9e1eddc6088f6ce95ff178e7b37a0290154e9d2151ccbc045350df2170cdd81dfd958f1272b81109aef59788d6273e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
c55def0aaaf564d970fd392ec97bb704

SHA1
94dc28b0624fb3c294f708c16ee74dafce0f9e08

SHA256
96d7d6eb29ceee7395a0b85a8b4db9944f61dac893ab4a5ee73832a55bbb5c5e

SHA512
16fb8edea257ef1cd1bbb2af1b78af255eef70ebf4f861d0af9b603ecac2443af1cfa04618db42ba8f0e58d20d837447be4b699b632645a52f899c912ee48472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.19.1\typosquatting_list.pb

Filesize
638KB

MD5
ca87451145b7744bee71724af1feca21

SHA1
3d99f1ad97326e49ef04904db63c312bd8c64612

SHA256
d03de614aecf8590e013746de46b715605b72445a14702edbda12b5ce2db3df3

SHA512
ef4a47b30b6b03bc73e4c876111af6d08f741998308bde635427d466d4800f8764ea94462f4bd9f13d21c9eff12cc3c2b8ac13433a8cef3f7aa5bc8395c4285f

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1115554892\manifest.json

Filesize
145B

MD5
d4e12ffdd8993ba5a661c6d6f631b132

SHA1
2ad30a3f86c7ce9df7a520e8a03e7d2ae0d0492b

SHA256
6c0822b52a411b119a1260d77b6e4840363639f7004fb9528895fce52012c773

SHA512
151c7557f18c8ab074d5f9a13c37f47b896c19437bd677874c0a48e06dce418ea149f84f5e27ec0f5ca0abe86317d110fa373500c36c48d6c2caeff660be13b5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1663101190\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_699667669\manifest.json

Filesize
118B

MD5
1c86577f2cd4d32c2a66df8ea2688d85

SHA1
35a17132f6e9fa4cf9f7cfb307870eef46b697f7

SHA256
312e962260bb133a4c811348a75396477d2bc284701393137cbdad971317578c

SHA512
ab8583a6c1e0f34f937296d12b9c045c99a8d5eb61fb36e797940cb0bd65f952eb99cfcd44c56ae45d6d14ff330bde0bfbd9cf5c18fb8296bf68a64b38ef7594

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_918383064\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_918383064\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
memory/4636-859-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/4636-860-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download